Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

131–140 of 311 posts

Re: My NAS exposes itself over the internet without permission

#131

Post by 7steps2much »

alias_neo wrote: post #35
ancarda wrote: post #15

Earlier quoted context omitted.

Do you have a router you recommend? Ideally something running free software

Hardware wise, I run Ubiquiti EdgeMAX but I wouldn't recommend them anymore, their software has gone down hill since many of their best developers left. Software wise, pfSense is where it's at, but I don't have experience with their own hardware other than the ones we ran at work all failed due to a silicon flaw in the Intel SoCs they ran.

> Ubiquiti EdgeMAX but I wouldn't recommend them anymore

Sadly there isn't exactly a lot of alternatives in the hobbyist network setup area ... It's basically just ubiquity and mikrotik at this point as far as I know

Re: My NAS exposes itself over the internet without permission

#132

Post by dijit »

clajiness wrote: post #87
dijit wrote: post #80

Earlier quoted context omitted.

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

I'm gaming on my Xbox right now with specific ports forwarded. I guess "absolutely must" is a bit much, huh? UPNP has no place in a secure network.

This is not a reasonable solution for most people, it requires intimate knowledge of the games you play (which ports they use), a static IP for your console and no more than one player/console per household.

Heaven forbid you have a PC game and a Xbox game that have conflicting ports.

And, I just have to say: you open arbitrary ports to your game console from the internet and talk about security.

Re: My NAS exposes itself over the internet without permission

#133

Post by [deleted] »

rubatuga wrote: post #120
kn100 wrote: post #116

Earlier quoted context omitted.

It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in…

You keep saying "whatever" software wouldn't work without UPnP, but you are failing to give us concrete examples.

[deleted]

Re: My NAS exposes itself over the internet without permission

#134

Post by zippergz »

kn100 wrote: post #116
bunnyfoofoo wrote: post #75

Earlier quoted context omitted.

I'm sorry, I didn't mean to come off as offensive. I agree that it would be bothersome to convert from uPnP to non-uPnP, but you really only need to set it up once. Then any new devices you add to your network don't require individual workarounds.

It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in…

FWIW I have never had upnp enabled and I don't recall any cases where it's caused a problem for me. Certainly my wife and I are on videoconferences all day and they work fine. I am completely with you that I can't have network configurations that make the network unusable, confusing, or inconvenient for my family, but are you sure that upnp falls into that category? I'm sure you have different applications than I do, but I think we're pretty normal...

Re: My NAS exposes itself over the internet without permission

#135

Post by bscphil »

rubatuga wrote: post #72
takeda wrote: post #43

Earlier quoted context omitted.

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.

Aren't these two points slightly contradictory?

> the author depends on NAT as a security feature, when it was never designed to be one

> UPnP is a convenience feature, and is disabled in all security focused networks.

uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your network, and it's not an issue.

(I suppose some routers might automatically add a firewall exception when doing uPnP hole punching, but if so that's an issue with those routers, not with the idea of relying on a firewall.)

Re: My NAS exposes itself over the internet without permission

#136

Post by easton »

clajiness wrote: post #87
dijit wrote: post #80

Earlier quoted context omitted.

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

I'm gaming on my Xbox right now with specific ports forwarded. I guess "absolutely must" is a bit much, huh? UPNP has no place in a secure network.

n>1, not n=1.

Re: My NAS exposes itself over the internet without permission

#137

Post by eikenberry »

daniellarusso wrote: post #83
alias_neo wrote: post #62

Earlier quoted context omitted.

Its muddy right now, I run Ubiquiti EdgeMAX switches and EdgeRouter at home, but I wouldn't recommend them right now (see another comment of mine, or check out the subreddit), for NAS I run TrueNAS, on a home built server.

For your NAS, to you have a mobo and case recommendation?

Not OP, but I built a NAS not that long ago. For the case I purchased the Fractal Design Node 304 (https://www.fractal-design.com/products/cases/node/node-304/...) and am very happy with it.

For the Mobo I suggest finding a decent board (AMD based one if you want ECC RAM) and then use a PCI-e controller card to support the hard drives you need. It is hard to find a nice MB with all the SATA ports you need, using an external card gives you a lot more options. When I researched it everyone recommended an "LSI Logic Controller Card LSI00301 SAS 9207-8i" (eg. https://www.amazon.com/LSI-Controller-LSI00301-9207-8i-Inter...) and it has performed very well for me. If you go that way you'll need a SAS to SATA cable, they are easy to find as well.

Re: My NAS exposes itself over the internet without permission

#138

Post by JoshTriplett »

alias_neo wrote: post #35
ancarda wrote: post #15

Earlier quoted context omitted.

Do you have a router you recommend? Ideally something running free software

Hardware wise, I run Ubiquiti EdgeMAX but I wouldn't recommend them anymore, their software has gone down hill since many of their best developers left. Software wise, pfSense is where it's at, but I don't have experience with their own hardware other than the ones we ran at work all failed due to a silicon flaw in the Intel SoCs they ran.

> Software wise, pfSense is where it's at

Recent events suggest that the people behind pfSense are not especially responsible stewards; see https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... and https://opnsense.org/opnsense-com/ .

Re: My NAS exposes itself over the internet without permission

#139

Post by rubatuga »

bscphil wrote: post #135
rubatuga wrote: post #72

Earlier quoted context omitted.

Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.

Aren't these two points slightly contradictory? > the author depends on NAT as a security feature, when it was never designed to be one > UPnP is a convenience feature, and is disabled in all security focused networks. uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your netwo…

Ah that’s fair, but it’s the combination of both that is the worst

Re: My NAS exposes itself over the internet without permission

#140

Post by nullify88 »

rubatuga wrote: post #88
dijit wrote: post #80

Earlier quoted context omitted.

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

This is completely false. Almost all home networks use port-restricted NAT, which allows for STUN for NAT traversal. You do not need UPnP to play games, even those that have peer to peer multiplayer. Also STUN for VOIP does not increase latency. It tells you your external IP and port. Edit: Port symmetric —> port restricted

Do you mean TURN? STUN does not work over Symmetric NAT as the source port is unpredictable.
Post reply on HN