NAT is not a firewall

Freshness Warning
This blog post is over 18 years old. It's possible that the information you read below isn't current and the links no longer work.

I’m having trouble getting a Linksys USB wireless adapter to connect to my network, so I called Linksys tech support. Besides not fixing my problem, the support tech told me repeatedly that I don’t need to use a firewall because my Linksys router contains one.

Many vendors of home networking equipment advertise that their broadband routers contain a built-in firewall to enhance security. What they are referring to is a technology called Network Address Translation (NAT). A NAT router simply denies incoming traffic that it doesn’t understand. That’s one function of a firewall, but not the only one.

NAT is the technology that lets more than one computer share an Internet connection with only a single IP address. The Internet Connection Sharing feature that comes with recent versions of Windows is a NAT router. A very simplistic description of how NAT works is that none of the computers behind the router is on the public Internet. The router forwards outgoing requests from computers out to the Internet. When the server replies, the NAT router remembers which machine it was that made the request and forwards the reply back to it.

If network traffic comes into the NAT router that isn’t the result of a machine making an outbound request, the NAT router doesn’t know where to send that network traffic. So that traffic gets ignored. It doesn’t get sent anywhere at all. The fact that an outside computer can’t arbitrarily connect to computers behind the NAT router is a byproduct of how NAT works and is why the router companies call their products firewalls.

The protection offered by NAT is very limited. It will keep an attacker from sending Messenger popup spams to your computer. It will keep people from connecting to services and backdoors installed on your computer. But it won’t keep trojans, viruses, and other malicious software from connecting to the Internet from your computer. It won’t prevent unauthorized network traffic from leaving your computer and going onto the Internet. That’s what modern firewalls do.

I know someone will point out that my description of NAT is a gross simplification and isn’t entirely accurate, so I’m going to mention up front that I know that. But it does explain the concepts of NAT, why vendors call it a firewall, and why it isn’t good enough security by itself. If you want, you can read more about how NAT works, including all sorts of highly technical details about packet routing, different forms of NAT, and how Linux implements NAT. Netgear also makes a home router that also contains a true firewall, so their Web site explains the differences.

October 8, 2003 1:43 PM

But what piece of (preferably free or at least low cost) software is the appropriate addition to the router's protection?

Adam Kalsey
October 9, 2003 11:21 AM

The free version of ZoneAlarm works well, and the Pro version is only $40. Recent releases of ZoneAlarm Pro have been aimed at the consumer with privacy protections and ad-blocking features built in. But Pro is also useful if you need more control over your network settings, like allowing machines from certain subnets to access your computer but denying all others.

Trackback from Kalsey Consulting Group :: Measure Twice
October 9, 2003 11:30 AM

Personal firewall advantages

Excerpt: A NAT router cannot is protect computers on your network from the other computers on your network.

October 9, 2003 1:05 PM

Thanks Adam. The problem I had with ZA free in my last PC was a conflict with the Linksys router, but also this PC is running WinXP which has a firewall running too. Do you have any good references (mag articles or similar) that explore this topic in more detail?

Chris Vance
October 9, 2003 8:55 PM

Bill, Kevin Rose and the TechTV staff recently reviewed firewalls. Their top picks were ZoneAlarm Pro and McAfee Personal Firewall Plus. The article is at,24330,3522872,00.html I personally run the D-Link 604 (4 port, NAT, no SPI) and the free version of ZoneAlarm. I can't say that I've taken issue with anything (although I generally "unload" ZA when playing games online, and DMZ my comp when hosting (56K modem players playing Sierra's Swat3 complain of lag when playing games hosted by a firewalled host)). I don't think that ZA and the router are working the best together (could be better, I suppose), but I can't complain. What specific problem did you find with ZA free and the Linksys router?

October 10, 2003 8:52 AM

Problem was my PC could not see the Internet, mail and browser didn't work, but this was intermittent yet frequent. That PC was running Win2000 and I've recently moved to WinXP, so perhaps the builtin firewall in XP is good enough on top of the NAT?

November 17, 2003 4:41 PM

I have a question regarding Zonealarm and a NAT Router. How do you differentiate between another computer an the network and the actual internet connection? In other words how do I separate the internat connection (dsl) into the internet zone and the other computers on my network into the trusted zone? Since zonealrm sees them as the same network.

November 30, 2004 2:54 AM

Unistall Zone Alarm while establishing internet connection then reinstall and it will detect the connection. Set the internet connection as "internet" when Zone Alarm asks not "trusted". Set LAN connections as "trusted".

June 18, 2005 8:20 AM

the thing is tho, wether you have a hardware firewall (router), or a software firewall, you have to allow some ports in (for games, software, or p2p)... and thats where they get you.. i currently have 5ports forwarded to my family pc and 200 to my personal pc... and thats how the intruders will get in, by finding those ports, other then that, your safe from external..and configuring those ports is a PAIN with software firewall, with linksys its REALLY easy true you cant stop traffic out, like zonealarm, but if your computer has good av and spyware protection, you dont need to. on my linksys 4port router w/ wireless (b), all my ports are stealthed except 1, and i am thinking on getting that one stealthed to, whereas many software firewalls just close, not stealth.

Raven Lee
June 8, 2007 7:28 AM

Like Windows Firewall. *cough* You are under the assumption that because it only acts in one direction, it can't be termed a firewall. Windows Firewall is a firewall. Just as nat routers double as firewalls. Perhaps, not as complete as Kerio Personal Firewall, ZA, Cisco PiX, etc. But, a firewall. And not only are nat routers firewalls, they are very good firewalls. They stealth every port by default. "...It will keep people from connecting to services and backdoors installed on your computer. But it won’t keep trojans, viruses, and other malicious software from connecting to the Internet from your computer. It won’t prevent unauthorized network traffic from leaving your computer and going onto the Internet. That’s what modern firewalls do...."

April 4, 2008 2:16 AM

If one is conducting online firewall tests(ShieldsUp or pcflank) from behind a NAT router ,are results affected? How to get around it?(I use Netveda as software firewall).

This discussion has been closed.

Recently Written

The Trap of The Sales-Led Product (Dec 10)
It’s not a winning way to build a product company.
The Hidden Cost of Custom Customer Features (Dec 7)
One-off features will cost you more than you think and make your customers unhappy.
Domain expertise in Product Management (Nov 16)
When you're hiring software product managers, hire for product management skills. Looking for domain experts will reduce the pool of people you can hire and might just be worse for your product.
Strategy Means Saying No (Oct 27)
An oft-overlooked aspect of strategy is to define what you are not doing. There are lots of adjacent problems you can attack. Strategy means defining which ones you will ignore.
Understanding vision, strategy, and execution (Oct 24)
Vision is what you're trying to do. Strategy is broad strokes on how you'll get there. Execution is the tasks you complete to complete the strategy.
How to advance your Product Market Fit KPI (Oct 21)
Finding the gaps in your product that will unlock the next round of growth.
Developer Relations as Developer Success (Oct 19)
Outreach, marketing, and developer evangelism are a part of Developer Relations. But the companies that are most successful with developers spend most of their time on something else.
Developer Experience Principle 6: Easy to Maintain (Oct 17)
Keeping your product Easy to Maintain will improve the lives of your team and your customers. It will help keep your docs up to date. Your SDKs and APIs will be released in sync. Your tooling and overall experience will shine.


What I'm Reading


Adam Kalsey

+1 916 600 2497


Public Key

© 1999-2022 Adam Kalsey.