Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

111–120 of 311 posts

Re: My NAS exposes itself over the internet without permission

#111

Post by alias_neo »

takeda wrote: post #43
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic.

The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GUI at all.

Re: My NAS exposes itself over the internet without permission

#112

Post by dijit »

birdyrooster wrote: post #99
dijit wrote: post #80

Earlier quoted context omitted.

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

If you want to host servers on your network then you need firewall rules, but if you are just a client then the firewalls implicitly allow the responses to client traffic through.

Only if it’s dedicated server infrastructure (as mentioned) games like call of duty will not work.

Re: My NAS exposes itself over the internet without permission

#113

Post by nemosaltat »

rubatuga wrote: post #72
takeda wrote: post #43

Earlier quoted context omitted.

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.

This is what I did a couple years ago. The documentation for OpenWRT is great, and Luci/LDE makes it approachable if you don’t feel comfortable managing from the CLI. I have one VLAN for my “privileged” devices and one for the “IO(shi)T” devices.

Re: My NAS exposes itself over the internet without permission

#114

Post by KozmoNau7 »

atmosx wrote: post #81
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Indeed, UPNP effectively turns on "auto-pilot". The fridge running on 10 years old firmware might open ports dynamically. Networks featuring UPNP should be marked as "open/insecure".

If your fridge has a MAC address, you have much much deeper problems than UPnP.

Re: My NAS exposes itself over the internet without permission

#115

Post by my123 »

daniellarusso wrote: post #89
my123 wrote: post #71

Earlier quoted context omitted.

As I said, "without going through a relay". And TURN is one of those relays. (I host a STUN and TURN relay myself, because I had to for my personal VoIP server for enough people to be able to connect on it. Downside is more use of bandwidth.) edit: replaced STUN with TURN where appropriate, I did confuse both as they were provided as a single package.

What STUN relay software do you use, or is it a hardware device?

I use https://github.com/coturn/coturn, provided as the coturn package on Ubuntu 20.04.

Re: My NAS exposes itself over the internet without permission

#116

Post by kn100 »

bunnyfoofoo wrote: post #75
kn100 wrote: post #44

Earlier quoted context omitted.

To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep…

I'm sorry, I didn't mean to come off as offensive. I agree that it would be bothersome to convert from uPnP to non-uPnP, but you really only need to set it up once. Then any new devices you add to your network don't require individual workarounds.

It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in a somewhat fruitless fight with the stuff I can control to keep the uPnP port punching under control somewhat.

It's definitely a bug in the nas that it continues to punch ports no matter how it is configured. Plenty of software gives you the option of not punching ports.

Re: My NAS exposes itself over the internet without permission

#117

Post by rembicilious »

rubatuga wrote: post #91
kn100 wrote: post #69

Earlier quoted context omitted.

This is exactly my opinion and exactly how I use uPnP. I can't control exactly what runs on my network since I'm not the only one using it, but I can guard certain parts of my network more thoroughly.

You have to choose: security or convenience.

“They that would give up a little convenience for a little security deserve neither and they shall lose them both.” -Beenjammin Frankmon

Re: My NAS exposes itself over the internet without permission

#118

Post by my123 »

dasyatidprime wrote: post #108
rubatuga wrote: post #104

Earlier quoted context omitted.

STUN is not a relay.

STUN is not a relay, but TURN is, and STUN/TURN is a common combo for when STUN doesn't manage to holepunch reliably, falling back to the relay when the direct connection fails. What's also true, and what I think the GP was trying to get at, is that STUN requires an external coordination server. UPnP (I think—I am far less familiar with it) does not, because in UPnP you're negotiating the holepunching with the local…

With TURN, all the traffic to the clients is routed through the TURN server indeed. That makes hosting a discussions server more traffic-heavy than otherwise...

(and it turns out that the server software that I use implements TURN and STUN in the same daemon)

Re: My NAS exposes itself over the internet without permission

#119

Post by KozmoNau7 »

daniellarusso wrote: post #98
KozmoNau7 wrote: post #18

Earlier quoted context omitted.

The issue is letting untrusted or badly behaved devices on the network. UPnP works great, if you control which devices get on your network . Static port forwarding combined with DHCP gets annoying quickly, you end up having to set up static assignments for every device that may need a port forwarded, which can be a lot, with modern multiplayer gaming and p2p. And for applications that select a random port on startup,…

So, keeping track of which device on your network belongs to which MAC address, and reserving an address for each, is that what you mean by ‘annoying’ - the administration of that?

That's the easy part. Plenty of applications (such as bittorrent clients) use randomized ports. So you have to either disable that, manually add the port forward every time you start the client, or let UPnP handle it, because you don't let any untrusted devices or apps onto your network.

And multiple devices on the network may need the same port forwarded at different times, such as multiple games consoles.

Re: My NAS exposes itself over the internet without permission

#120

Post by rubatuga »

kn100 wrote: post #116
bunnyfoofoo wrote: post #75

Earlier quoted context omitted.

I'm sorry, I didn't mean to come off as offensive. I agree that it would be bothersome to convert from uPnP to non-uPnP, but you really only need to set it up once. Then any new devices you add to your network don't require individual workarounds.

It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in…

You keep saying "whatever" software wouldn't work without UPnP, but you are failing to give us concrete examples.
Post reply on HN