> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
> If the author really cares, go one step further and replace the ISP owned router with something with more control. I wanted to do that for a while now. Do you happen to have a good suggestion regarding whose products are worthwhile?
Its muddy right now, I run Ubiquiti EdgeMAX switches and EdgeRouter at home, but I wouldn't recommend them right now (see another comment of mine, or check out the subreddit), for NAS I run TrueNAS, on a home built server.
It's not offensive. But you were offended. Big difference.
I'm wondering what definition of the word "offensive" you're using.
To be very exact, being offended is a choice, in that nobody can offend you if you don't let them. You can always choose to not take offense. (The statement in question does seem rude and dismissive to me, however.)
> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
> If the author really cares, go one step further and replace the ISP owned router with something with more control. I wanted to do that for a while now. Do you happen to have a good suggestion regarding whose products are worthwhile?
Up until a week ago I would have suggested the UniFi. Since the latest snafu, the handling of the breach not the breach itself, I’m not so sure anymore what would be the best alternative. Perhaps just their EdgeRouter devices or a mikrotik device.
> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
The issue is letting untrusted or badly behaved devices on the network. UPnP works great, if you control which devices get on your network . Static port forwarding combined with DHCP gets annoying quickly, you end up having to set up static assignments for every device that may need a port forwarded, which can be a lot, with modern multiplayer gaming and p2p. And for applications that select a random port on startup,…
> And for applications that select a random port on startup, such as some bittorrent clients, you either have to manually forward the port every time or select a static port.
What if you run them over a VPN? I don’t use torrents much but have a client containerised with OpenVPN. I’m not a networking expert but I had assumed (with all the dangers that comes with) that this moved the problem to the VPN provider?
"CAN USER NAME AND PASSWORD OF TNAS ADMINISTRATOR BE CHANGED? Administrator’s username is admin and the initial password is admin as well. " https://www.terra-master.com/us/faq/category/detail/?id=3303 Oy.
“Users can change the password of administrator but cannot change the administrator’s username.
> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.
NAT can mean 2 things, 1 to 1, and 1 to many. Firewall is a concept not a thing.
IPv6 could be set up so every computer has an internal address and you choose to map external to internet using 1 to 1 NAT.
Edited: deleted my comment as I was unintentionally offensive.
To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep…
It was clear you didn't want to disable UPnP support on the entire network, but I couldn't tell whether you'd tried disabling it on the NAS.
Does the following disable the FS2-210's local UPnP?
Go to TOS Desktop> Control Panel> Network Services> Discovery Service> UPnP Discovery > Uncheck "Enable UPnP discovery service"
> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
Sure, UPnP can open ports to the outside world, but that's something that might be desired in some cases. However, devices should default to local access only, and offer an option to expose them to the world, with appropriate warning.
This is exactly my opinion and exactly how I use uPnP. I can't control exactly what runs on my network since I'm not the only one using it, but I can guard certain parts of my network more thoroughly.
There is a distinct whiff of Docker to the ports it’s using. But maybe I’ve been too far down that hole and am just seeing things though Docker tinted spectacles.