Networking noob here. I want to prevent all incoming requests except through a specific port, and that traffic is forwarded to a specific device on the network. NAT seems to do that just fine, it’s almost like a kind of firewall by itself. What kind of threats are there that requires more than just NAT for security?
You must log in or register to comment.
removed by mod
This is true and typically called “Next Generation Firewall” or “Intrusion Prevention System”.
However, these have three disadvantages:
- They rely on signatures and many vendors only provide these with an active, costly subscription
- They add complexity and possible error sources and false positives.
- They require processing power and can easily reduce throughput by 90%.
These systems are quite common in enterprise scenarios, but AFAIK the exception in home labs and selfhosting environments.