Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serveo: Expose Local Servers to the Internet

serveo.net

Post reply on HN
Print view View original

51–60 of 122 posts

Re: Serveo: Expose Local Servers to the Internet

#51

Post by zAy0LfpBZLC8mAC »

ComodoHacker wrote: post #48
zAy0LfpBZLC8mAC wrote: post #41

Earlier quoted context omitted.

No, NAT does not prevent connections, it only rewrites addresses. If your NAT router also has a stateful firewall, that is what prevents inbound connections, and removing the NAT from that equation does not change that.

The point is NAT is actually a couple of rules in router's stateful firewall, it is done by firewall, and firewall can't do it without explicit configuration. There can't be 'default allow NAT' config.

... which doesn't change that that "default allow" firewall will still pass through all packets, and thus allow access to all your internal devices/machines? Absence of NAT rules does not prevent packets from passing through the firewall, it only prevents rewriting of addresses.

Re: Serveo: Expose Local Servers to the Internet

#52

Post by indigo945 »

TrueDuality wrote: post #32
ultrarunner wrote: post #28

Earlier quoted context omitted.

“The masses” don’t deploy http servers. They don’t need to implement tls. The fact is that something struck a nerve and motivated the people who handle this to implement TLS. Whether that’s tech-minded understanding or consumer-fomented demand channeled through CTOs, I don’t really care. Let’s Encrypt founders didn’t sit down one day with a master business plan of getting rich off free certs. I wouldn’t be the least…

LetsEncrypt was likely accelerated by the Snowden leaks, but the discussions around free community run CAs were around long before that precipitous event. For CloudFlare it was likely just an effective way to drive additional business to them while pursuing their business model. I don't think "the masses" fall into the equation at all and likely haven't even really noticed the change besides the "This site isn't safe…

If LetsEncrypt was accelerated by the Snowden leaks, that's a rather sad result. After all, it is absolutely trivial for a nation-state actor to generate SSL certificates for any domain they like, due to the broken state of global PKI. It is sufficient to gain access to any root certificate, or to know a person at a CA that can issue certificates, or to be able to manipulate the domain's nameserver, or to take over the server pointed to by the domain's A record, or to redirect traffic to that server to a middleman at the ISP level, in order to issue a perfectly valid, HSTS-accepted certificate.

SSL helps against the skript kiddie at your local Starbucks, not against the NSA.

(Of course, not being able to monitor and log all web traffic all the time must be a slight inconvenience, especially after the TLS 1.3 SAN changes. But we still shouldn't fool ourselves that just because we can't break it, the NSA can't either.)

Re: Serveo: Expose Local Servers to the Internet

#53

Post by satori99 »

ultrarunner wrote: post #28
TrueDuality wrote: post #25

Earlier quoted context omitted.

Honestly I think the adoption of TLS has more to do with free certificates from LetsEncrypt and CloudFlare than the Snowden leaks. As much as I'd like to think people were concerned about the privacy of their communications... I don't think most of the masses actually care about security or avoid conveniences based on threats to their privacy...

“The masses” don’t deploy http servers. They don’t need to implement tls. The fact is that something struck a nerve and motivated the people who handle this to implement TLS. Whether that’s tech-minded understanding or consumer-fomented demand channeled through CTOs, I don’t really care. Let’s Encrypt founders didn’t sit down one day with a master business plan of getting rich off free certs. I wouldn’t be the least…

> “The masses” don’t deploy HTTP servers.

In a way they do...

Every UPnP device is also a HTTP server (listening for SOAP requests), as are many other IoT devices.

I have two light bulbs in my room that are both running HTTP servers.

“The masses” are definitely deploying this type of HTTP server frequently

Re: Serveo: Expose Local Servers to the Internet

#54

Post by neilv »

rohan1024 wrote: post #8

NAT has crippled the Internet. We are permanently dependent on public facing servers to route packets from one device to the other. This service is absolutely not needed in a non-NAT world. And I strongly believe we have lost a lot by being completely dependent on client-server model of Internet. I've written more about it here https://www.ankshilp.in/post/the_broken_promise_of_internet/

My first always-on home Internet was ADSL that came with 2 static IPv4 addrs and no filtering. I ran a server for my own needs, including hosting my own SMTP server, SSH, and SCM for my home directory&projects replication&backup.

At one point, I temporarily hosted a friend's server on my home second IP addr, while he was moving apartments and had a long lead time to move SDSL to the new place. Unbeknownst to me, it wasn't just an email server, but, I learned after the fact, was also hosting a political activism Web site, advocating freeing a person who was in trouble with a government. (I assume friend didn't tell me in an attempt to not to involve me in any possible government disfavor, though I really wished he'd found a different way to host that.)

This was before such activism was done by letting 'social media' companies own and intimately monitor the network and organizing/communications of people involved/interested in any movement. But earlier wasn't ideal either: if you wanted a decent Internet presence, including with your own domain name, you might've had to know how to set up a server, and be able to afford to operate it.

Re: Serveo: Expose Local Servers to the Internet

#55

Post by zAy0LfpBZLC8mAC »

AmericanChopper wrote: post #50
zAy0LfpBZLC8mAC wrote: post #47

Earlier quoted context omitted.

> It allows you to connect a private network to any other network, including the internet, without allowing hosts on that network access to hosts on the private network. So, how does it do that? > What is your justification for saying that access control measures are not security controls? I am not saying that. It simply isn't an access control measure.

> So, how does it do that? By rewriting the IP headers of packets as they traverse routing devices. If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought. > It simply isn't an access control measure. Then why can’t other internet connected devices connect to my internet connected laptop? If I’d connected my laptop directly to my ISP then they…

> By rewriting the IP headers of packets as they traverse routing devices.

How does that prevent hosts on that other network from accessing hosts on your "private network"? Like, a packet addressed to one of the hosts on your "private network" arrives at your NAT gateway from the "other network". How does the NAT rewrite the IP headers, and how does that provide access control?

> If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought.

Even that would not be contrived. If removing the NAT function does not change the security functions of a router, then the NAT obviously does not provide security, at best it implies the presence of certain security functions. But even that just isn't the case.

> But I didn’t do that, I connected my home router to my ISP, and I connected my laptop to my home router, which is providing access control for me.

Then that presumably is because your home router provides access control? What does that have to do with NAT, though?

Re: Serveo: Expose Local Servers to the Internet

#56

Post by AmericanChopper »

zAy0LfpBZLC8mAC wrote: post #55
AmericanChopper wrote: post #50

Earlier quoted context omitted.

> So, how does it do that? By rewriting the IP headers of packets as they traverse routing devices. If you’re trying to say that all NAT devices are stateless firewalls, then your point is even more contrived than I first thought. > It simply isn't an access control measure. Then why can’t other internet connected devices connect to my internet connected laptop? If I’d connected my laptop directly to my ISP then they…

> By rewriting the IP headers of packets as they traverse routing devices. How does that prevent hosts on that other network from accessing hosts on your "private network"? Like, a packet addressed to one of the hosts on your "private network" arrives at your NAT gateway from the "other network". How does the NAT rewrite the IP headers, and how does that provide access control? > If you’re trying to say that all NAT…

Because without NAT, none of the devices on my home network would be able to connect to any internet connected hosts. That is, unless I assigned internet routable addresses to their network interfaces. If I did that, I’d either have to install firewalls on my devices, or expose all services running on my devices to the internet. But I don’t have to do that, because my home router uses NAT to allow all devices on my home network to connect to the internet, without allowing other devices on the internet inbound access.

If you have a point to make, then explain what it is. If you’re just gonna keep asking more contrived questions then I’ll presume you’re simply trolling.

Re: Serveo: Expose Local Servers to the Internet

#58

Post by ComodoHacker »

zAy0LfpBZLC8mAC wrote: post #51
ComodoHacker wrote: post #48

Earlier quoted context omitted.

The point is NAT is actually a couple of rules in router's stateful firewall, it is done by firewall, and firewall can't do it without explicit configuration. There can't be 'default allow NAT' config.

... which doesn't change that that "default allow" firewall will still pass through all packets, and thus allow access to all your internal devices/machines? Absence of NAT rules does not prevent packets from passing through the firewall, it only prevents rewriting of addresses.

The point you were objecting to was "external device can't connect to a device behind NAT without explicit configuration". Without NAT rules access to internal devices is prevented because packets don't get routed to private IPs.

Re: Serveo: Expose Local Servers to the Internet

#59

Post by phate »

dboreham wrote: post #37
rohan1024 wrote: post #16

Earlier quoted context omitted.

The original purpose of NAT was to get additional devices connected to Internet since we had shortage of Ipv4 addresses. For security, we have firewalls. If we had not been dependent on NAT for security, firewalls would have been actually configured. We will have to configure firewalls with ipv6 anyway.

NAT arose long before any address shortage concerns. Rather it was a response to ISPs attempting to charge "per user" by associating a fee with each additional address (note this is long before residential ISP service we know today: Internet service was for businesses with retail subs only having ppp access via dialup). NAT allowed customers to work around the ISPs pricing model at the time.

When my family first got broadband via Comcast@home back in the early 2000s they had a proviso saying if you wanted more then one computer required a separate subscription. My dad and my bother quickly figured out we could get around this by using Windows Internet Connection Sharing. We eventually got a Linksys Router that did the same job and was faster. IIRC even most dial up ISPs did the same thing, if you wanted more then one computer online you had to use separate creds.

Re: Serveo: Expose Local Servers to the Internet

#60

Post by stepbeek »

smittywerben wrote: post #31
jarcane wrote: post #22

Earlier quoted context omitted.

I honestly think the fault here is not technical, it's ISPs. Between the RIAA/MPAA breathing down their necks about piracy, and the realization they could make a mint charging inflated "business rates" than letting you do what you wanted with your own damn internet connection, shit got locked up tight so fast no one even noticed. It's not NAT that's why my ISP is blocking half the protocols on the Internet. Why every…

> Why I'd need to us a fucking VPN tunnel just to get SSH to my home computer. My most recent disappointment was trying to mount an Azure SMB 3.0 network drive over port 445. It would function just like a network drive at work or school right? No more poorly made userland daemons i.e. Dropbox. Or any additional software, VPN, proxy, or admin rights for that matter. Just click “add network drive” button in explorer an…

I ran into this with a client recently. Unfortunately, they were already on the business plan.

We ended up just hosting an OpenVPN server and having them connect automatically on startup.... This then broke Microsoft Office's ability to verify it still has a paid subscription.

Post reply on HN