is enabling firewall necessary (same for upnp) when on a provider with cgnat?

[lgkahn]

currently on one of my routers (on starlink) with cgnat I have not enabled the firewall..
I believe it is not necessary as nothing can come in from the outside that was not initiated internally anyway..

Is there any real reason i need to enable the firewall?

Searched and did not see an similar thread regarding this question?

 

[jetpack42]

I would argue that you should leave the firewall enabled. NAT is not a firewall or a firewall equivalent.

 

[Tech9]

I believe it is not necessary as nothing can come in from the outside

Perhaps nothing can come from Internet, but something may come from inside the CGNAT network. Keep it enabled.

 

[Treadler]

IMHO, firewall should always be enabled.

 

[Tech9]

@lgkahn may be good friends with all the ISP subscribers or they may have signed mutual trust agreement, who knows?

 

[lgkahn]

every firewall checker i have ran show no ports open or security issues with cginat and the firewall off. i guess is the few people that possibly are sharing my not public ip may be able to get some sort of access if they can figure that out.. but i doubt it as dont know how they would and even when i run it (on the same ip) nothing gets in.

i guess it would stop misconfigurations or infected devices inside the network from getting out but not too worried about that.