> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
My NAS exposes itself over the internet without permission
171–180 of 311 posts
Re: My NAS exposes itself over the internet without permission
#172Earlier quoted context omitted.
To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep…
It was clear you didn't want to disable UPnP support on the entire network, but I couldn't tell whether you'd tried disabling it on the NAS. Does the following disable the FS2-210's local UPnP? Go to TOS Desktop> Control Panel> Network Services> Discovery Service> UPnP Discovery > Uncheck "Enable UPnP discovery service" https://help.terra-master.com/TOS/view/?lang/en-us/flag/disc... I assume this won't break anything…
Re: My NAS exposes itself over the internet without permission
#173Can someone ELI5 on what a NAS is and why someone would need a NAS?
Re: My NAS exposes itself over the internet without permission
#174One usually runs Nmap or similar from WAN side to check for open ports.
How to test if a router permits UPnP?
Checking that UPnP is disabled in router’s GUI is not sufficient. An app should try to punch holes, and run tests for various things.
Also, what else needs to be checked?
Re: My NAS exposes itself over the internet without permission
#175Re: My NAS exposes itself over the internet without permission
#176Earlier quoted context omitted.
Hardware wise, I run Ubiquiti EdgeMAX but I wouldn't recommend them anymore, their software has gone down hill since many of their best developers left. Software wise, pfSense is where it's at, but I don't have experience with their own hardware other than the ones we ran at work all failed due to a silicon flaw in the Intel SoCs they ran.
> Ubiquiti EdgeMAX but I wouldn't recommend them anymore Sadly there isn't exactly a lot of alternatives in the hobbyist network setup area ... It's basically just ubiquity and mikrotik at this point as far as I know
Re: My NAS exposes itself over the internet without permission
#177> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
Honest question - what would I use UPnP for? I discovered a similar issue as the blog poster with my QNAP NAS which was easily remedied by disabling UPnP. I’ve not noticed any issues. We can do all the same things we did before. My Xbox and Switch still do online multiplayer just fine. I remember hearing Xbox/PS3-4 and UPnP mentioned together but it’s been a while.
Now-a-days it's not used much and quite frankly it was always a fairly bad idea.
Re: My NAS exposes itself over the internet without permission
#178Re: My NAS exposes itself over the internet without permission
#179Earlier quoted context omitted.
I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.
IMHO IPv6 is an ISP problem, I don't need every (any, really) of my devices accessible from outside my personal VPN, and IPV4 private space is more than sufficient for that. IPv6 is overly complex, therefore insecure. Thanks to the US Patriot Act I dont even trust the VPN stuff tbh.
In practical networks, IPv4 tends to be set up in some way and usually seems to work correctly - until you discover all the atrocious hacks people have commited over the ~ 25 years of practical, widespread use. Quite often multiple levels of NAT without much reason for it, UPnP where it shouldn't be, payment for even single IP addresses (great, we are paying for numbers other people got basically for free) and more - IPv4 are often handled like pets. Compared to IPv6, it is much harder to do a simple split into security groups based on prefix with IPv4. (In IPv6, you can usually just give every broadcast domain a /64 and will not do a huge mistake - they are a single security group. Sometimes, you might want to hand out a /64 or even shorter prefix to every client though.)
There are some great resources for modern and practical IPv6 too: https://knihy.nic.cz/#IPv6-2019 (4th edition in Czech by Pavel Satrapa, but can be translated using Google Translate and is more or less ok as a translation: https://docs.google.com/document/d/10CRjSRBLcdqtGjJgaW5Sct5h...) there are older books in English that are also mostly relevant still. The free IPv6 course by RIPE NCC is also a good way to get up to speed and avoid (spreading) FUD.
Re: My NAS exposes itself over the internet without permission
#180Once more a sad story about so called plug and play devices doing weird stuff. I prefer getting my hands a bit dirty using: - FreeNAS / NAS4free / OpenMediaVault (for Home-NAS) - OpenWRT / OPNsense / PFSense (for Home-Firewall) Nearly Plug and play with this Hardware: - Dell T20 / T30 / T40 - HP Microserver N54L / Gen8 / Gen10 - Linksys WRT 1200 / 1900 / 3200 / 32X (https://dc502wrt.org/) - Alix APU
+1 for FreeNAS. Its use of ZFS and ability to easily manage multiple "jails" and vms is perfect for a reliable home automation platform! The only major downside I've found thus far it that you cannot pass USB devices selectively to a jail/vm.
Having Home Assistant as a guest under TrueNAS would be nicer though. Right now there's no data redundancy for Home Assistant.