Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

81–90 of 311 posts

Re: My NAS exposes itself over the internet without permission

#81

Post by atmosx »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Indeed, UPNP effectively turns on "auto-pilot". The fridge running on 10 years old firmware might open ports dynamically.

Networks featuring UPNP should be marked as "open/insecure".

Re: My NAS exposes itself over the internet without permission

#82

Post by nullify88 »

sdflhasjd wrote: post #47
Tepix wrote: post #39

Earlier quoted context omitted.

Which ones? I have it turned off and haven't had any issues with games.

Games that use Peer-to-peer lobbies instead of dedicated servers, more popular with multiplayer co-op games. Typically, it can be possible to join another lobby, but impossible to host (insofar as other people can't connect to it)

Lets not forget about consoles too. Xbox Live and PSN complain about obstructive NAT configurations and rely upon uPnP to open ports.

Of course they can be opened manually but that assumes some technical experience, and that the ISP provided hardware gives you access to its configuration.

Re: My NAS exposes itself over the internet without permission

#83

Post by daniellarusso »

alias_neo wrote: post #62
hh3k0 wrote: post #54

Earlier quoted context omitted.

> If the author really cares, go one step further and replace the ISP owned router with something with more control. I wanted to do that for a while now. Do you happen to have a good suggestion regarding whose products are worthwhile?

Its muddy right now, I run Ubiquiti EdgeMAX switches and EdgeRouter at home, but I wouldn't recommend them right now (see another comment of mine, or check out the subreddit), for NAS I run TrueNAS, on a home built server.

For your NAS, to you have a mobo and case recommendation?

Re: My NAS exposes itself over the internet without permission

#84

Post by ryandrake »

kitsunesoba wrote: post #38
sandreas wrote: post #27

Once more a sad story about so called plug and play devices doing weird stuff. I prefer getting my hands a bit dirty using: - FreeNAS / NAS4free / OpenMediaVault (for Home-NAS) - OpenWRT / OPNsense / PFSense (for Home-Firewall) Nearly Plug and play with this Hardware: - Dell T20 / T30 / T40 - HP Microserver N54L / Gen8 / Gen10 - Linksys WRT 1200 / 1900 / 3200 / 32X (https://dc502wrt.org/) - Alix APU

Been running a T20 w/4x 4TB HDs with plain FreeBSD for a few years now and it works pretty well. I'm barely even competent when it comes to sysadmin sorts of things, but it was pretty easy to get set up following a blog post I found years ago. The consistency of FreeBSD is a real benefit here — it's well documented to begin with, and since things change so little between releases, bits and pieces you find online are…

First thing I did when I got my Buffalo Terastation was look up how to install plain Debian Linux on it and set it up myself. There is usually very little benefit to using the manufacturer's neutered, cobbled-together firmware.

Same thing with my Internet router. Flash it with non-manufacturer firmware so I can configure it properly.

Re: My NAS exposes itself over the internet without permission

#86

Post by ryandrake »

kalleboo wrote: post #28
LeanderK wrote: post #22

I use a lot of software/devices which I think is using UPnP (airplay, airdrop, pioneer dj pro link, maybe the printer etc.). There's talk here about disabling UPnP but does that mean that the devices wouldn't be able to find each other? I don't want to babysit my router. Or aren't they using UPnP? Quick googling wasn't successful. I thought most of those autodiscover-services use UPnP.

There are 2 parts to UPnP. One is service discovery, in cooperation with zeroconf (aka bonjour/mDNS). This is handled 100% by devices themselves. The other is the port forwarding protocol, where devices can ask your router to open a port in the NAT to the wide internet forwarded to them. This is done in the router. It's also a potential massive security hole. If you disable UPnP on your router, you only disable the s…

The service discovery isn't really the security hole though, is it? I mean I have mDNS configured on my LAN. It's the port forwarding, and specifically, configuring it so that any rando device on the network can set up port forwarding, which is the security problem.

If you really want the dubious convenience of UPnP port forwarding, at least limit it to the one or two devices on your LAN that need it.

Re: My NAS exposes itself over the internet without permission

#87

Post by clajiness »

dijit wrote: post #80
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

I'm gaming on my Xbox right now with specific ports forwarded. I guess "absolutely must" is a bit much, huh? UPNP has no place in a secure network.

Re: My NAS exposes itself over the internet without permission

#88

Post by rubatuga »

dijit wrote: post #80
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

This is completely false. Almost all home networks use port-restricted NAT, which allows for STUN for NAT traversal. You do not need UPnP to play games, even those that have peer to peer multiplayer.

Also STUN for VOIP does not increase latency. It tells you your external IP and port.

Edit: Port symmetric —> port restricted

Re: My NAS exposes itself over the internet without permission

#89

Post by daniellarusso »

my123 wrote: post #71
rubatuga wrote: post #58

Earlier quoted context omitted.

Yes, it’s a feature supported by many VOIP clients, and this comments section is filled with UPnP apologists

As I said, "without going through a relay". And TURN is one of those relays. (I host a STUN and TURN relay myself, because I had to for my personal VoIP server for enough people to be able to connect on it. Downside is more use of bandwidth.) edit: replaced STUN with TURN where appropriate, I did confuse both as they were provided as a single package.

What STUN relay software do you use, or is it a hardware device?

Re: My NAS exposes itself over the internet without permission

#90

Post by benlivengood »

nobody9999 wrote: post #40
my123 wrote: post #32

Earlier quoted context omitted.

Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...

>Without UPnP, you specifically have to configure your NAT for this... While I realize that configuring nftables/iptables is beyond most folks, there are many firewalls out there that have a GUI/webui which makes this dead simple. Not sure why this should be an issue in 2021, except for users' trained-in helplessness.

> Not sure why this should be an issue in 2021, except for users' trained-in helplessness.

Kids hosting games on random ports (terraria, etc.) benefit from UPnP. I'd rather enable it than manually enter firewall rules for each game or give them admin access to the firewall.

UPnP is only an additional risk if you have malware inside your network already and then it mostly allows malware to host services in a simpler way, but capable malware will be able to use TCP hole punching to establish arbitrary connections between infected networks.

Post reply on HN