Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

51–60 of 311 posts

Re: My NAS exposes itself over the internet without permission

#51

Post by bytearray64 »

ancarda wrote: post #15
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Do you have a router you recommend? Ideally something running free software

I like Mikrotik for routers. They're cheap and have a lot of knobs in the SW (maybe too many if you just want NAT). They do run linux, but their SW isn't open. I've been pairing my Mikrotik hEX with a Unifi AP. Not sure what I'll do going forward, as I've heard Mikrotik's APs aren't as good as their routing and switching hardware.

If I was going the "dedicated machine" route, I'd probably go with OPNsense nowadays.

Re: My NAS exposes itself over the internet without permission

#52

Post by uberswe »

kn100 wrote: post #44
bunnyfoofoo wrote: post #7

Earlier quoted context omitted.

Edited: deleted my comment as I was unintentionally offensive.

To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep…

I think some people miss the point of the article. That a NAS like Terramaster F2-210 shouldn't open ports externally and if they do there should be options to turn this feature off.

Re: My NAS exposes itself over the internet without permission

#53

Post by ShroudedNight »

my123 wrote: post #32
deburo wrote: post #16

Earlier quoted context omitted.

I also found this weird, and this got me to check if it was enabled on my business firewall devices: turns out they don't even support UPnP. Is it just consumer routers that support it nowadays? Shouldn't that feature just be nuked? EDIT: Well it sounds like a feature for pro users that know what they are doing and control all devices on the network. Even then, security appliances (eg. from SonicWall) don't support i…

Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...

> Notably, it is a must for VoIP

Wouldn't making STUN work be a better alternative?

Re: My NAS exposes itself over the internet without permission

#54

Post by hh3k0 »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

> If the author really cares, go one step further and replace the ISP owned router with something with more control.

I wanted to do that for a while now. Do you happen to have a good suggestion regarding whose products are worthwhile?

Re: My NAS exposes itself over the internet without permission

#55

Post by dxdm »

edoceo wrote: post #50
kn100 wrote: post #44

Earlier quoted context omitted.

To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep…

It's not offensive. But you were offended. Big difference.

I'm wondering what definition of the word "offensive" you're using.

Re: My NAS exposes itself over the internet without permission

#56

Post by KozmoNau7 »

iso1210 wrote: post #24
KozmoNau7 wrote: post #20

Earlier quoted context omitted.

You mean "enable them all over again for every new DHCP assignment, unless you insist on static IP assignments".

Why wouldn't I use static dhcp?

Forwarded ports are not always static, we're not in the world of just web servers and SSH.

Different devices may need to use VoIP, P2P, games and other applications that cannot be strictly mapped to just one system or even just one port. UPnP handles dynamic mappings, so you don't have to update your port forwards every time.

Re: My NAS exposes itself over the internet without permission

#57

Post by watermelon0 »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Sure, UPnP can open ports to the outside world, but that's something that might be desired in some cases.

However, devices should default to local access only, and offer an option to expose them to the world, with appropriate warning.

Re: My NAS exposes itself over the internet without permission

#58

Post by rubatuga »

ShroudedNight wrote: post #53
my123 wrote: post #32

Earlier quoted context omitted.

Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...

> Notably, it is a must for VoIP Wouldn't making STUN work be a better alternative?

Yes, it’s a feature supported by many VOIP clients, and this comments section is filled with UPnP apologists

Re: My NAS exposes itself over the internet without permission

#59

Post by testfoobar »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Agreed.

My router firewall drops all packets from my NAS to my WAN. Doesn’t matter what software it runs.

Re: My NAS exposes itself over the internet without permission

#60

Post by cerved »

philo23 wrote: post #41
tyingq wrote: post #29

Earlier quoted context omitted.

Where? I don't see that. What type info is below? Do you mean "mapList"? I suspect it's just what they chose to name the key. "triestimes": 3, "mapList": [ { "desc": "ftp", "nExternalPort": 6221, "nInternalPort": 21, "sProtocol": "TCP", "bEnable": 0 },...

I suspect they mean the letter prefixes: _n_ExternalPort + _n_InternalPort for number, _s_Protocol for string and _b_Enable for boolean. It's probably just a convention they use in the source code that's made its way into the JSON by serializing something? Either that or old habits die hard.

probably serialization of some object which uses hungarian notation
Post reply on HN