Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

121–130 of 311 posts

Re: My NAS exposes itself over the internet without permission

#121

Post by eikenberry »

waffle_ss wrote: post #110
rubatuga wrote: post #88

Earlier quoted context omitted.

This is completely false. Almost all home networks use port-restricted NAT, which allows for STUN for NAT traversal. You do not need UPnP to play games, even those that have peer to peer multiplayer. Also STUN for VOIP does not increase latency. It tells you your external IP and port. Edit: Port symmetric —> port restricted

I get the feeling you’ve never ran n>1 Xbox Ones connecting to Xbox Live at the same time. Without UPnP only one will be able to connect.

So is this issue mostly with consoles? I've always kept UPnP off and we do lots of gaming here without a problem, but pretty much all PC gaming.

Re: My NAS exposes itself over the internet without permission

#122

Post by dbeley »

sandreas wrote: post #27

Once more a sad story about so called plug and play devices doing weird stuff. I prefer getting my hands a bit dirty using: - FreeNAS / NAS4free / OpenMediaVault (for Home-NAS) - OpenWRT / OPNsense / PFSense (for Home-Firewall) Nearly Plug and play with this Hardware: - Dell T20 / T30 / T40 - HP Microserver N54L / Gen8 / Gen10 - Linksys WRT 1200 / 1900 / 3200 / 32X (https://dc502wrt.org/) - Alix APU

I also had good experience with mini-PCs like Chuwi's. They are pretty cheap, have a good amount of ports and have the advantage of having newer CPUs with very little power consumption.

Re: My NAS exposes itself over the internet without permission

#123

Post by rufius »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Honest question - what would I use UPnP for?

I discovered a similar issue as the blog poster with my QNAP NAS which was easily remedied by disabling UPnP.

I’ve not noticed any issues. We can do all the same things we did before. My Xbox and Switch still do online multiplayer just fine.

I remember hearing Xbox/PS3-4 and UPnP mentioned together but it’s been a while.

Re: My NAS exposes itself over the internet without permission

#124

Post by bscphil »

ancarda wrote: post #15
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Do you have a router you recommend? Ideally something running free software

The PC Engines hardware line is popular here. The firmware is coreboot and you can run OPNsense on it for an entirely free software solution. It's quite solid, have had no issues at all. See e.g. https://www.pcengines.ch/apu4d4.htm

Not aff'd, just a customer.

Re: My NAS exposes itself over the internet without permission

#125

Post by dijit »

eikenberry wrote: post #121
waffle_ss wrote: post #110

Earlier quoted context omitted.

I get the feeling you’ve never ran n>1 Xbox Ones connecting to Xbox Live at the same time. Without UPnP only one will be able to connect.

So is this issue mostly with consoles? I've always kept UPnP off and we do lots of gaming here without a problem, but pretty much all PC gaming.

PC also has problems. Truth be told it’s all about the kinds of games you play.

You can port forward of course, but you have to know which ports and obviously it only goes to one static IP

Re: My NAS exposes itself over the internet without permission

#126

Post by bscphil »

spockz wrote: post #64
hh3k0 wrote: post #54

Earlier quoted context omitted.

> If the author really cares, go one step further and replace the ISP owned router with something with more control. I wanted to do that for a while now. Do you happen to have a good suggestion regarding whose products are worthwhile?

Up until a week ago I would have suggested the UniFi. Since the latest snafu, the handling of the breach not the breach itself, I’m not so sure anymore what would be the best alternative. Perhaps just their EdgeRouter devices or a mikrotik device. The snafu: https://news.ycombinator.com/item?id=26638145

Also, the security report you're talking about came out like two days after a huge blow-up on this site because of a report they added advertising to a UI for one of their products. (The controller I think?)

Re: My NAS exposes itself over the internet without permission

#127

Post by 7steps2much »

eikenberry wrote: post #121
waffle_ss wrote: post #110

Earlier quoted context omitted.

I get the feeling you’ve never ran n>1 Xbox Ones connecting to Xbox Live at the same time. Without UPnP only one will be able to connect.

So is this issue mostly with consoles? I've always kept UPnP off and we do lots of gaming here without a problem, but pretty much all PC gaming.

I can't say for sure, but I have never ever seen a PC game using UPnP. That said, I have only ever seen it once with a console, a PS3 in this case.

And, don't quote me on this, but most PC games are not Peer-To-Peer. They often come with their own server software.

Re: My NAS exposes itself over the internet without permission

#128

Post by canada_dry »

sandreas wrote: post #27

Once more a sad story about so called plug and play devices doing weird stuff. I prefer getting my hands a bit dirty using: - FreeNAS / NAS4free / OpenMediaVault (for Home-NAS) - OpenWRT / OPNsense / PFSense (for Home-Firewall) Nearly Plug and play with this Hardware: - Dell T20 / T30 / T40 - HP Microserver N54L / Gen8 / Gen10 - Linksys WRT 1200 / 1900 / 3200 / 32X (https://dc502wrt.org/) - Alix APU

+1 for FreeNAS.

Its use of ZFS and ability to easily manage multiple "jails" and vms is perfect for a reliable home automation platform!

The only major downside I've found thus far it that you cannot pass USB devices selectively to a jail/vm.

Re: My NAS exposes itself over the internet without permission

#129

Post by bscphil »

im_down_w_otp wrote: post #10

I'm confused. Some significant length was gone to in attempting to interrogate the device and modify it in such a way that it wouldn't try to open uPnP ports anymore. Further, a lot of devices try to leverage uPnP by default, and many of them are significantly more opaque than this NAS proved to be. However, the author doesn't want to just disable uPnP in their router and manage forwarding directly due to a perceived…

Given this:

> My router is an ISP provisioned one so the feature-set there is somewhat limited

My assumption was that their router doesn't support disabling uPnP for a single client, so it's 100% on or 100% off. If they play a significant number of p2p games or use p2p applications with non-predictable ports, it might well be more difficult to do manual port-forwarding when needed than to leave uPnP enabled (or even impossible, depending on what the router can do).

Re: My NAS exposes itself over the internet without permission

#130

Post by kaylynb »

rubatuga wrote: post #72
takeda wrote: post #43

Earlier quoted context omitted.

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.

This is the way to do it.

NAT is not really security and UPnP doesn't really do much to prevent malicious software already on your network from doing malicious things except perhaps hosting itself on your WAN to spread further.

What disabling it does help is prevent improperly configured or flawed devices from accidentally exposing themselves to your WAN. IOT devices? Put them on a network with no UPnP. Workstations and video game consoles with up-to-date patches? UPnP is probably fine.

Post reply on HN