NAT is not a firewall

I’m having trouble getting a Linksys USB wireless adapter to connect to my network, so I called Linksys tech support. Besides not fixing my problem, the support tech told me repeatedly that I don’t need to use a firewall because my Linksys router contains one.

Many vendors of home networking equipment advertise that their broadband routers contain a built-in firewall to enhance security. What they are referring to is a technology called Network Address Translation (NAT). A NAT router simply denies incoming traffic that it doesn’t understand. That’s one function of a firewall, but not the only one.

NAT is the technology that lets more than one computer share an Internet connection with only a single IP address. The Internet Connection Sharing feature that comes with recent versions of Windows is a NAT router. A very simplistic description of how NAT works is that none of the computers behind the router is on the public Internet. The router forwards outgoing requests from computers out to the Internet. When the server replies, the NAT router remembers which machine it was that made the request and forwards the reply back to it.

If network traffic comes into the NAT router that isn’t the result of a machine making an outbound request, the NAT router doesn’t know where to send that network traffic. So that traffic gets ignored. It doesn’t get sent anywhere at all. The fact that an outside computer can’t arbitrarily connect to computers behind the NAT router is a byproduct of how NAT works and is why the router companies call their products firewalls.

The protection offered by NAT is very limited. It will keep an attacker from sending Messenger popup spams to your computer. It will keep people from connecting to services and backdoors installed on your computer. But it won’t keep trojans, viruses, and other malicious software from connecting to the Internet from your computer. It won’t prevent unauthorized network traffic from leaving your computer and going onto the Internet. That’s what modern firewalls do.

I know someone will point out that my description of NAT is a gross simplification and isn’t entirely accurate, so I’m going to mention up front that I know that. But it does explain the concepts of NAT, why vendors call it a firewall, and why it isn’t good enough security by itself. If you want, you can read more about how NAT works, including all sorts of highly technical details about packet routing, different forms of NAT, and how Linux implements NAT. Netgear also makes a home router that also contains a true firewall, so their Web site explains the differences.