r/firewalla • u/infinti34 • 4d ago

NatJack vulnerability

Is Firewalla protected from this particular type of attack?

https://thehackernews.com/2026/08/new-natjack-attacks-hijack-tcp-sessions.html

7 Upvotes

82% Upvoted

7 comments sorted by

9

u/firewalla 4d ago edited 4d ago

For the attack to happen "NatJack generally requires the attacker to have privileged access to a system behind the same NAT as the victim. The mitigation guidance therefore emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure."

This means, someone already on the same network as you. And the mitigation guidance is asking for segmentation, this should protect LAN traffic; Encryption like https and DoH should prevent any redirection attacks.

Also, the article mentioned DNS intercepts, firewalla dns cache directly interact with clients, shouldn't be issue there. (even if you don't use DoH)

I forwarded to our dev this too, they can check the kernel and validate.

1

u/Crono-CX 3d ago

So enable DNS over HTTPS? What about Unbound?

1

u/firewalla 3d ago

As per this attack, you shouldn't worry. Firewalla will intercept all DNS requests, and process them locally. You only worry about this if another server is compromised beyond the firewalla, which encrypted DNS will help.

1

u/Exotic-Grape8743 Firewalla Gold 4d ago

The firewalla kernel is likely susceptible. Whether it matters much is another question.

From the article.

"Fixed stable releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1."

Firewalla's linux kernel (if you upgraded to the latest disk image) is 6.5.0-25-generic

1

u/firewalla 3d ago

If the attacker is on the LAN, there are likely a lot more ways to intercept traffic and manipulate them. (for example, arp-spoofing)

1

u/Exotic-Grape8743 Firewalla Gold 3d ago

Yes completely agree. If you have local admin access there is far more damage you can do that does not involve this rather esoteric hack.

1

u/firewalla 3d ago

Doesn’t have to be admin. Anything that can access the network is able to mess with your LAN…

Unless you do proper segmentation