Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

91–100 of 311 posts

Re: My NAS exposes itself over the internet without permission

#91

Post by rubatuga »

kn100 wrote: post #69
watermelon0 wrote: post #57

Earlier quoted context omitted.

Sure, UPnP can open ports to the outside world, but that's something that might be desired in some cases. However, devices should default to local access only, and offer an option to expose them to the world, with appropriate warning.

This is exactly my opinion and exactly how I use uPnP. I can't control exactly what runs on my network since I'm not the only one using it, but I can guard certain parts of my network more thoroughly.

You have to choose: security or convenience.

Re: My NAS exposes itself over the internet without permission

#92

Post by xyst »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

also dont buy Ubiquiti gear :)

Re: My NAS exposes itself over the internet without permission

#93

Post by [deleted] »

my123 wrote: post #71
rubatuga wrote: post #58

Earlier quoted context omitted.

Yes, it’s a feature supported by many VOIP clients, and this comments section is filled with UPnP apologists

As I said, "without going through a relay". And TURN is one of those relays. (I host a STUN and TURN relay myself, because I had to for my personal VoIP server for enough people to be able to connect on it. Downside is more use of bandwidth.) edit: replaced STUN with TURN where appropriate, I did confuse both as they were provided as a single package.

[deleted]

Re: My NAS exposes itself over the internet without permission

#94

Post by skizm »

TerminalSystem3 wrote: post #85

Can someone ELI5 on what a NAS is and why someone would need a NAS?

Just a computer with a bunch of hard drives so you can store your media all in one place. Most of the time people expose this to their home network so they can access the files from all their devices while on the same wifi, but you can also expose it to the internet so you can access the files anywhere.

Re: My NAS exposes itself over the internet without permission

#95

Post by mnd999 »

the8472 wrote: post #45
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Opening ports for a specific machine with dynamic IPv6 addresses can be difficult though. If the suffix stays stable then with iptables you can use netmasks where you mask out the prefix rather than the suffix. If both prefix and suffix are dynamic you need a solution that takes dhcp or host names into account. Not all router firmwares support something like that. Another alternative is to use UPnP or PCP with authen…

Suffix should always be static with SLAAC because it’s your MAC address. Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one.

If you’re using DHCPv6 then the DHCP server should take care of DNS as it would for v4.

Re: My NAS exposes itself over the internet without permission

#96

Post by ryandrake »

watermelon0 wrote: post #57
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Sure, UPnP can open ports to the outside world, but that's something that might be desired in some cases. However, devices should default to local access only, and offer an option to expose them to the world, with appropriate warning.

You could also configure your Internet router to only allow one or two trusted devices to invoke UPnP to open ports.

Re: My NAS exposes itself over the internet without permission

#97

Post by xyst »

TerminalSystem3 wrote: post #85

Can someone ELI5 on what a NAS is and why someone would need a NAS?

It stands for "network attached storage", it's basically a standalone disk drive that is accessible to all devices within the local network (or public internet, if the device is setup that way).

In home setups, it's often used as a way to store terabytes of digital media (movies, videos, locally hosted wikipedia)

Re: My NAS exposes itself over the internet without permission

#98

Post by daniellarusso »

KozmoNau7 wrote: post #18
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

The issue is letting untrusted or badly behaved devices on the network. UPnP works great, if you control which devices get on your network . Static port forwarding combined with DHCP gets annoying quickly, you end up having to set up static assignments for every device that may need a port forwarded, which can be a lot, with modern multiplayer gaming and p2p. And for applications that select a random port on startup,…

So, keeping track of which device on your network belongs to which MAC address, and reserving an address for each, is that what you mean by ‘annoying’ - the administration of that?

Re: My NAS exposes itself over the internet without permission

#99

Post by birdyrooster »

dijit wrote: post #80
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

If you want to host servers on your network then you need firewall rules, but if you are just a client then the firewalls implicitly allow the responses to client traffic through.

Re: My NAS exposes itself over the internet without permission

#100

Post by Zombieball »

KozmoNau7 wrote: post #56
iso1210 wrote: post #24

Earlier quoted context omitted.

Why wouldn't I use static dhcp?

Forwarded ports are not always static, we're not in the world of just web servers and SSH. Different devices may need to use VoIP, P2P, games and other applications that cannot be strictly mapped to just one system or even just one port. UPnP handles dynamic mappings, so you don't have to update your port forwards every time.

What’s wrong with static IP assignments? Doesn’t this solve the issue?
Post reply on HN