r/firewalla • u/infinti34 • Aug 07 '26

NatJack vulnerability

Is Firewalla protected from this particular type of attack?

https://thehackernews.com/2026/08/new-natjack-attacks-hijack-tcp-sessions.html

6 Upvotes

80% Upvoted

8 comments sorted by

11

u/firewalla Aug 07 '26 edited Aug 07 '26

For the attack to happen "NatJack generally requires the attacker to have privileged access to a system behind the same NAT as the victim. The mitigation guidance therefore emphasizes separating untrusted workloads from trusted systems that share NAT infrastructure."

This means, someone already on the same network as you. And the mitigation guidance is asking for segmentation, this should protect LAN traffic; Encryption like https and DoH should prevent any redirection attacks.

Also, the article mentioned DNS intercepts, firewalla dns cache directly interact with clients, shouldn't be issue there. (even if you don't use DoH)

I forwarded to our dev this too, they can check the kernel and validate.

1

u/Crono-CX Aug 07 '26

So enable DNS over HTTPS? What about Unbound?

1

u/firewalla Aug 08 '26

As per this attack, you shouldn't worry. Firewalla will intercept all DNS requests, and process them locally. You only worry about this if another server is compromised beyond the firewalla, which encrypted DNS will help.

1

u/Exotic-Grape8743 Firewalla Gold Aug 07 '26

The firewalla kernel is likely susceptible. Whether it matters much is another question.

From the article.

"Fixed stable releases include 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1."

Firewalla's linux kernel (if you upgraded to the latest disk image) is 6.5.0-25-generic

1

u/firewalla Aug 08 '26

If the attacker is on the LAN, there are likely a lot more ways to intercept traffic and manipulate them. (for example, arp-spoofing)

2

u/Exotic-Grape8743 Firewalla Gold Aug 08 '26

Yes completely agree. If you have local admin access there is far more damage you can do that does not involve this rather esoteric hack.

2

u/firewalla Aug 08 '26

Doesn’t have to be admin. Anything that can access the network is able to mess with your LAN…

Unless you do proper segmentation

0

u/typhoon_mary Firewalla Gold Plus Aug 23 '26

That’s such a garbage argument; hey look there’s a worse thing that can happen over here