My NAS exposes itself over the internet without permission • Hacker News Board

Re: My NAS exposes itself over the internet without permission

#31

Post by stonesweep » Sat, Apr 03, 2021, 5:09 PM UTC

LeanderK wrote: post #22

I use a lot of software/devices which I think is using UPnP (airplay, airdrop, pioneer dj pro link, maybe the printer etc.). There's talk here about disabling UPnP but does that mean that the devices wouldn't be able to find each other? I don't want to babysit my router. Or aren't they using UPnP? Quick googling wasn't successful. I thought most of those autodiscover-services use UPnP.

"It depends" as not all the names you listed as examples use the same technology, but in general "UPNP is more useful for thins which need an incoming connection" (kinda sorta). This might be, say, a bittorrent client needing to allow other clients in on a port to share the file... sharing. To share. :) If you understand how Active vs Passive FTP works and how the incoming connections might need to be tracked (nf_conntrack for Linux folks), UPNP is more like that - apps which handle bi-directional conversations with the outside world beyond your router.

Airdrop uses an ad-hoc WiFi network (peer-to-peer) with TLS, as does I think (Android) Beam. If I'm not mistaken some other devices in this area (Chromecast, Roku, etc.) use similar techniques, and sometimes leverage bluetooth ad-hoc networks. Discovery services like printers and fileshares tend to use (I'm assuming you're macOS) Bonjour (Rendezvous, renamed awhile back), which is sort of like an ad-hoc multicast (mDNS) solution if I understand it. On Windows it would use something like Netbios - conceptually the same. I just set a static IP on my wifi printer and call it a day, it's trivial stuff being a printer.

Re: My NAS exposes itself over the internet without permission

#32

Post by my123 » Sat, Apr 03, 2021, 5:11 PM UTC

deburo wrote: post #16

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

I also found this weird, and this got me to check if it was enabled on my business firewall devices: turns out they don't even support UPnP. Is it just consumer routers that support it nowadays? Shouldn't that feature just be nuked? EDIT: Well it sounds like a feature for pro users that know what they are doing and control all devices on the network. Even then, security appliances (eg. from SonicWall) don't support i…

Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network)

Without UPnP, you specifically have to configure your NAT for this...

Re: My NAS exposes itself over the internet without permission

#33

Post by sdflhasjd » Sat, Apr 03, 2021, 5:11 PM UTC

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

UPNP is pretty important for a lot of online games.

Re: My NAS exposes itself over the internet without permission

#34

Post by anonymousiam » Sat, Apr 03, 2021, 5:14 PM UTC

annoyingnoob wrote: post #23

ancarda wrote: post #15

Earlier quoted context omitted.

Do you have a router you recommend? Ideally something running free software

OPNsense or pfSense

I have used both OPNsense and pfSense. I currently OpenWRT which I find to be full featured, secure, and lightweight.

Re: My NAS exposes itself over the internet without permission

#35

Post by alias_neo » Sat, Apr 03, 2021, 5:14 PM UTC

ancarda wrote: post #15

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Do you have a router you recommend? Ideally something running free software

Hardware wise, I run Ubiquiti EdgeMAX but I wouldn't recommend them anymore, their software has gone down hill since many of their best developers left.

Software wise, pfSense is where it's at, but I don't have experience with their own hardware other than the ones we ran at work all failed due to a silicon flaw in the Intel SoCs they ran.

Re: My NAS exposes itself over the internet without permission

#36

Post by Iolaum » Sat, Apr 03, 2021, 5:14 PM UTC

ancarda wrote: post #15

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Do you have a router you recommend? Ideally something running free software

Look at the range of devices from GL.inet. They run a custom version of openwrt with a nice UI on top. But most are upstreamed and you can flash vanilla openwrt on them. They re quite cheap as well. I m not affiliated with them but I have bought devices from them. I use one between the router s ISP and my home network.

Re: My NAS exposes itself over the internet without permission

#37

Post by Spivak » Sat, Apr 03, 2021, 5:15 PM UTC

sdflhasjd wrote: post #33

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

UPNP is pretty important for a lot of online games.

Yeah, you can’t really “manage your firewall” when consumer software doesn’t open fixed ports and assumes upnp.

Re: My NAS exposes itself over the internet without permission

#38

Post by kitsunesoba » Sat, Apr 03, 2021, 5:15 PM UTC

sandreas wrote: post #27

Once more a sad story about so called plug and play devices doing weird stuff. I prefer getting my hands a bit dirty using: - FreeNAS / NAS4free / OpenMediaVault (for Home-NAS) - OpenWRT / OPNsense / PFSense (for Home-Firewall) Nearly Plug and play with this Hardware: - Dell T20 / T30 / T40 - HP Microserver N54L / Gen8 / Gen10 - Linksys WRT 1200 / 1900 / 3200 / 32X (https://dc502wrt.org/) - Alix APU

Been running a T20 w/4x 4TB HDs with plain FreeBSD for a few years now and it works pretty well. I'm barely even competent when it comes to sysadmin sorts of things, but it was pretty easy to get set up following a blog post I found years ago.

The consistency of FreeBSD is a real benefit here — it's well documented to begin with, and since things change so little between releases, bits and pieces you find online are largely still relevant even if they're a little old.

Re: My NAS exposes itself over the internet without permission

#39

Post by Tepix » Sat, Apr 03, 2021, 5:15 PM UTC

sdflhasjd wrote: post #33

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

UPNP is pretty important for a lot of online games.

Which ones? I have it turned off and haven't had any issues with games.

Re: My NAS exposes itself over the internet without permission

#40

Post by nobody9999 » Sat, Apr 03, 2021, 5:16 PM UTC

my123 wrote: post #32

deburo wrote: post #16

Earlier quoted context omitted.

I also found this weird, and this got me to check if it was enabled on my business firewall devices: turns out they don't even support UPnP. Is it just consumer routers that support it nowadays? Shouldn't that feature just be nuked? EDIT: Well it sounds like a feature for pro users that know what they are doing and control all devices on the network. Even then, security appliances (eg. from SonicWall) don't support i…

Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...

>Without UPnP, you specifically have to configure your NAT for this...

While I realize that configuring nftables/iptables is beyond most folks, there are many firewalls out there that have a GUI/webui which makes this dead simple.

Not sure why this should be an issue in 2021, except for users' trained-in helplessness.