Why require stateful inspection?

Isn't network address translation (NAT) security in your SOHO router enough? Not anymore. NAT does a good job controlling addresses, especially when networks have multiple address ranges to manage or not enough addresses to go around. Security improves with NAT because internal IP addresses can't be seen from the outside, making them invisible to hackers.

Yet, NAT breaks some applications. FTP clients and VPN connections often have trouble, for example. And some peer-to-peer protocols and H.323 for videoconferencing require special NAT configuration to work properly. Another problem arises when connecting two networks via VPN and both ends rely on NAT to convert overlapping addresses, such as when both networks use the popular internal 10.0.0.0 network address range.

Stateful inspection goes an extra step beyond IP filtering firewalls, which automatically leave open certain port numbers for common protocols such as FTP, by forcing incoming FTP packets to match outgoing packets Stateful inspection filters track outgoing packets requesting return packets, such as FTP requests, and allow only incoming packets responding to valid requests.

Don't disable NAT, because you still get benefits through network address translation. Just don't assume using NAT today closes all your security holes.

Back to review: Secure SOHO routers