Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

161–170 of 311 posts

Re: My NAS exposes itself over the internet without permission

#161

Post by rdudek »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Nothing wrong with uPnP. If you’re worried about something opening up ports on your network, you’re already compromised.

Re: My NAS exposes itself over the internet without permission

#162

Post by hedora »

alias_neo wrote: post #155
stilisstuk wrote: post #151

Earlier quoted context omitted.

So I don't know about routers or networks. I live in a an apartment. Which router (+ a extra point / 2 hub mesh) is recommended these days. There seems to be a plethora of options. But most of always end with ubiquity, which today feels like a bad choice. Also kind of expensive. Preferable something Completely local. No cloud service. Preferable opens source. I live in EU. (Sorry if it's bad form to ask for product r…

I've replied to a couple of others, normally I would have recommended Ubiquiti, but I no longer do. Not just because of their recent breach debackle, but because their software quality has declined since some of their best developers left. The short but not so useful answer is, run something with pfSense or similar, I hear PCEngines hardware works well and is open source from the bootloader up. Ubiquiti has hardware…

I can recommend PC Engines (though a bit pricey, and kind of a hobby project to set up), and also Ubiquiti (ignoring the recent debacle).

Both are generally maintenance free once they’re set up.

Re: My NAS exposes itself over the internet without permission

#163

Post by eqvinox »

DarkmSparks wrote: post #154
yesco wrote: post #147

Earlier quoted context omitted.

> IPv6 is overly complex I'm being a bit pedantic about this since you're right that in practice, setting up stuff for IPv6 is in-fact complex since support for it is all over the place. But I want to stress that IPv6 as a protocol is much simpler, more intuitive and much more versatile than IPv4. I'd even go so far as to say that it's actually fantastically suited for local networks, especially so in complicated set…

The basics of the client side are simple. But the routing is not simple. I'm pretty well versed in networking generally - even IPv6, but a quick glance over something like: http://ipv6now.com.au/primers/IPv6RoutingSecurity.php Makes it obvious why it still hasn't gotten anywhere, _no one_ wants to dig through all that unless they really really have to. Security depends on securing the routing and address allocation.…

> http://ipv6now.com.au/primers/IPv6RoutingSecurity.php

Everything listed there either also applies/transfers to IPv4 or is not applicable at all to the situation you're evaluating.

> Makes it obvious why it still hasn't gotten anywhere

Uh....

https://www.google.com/search?q=google+ipv6+traffic+percenta...

44.44%

https://www.google.com/search?q=google+global+ipv6+traffic+p...

34.15%

[EDIT: sibling post by minimaul has the better link:] https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6...

Re: My NAS exposes itself over the internet without permission

#164

Post by minimaul »

DarkmSparks wrote: post #154
yesco wrote: post #147

Earlier quoted context omitted.

> IPv6 is overly complex I'm being a bit pedantic about this since you're right that in practice, setting up stuff for IPv6 is in-fact complex since support for it is all over the place. But I want to stress that IPv6 as a protocol is much simpler, more intuitive and much more versatile than IPv4. I'd even go so far as to say that it's actually fantastically suited for local networks, especially so in complicated set…

The basics of the client side are simple. But the routing is not simple. I'm pretty well versed in networking generally - even IPv6, but a quick glance over something like: http://ipv6now.com.au/primers/IPv6RoutingSecurity.php Makes it obvious why it still hasn't gotten anywhere, _no one_ wants to dig through all that unless they really really have to. Security depends on securing the routing and address allocation.…

> Combine that with most users being happy and comfortable with 1 IP address and there was no mass market appeal for IPv6 hardware or software.

The mass market appeal for IPv6 is the fact that we do not have enough IPv4 to actually give one internet connection a unique IP. CGNAT is getting ever more present in the marketplace as a result of this.

Major providers are rolling out IPv6. eg in the USA, several major cable/fibre providers provide v6, several mobile networks provide IPv6 using things like 464xlat. It's the same in the UK - BT for example provide IPv6 on consumer internet connections, EE (a major phone carrier) provide v6 and use 464xlat to provide v4 connectivity to handsets.

India and Germany are further ahead still, generally. Google's IPv6 stats are a good indicator of just how much v6 is in use now: https://www.google.com/intl/en/ipv6/statistics.html#tab=ipv6...

Re: My NAS exposes itself over the internet without permission

#165

Post by omnimus »

katbyte wrote: post #160
newsclues wrote: post #152

Earlier quoted context omitted.

Mikrotik

The ux is... not good and I wouldn’t recommend it for anyone not experienced

yeah i bought Mikrotik for home and i have no idea what to do there. I tried to do hairpin nat with it and after 3 tutorials i somehow managed to get it working and now i have no clue how does it work or what its it really doing.

I think its only for real networking pros

Re: My NAS exposes itself over the internet without permission

#166

Post by Causality1 »

stilisstuk wrote: post #151
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

So I don't know about routers or networks. I live in a an apartment. Which router (+ a extra point / 2 hub mesh) is recommended these days. There seems to be a plethora of options. But most of always end with ubiquity, which today feels like a bad choice. Also kind of expensive. Preferable something Completely local. No cloud service. Preferable opens source. I live in EU. (Sorry if it's bad form to ask for product r…

I'm pretty sure the WRT-54G I had in 2005 was better at penetrating walls than anything Ubiquiti has ever built. After dealing with the one my mother was issued for her remote work I'm convinced that anyone not trying to remote-admin a hundred-router campus installation would be a fool to buy one.

Nothing is where you expect it to be. Getting to the control panel requires multiple login screens. Changing a port forwarding rule for devices that are and are not currently connected not only isn't on the same screen, it's not even in the same section of the control panel.

I had no end of problems getting it up and running for her, despite having paid tech support on the phone. Everything connected via ethernet would benchmark at exactly 1/2 the normal download speed of her old router, and anything on wifi benchmarked at 1/6. For the first three days her IP phone just rang continuously with nobody there, and neither I nor the tech support guy have any idea why it started working correctly.

Re: My NAS exposes itself over the internet without permission

#167

Post by BlackiceNetwork »

Trust but verify. Just wanted to add that in my opinion it is best practice to schedule a recurrent task for scanning the network using tools like nmap.

On top, add.

After done (re)configuring a (new)device on you network, scan and document baseline. Verify baseline recurrently.

Re: My NAS exposes itself over the internet without permission

#168

Post by stilisstuk »

alias_neo wrote: post #155
stilisstuk wrote: post #151

Earlier quoted context omitted.

So I don't know about routers or networks. I live in a an apartment. Which router (+ a extra point / 2 hub mesh) is recommended these days. There seems to be a plethora of options. But most of always end with ubiquity, which today feels like a bad choice. Also kind of expensive. Preferable something Completely local. No cloud service. Preferable opens source. I live in EU. (Sorry if it's bad form to ask for product r…

I've replied to a couple of others, normally I would have recommended Ubiquiti, but I no longer do. Not just because of their recent breach debackle, but because their software quality has declined since some of their best developers left. The short but not so useful answer is, run something with pfSense or similar, I hear PCEngines hardware works well and is open source from the bootloader up. Ubiquiti has hardware…

Considering linksys WRT3200ACM. Heard pfsense is not good with wireless.

Re: My NAS exposes itself over the internet without permission

#169

Post by aborsy »

alias_neo wrote: post #155
stilisstuk wrote: post #151

Earlier quoted context omitted.

So I don't know about routers or networks. I live in a an apartment. Which router (+ a extra point / 2 hub mesh) is recommended these days. There seems to be a plethora of options. But most of always end with ubiquity, which today feels like a bad choice. Also kind of expensive. Preferable something Completely local. No cloud service. Preferable opens source. I live in EU. (Sorry if it's bad form to ask for product r…

I've replied to a couple of others, normally I would have recommended Ubiquiti, but I no longer do. Not just because of their recent breach debackle, but because their software quality has declined since some of their best developers left. The short but not so useful answer is, run something with pfSense or similar, I hear PCEngines hardware works well and is open source from the bootloader up. Ubiquiti has hardware…

Although netgate’s recent debacle calls into question the code quality of pfsense as well:

https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

Re: My NAS exposes itself over the internet without permission

#170

Post by stilisstuk »

stefan_ wrote: post #153
stilisstuk wrote: post #151

Earlier quoted context omitted.

So I don't know about routers or networks. I live in a an apartment. Which router (+ a extra point / 2 hub mesh) is recommended these days. There seems to be a plethora of options. But most of always end with ubiquity, which today feels like a bad choice. Also kind of expensive. Preferable something Completely local. No cloud service. Preferable opens source. I live in EU. (Sorry if it's bad form to ask for product r…

Can you get rid of your ISP provided router? There are lots of obstacles there.

I don't know to be honest?
Post reply on HN