Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

171–180 of 311 posts

Re: My NAS exposes itself over the internet without permission

#171

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Yes, the real lesson here is, I learned not to trust random vendors and turned off upnp.

Re: My NAS exposes itself over the internet without permission

#172
post #44

Earlier quoted context omitted.

To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep…

It was clear you didn't want to disable UPnP support on the entire network, but I couldn't tell whether you'd tried disabling it on the NAS. Does the following disable the FS2-210's local UPnP? Go to TOS Desktop> Control Panel> Network Services> Discovery Service> UPnP Discovery > Uncheck "Enable UPnP discovery service" https://help.terra-master.com/TOS/view/?lang/en-us/flag/disc... I assume this won't break anything…

This option was and is disabled - I should have mentioned this in the blog post

Re: My NAS exposes itself over the internet without permission

#173

Can someone ELI5 on what a NAS is and why someone would need a NAS?

Adding on to what others have said, I have one set up that's also used as part of my backup strategy for the important stuff on all the other boxes around here.

Re: My NAS exposes itself over the internet without permission

#174
Is there an app to comprehensively test the security of a router?

One usually runs Nmap or similar from WAN side to check for open ports.

How to test if a router permits UPnP?

Checking that UPnP is disabled in router’s GUI is not sufficient. An app should try to punch holes, and run tests for various things.

Also, what else needs to be checked?

Re: My NAS exposes itself over the internet without permission

#175
aren't all these prosumer nas devices just out of date foss with a clunky webgui that ultimately is sufficiently limited such that you spend more time working around limitations then you would have just setting up foss yourself or are they actually getting good now?

Re: My NAS exposes itself over the internet without permission

#176

Earlier quoted context omitted.

Hardware wise, I run Ubiquiti EdgeMAX but I wouldn't recommend them anymore, their software has gone down hill since many of their best developers left. Software wise, pfSense is where it's at, but I don't have experience with their own hardware other than the ones we ran at work all failed due to a silicon flaw in the Intel SoCs they ran.

> Ubiquiti EdgeMAX but I wouldn't recommend them anymore Sadly there isn't exactly a lot of alternatives in the hobbyist network setup area ... It's basically just ubiquity and mikrotik at this point as far as I know

I've heard good things about Turris hardware too, but no personal experience. https://www.turris.com/en/omnia/overview/

Re: My NAS exposes itself over the internet without permission

#177
post #123

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Honest question - what would I use UPnP for? I discovered a similar issue as the blog poster with my QNAP NAS which was easily remedied by disabling UPnP. I’ve not noticed any issues. We can do all the same things we did before. My Xbox and Switch still do online multiplayer just fine. I remember hearing Xbox/PS3-4 and UPnP mentioned together but it’s been a while.

UPnP allows devices to open up firewall ports for themselves to allow traffic to reach them inbound. Games (for example) that that host a server on the users local machine may require an open port to allow access inbound so UPnP can help with this.

Now-a-days it's not used much and quite frankly it was always a fairly bad idea.

Re: My NAS exposes itself over the internet without permission

#179
post #43

Earlier quoted context omitted.

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

IMHO IPv6 is an ISP problem, I don't need every (any, really) of my devices accessible from outside my personal VPN, and IPV4 private space is more than sufficient for that. IPv6 is overly complex, therefore insecure. Thanks to the US Patriot Act I dont even trust the VPN stuff tbh.

@yesco is right that practice is all over the place for IPv6 if it works at all. But in general, IPv6 as a protocol is just fine, at least equally secure as IPv4 and not more complex than IPv4 in many practical cases. I would even go so far to say it is way easier to do a clean address plan with IPv6. Usually, IPv6 inbound access is blocked by default on the ISP routers firewall.

In practical networks, IPv4 tends to be set up in some way and usually seems to work correctly - until you discover all the atrocious hacks people have commited over the ~ 25 years of practical, widespread use. Quite often multiple levels of NAT without much reason for it, UPnP where it shouldn't be, payment for even single IP addresses (great, we are paying for numbers other people got basically for free) and more - IPv4 are often handled like pets. Compared to IPv6, it is much harder to do a simple split into security groups based on prefix with IPv4. (In IPv6, you can usually just give every broadcast domain a /64 and will not do a huge mistake - they are a single security group. Sometimes, you might want to hand out a /64 or even shorter prefix to every client though.)

There are some great resources for modern and practical IPv6 too: https://knihy.nic.cz/#IPv6-2019 (4th edition in Czech by Pavel Satrapa, but can be translated using Google Translate and is more or less ok as a translation: https://docs.google.com/document/d/10CRjSRBLcdqtGjJgaW5Sct5h...) there are older books in English that are also mostly relevant still. The free IPv6 course by RIPE NCC is also a good way to get up to speed and avoid (spreading) FUD.

Re: My NAS exposes itself over the internet without permission

#180

Once more a sad story about so called plug and play devices doing weird stuff. I prefer getting my hands a bit dirty using: - FreeNAS / NAS4free / OpenMediaVault (for Home-NAS) - OpenWRT / OPNsense / PFSense (for Home-Firewall) Nearly Plug and play with this Hardware: - Dell T20 / T30 / T40 - HP Microserver N54L / Gen8 / Gen10 - Linksys WRT 1200 / 1900 / 3200 / 32X (https://dc502wrt.org/) - Alix APU

+1 for FreeNAS. Its use of ZFS and ability to easily manage multiple "jails" and vms is perfect for a reliable home automation platform! The only major downside I've found thus far it that you cannot pass USB devices selectively to a jail/vm.

I really wish it could do USB passthrough. I need that for home automation to run in a VM under TrueNAS. The solution I've been running for a few years now is to have TrueNAS and Home Assistant running under VMWare ESX. Required getting an HBA that I could pass through to the VM instead of using the ports on the mobo but it works nicely.

Having Home Assistant as a guest under TrueNAS would be nicer though. Right now there's no data redundancy for Home Assistant.

Post reply on HN