Boundaries
Every network that matters is divided, and every division is a rule. This is where a compromise stops being one compromised machine.
- You can explain what NAT changes and what it does not protect, and why the server's log shows the wrong address.
- You can tell a stateless rule from a stateful one, and predict which one breaks when routing is asymmetric.
A laptop is compromised by a phishing email. Nothing else is wrong: no server has been touched, no credential has been reused. Whether that incident becomes one laptop or an entire company is decided by the network's boundaries, and by whether they were ever configured with intent.
9.1NAT is translation, not protection
Your devices use private addresses that the internet does not route. Your router rewrites the source address — and, for most traffic, the source port — to its own public address, and remembers the mapping so replies can find their way back.
192.168.1.42:51544 → 203.0.113.9:41207 → server:443
← state table matches ←Two consequences follow, and both bite in practice. First, inbound connections do not exist unless you add a rule: there is no path from outside to a private address. Second, the server sees 203.0.113.9, not your laptop — so any log, allowlist, rate limit or geolocation rule based on client address is really talking about the router.
NAT blocks unsolicited inbound connections as a side effect, and people mistake that for a firewall. It is not policy, it is arithmetic: there is no translation entry, so there is nowhere to send the packet. The moment you add a port forward, that protection is gone — and a port forward to a database is a database on the internet. Protection comes from an explicit default-deny policy, not from the absence of an address.
9.2Rules: order, state, and the implicit deny
A firewall rule set is read top to bottom, first match wins, and ends with a deny that is usually invisible. That single sentence explains most firewall bugs.
| Stateless (router ACL, cloud NACL) | Stateful (firewall, security group) | |
|---|---|---|
| Each packet | Evaluated alone | Matched against a flow table |
| Return traffic | Needs its own rule | Allowed automatically |
| Classic bug | Outbound replies blocked because ephemeral ports were not permitted | Asymmetric routing means the reply never reaches the device holding the state |
| Where you meet it | Subnet level, in the cloud and on routers | Host, instance and zone level |
The cloud version of this is worth memorising, because it is a weekly incident somewhere: security groups are stateful, network ACLs are not. A rule that permits 443 inbound and nothing outbound leaves the handshake half-complete, and the security group will look perfectly correct while it happens.
9.3Zones, and the point of dividing a network
A mature design writes policy between groups of things — users, servers, guests, management, industrial equipment — rather than between individual addresses. Written between hosts, policy becomes thousands of rules nobody can review; written between zones, it stays small enough to argue about.
9.4Zero trust, stated plainly
The older model was a castle: trusted inside, hostile outside, one wall. It stopped matching reality when people worked from home, services ran in three clouds, and the phished laptop was already inside the wall.
The replacement is not a product. It is a decision: authorize each request on evidence — who, which device, which service, what data — instead of on the address it came from. In practice that means identity for both ends of a connection, policy expressed per workload rather than per subnet, and logging that assumes the request might be hostile.
The honest caveat: this is significantly more work than a perimeter, and it depends on an inventory and an identity system that many organizations do not have. Segmentation with explicit inter-zone policy is the achievable version of the same idea, and it captures most of the benefit.
A web server behind NAT logs every request from the same address. Why?
60-second recap
- NAT translates. It hides your address and does not enforce policy.
- Order and state decide. First match wins; stateful remembers, stateless does not.
- Segmentation is the goal. VLANs without policy are tidiness, not security.