Nat reflection security Hole?
-
Hello dear Community
I give me the Question, when Nat reflection is enable, if this give me a security hole…
When i enable this i cant find a good document how it is realy work. When i access a external Adress from internal Network, is going the the Packet directly back to the Server? Or is going the Packet first to the dns Server from the Domain?
When the Packet is goint to the dns Server of the Domain whit the Statefull inspection Firewall aka dyndns, that it would be a security hole, while the firewall less the Connection open for a time.
How do Nat reflection realy work in pfsense to know the way from the Packages?
Havnt find a good answere...
Thx for explain...
Kind regards,
Divotion -
The way NAT reflection works is that the packets go to the firewall, and are then sent from the firewall to the NAT target, changed to appear as if they came from the firewall, so that replies go back through the firewall.
There is no security issue there, unless you count the loss of the client IP from the perspective of the NAT target/server. The server sees the firewall itself as the "client", not the actual IP of the client.
-
thanks for your answere!
Good to know.
best regards,
divotion
