CVE Assigned https://cve.report/CVE-2021-30127
My NAS exposes itself over the internet without permission
181–190 of 311 posts
Re: My NAS exposes itself over the internet without permission
#182> Unfortunately, disabling uPnP these days is too much of a hit to convenience
I've disabled UPnP on every router I owned. Never did I notice any problems from doing it.
Re: My NAS exposes itself over the internet without permission
#183> Upon SSHing into the NAS and having a dig around the file system, I discovered a file that could be modified. /etc/upnp.json seems to contain a list of port forwarding rules. Thank you to Terramaster for providing root access to these at least. Simply change bEnable to 0 for whatever ports you don’t want exposed, reboot the NAS, and check the port forwarding rules.
And don't forget to do all this each time the NAS updates. And pray to whatever entity you wish that auto-updates don't get enabled.
Seriously, after a blunder like this, why not return the device and find a manufacturer you can trust?
Re: My NAS exposes itself over the internet without permission
#184> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
People make blanket statements like this without thinking of how it is used by popular consumer devices.
As others have said it's really necessary for some consumer devices to work properly - especially if you have more than one of the same device.
Games consoles are the best example.
If you have one console only, then you can usually forward ports manually, but if you have two or more of the same console, and want them to go online at the same time, then you need to use UPnP.
If you don't have UPnP enabled on one of the consoles, you'll see issues like being unable to join some games or being unable to do voice chat with certain players.
Re: My NAS exposes itself over the internet without permission
#185Earlier quoted context omitted.
> IPv6 is overly complex I'm being a bit pedantic about this since you're right that in practice, setting up stuff for IPv6 is in-fact complex since support for it is all over the place. But I want to stress that IPv6 as a protocol is much simpler, more intuitive and much more versatile than IPv4. I'd even go so far as to say that it's actually fantastically suited for local networks, especially so in complicated set…
The basics of the client side are simple. But the routing is not simple. I'm pretty well versed in networking generally - even IPv6, but a quick glance over something like: http://ipv6now.com.au/primers/IPv6RoutingSecurity.php Makes it obvious why it still hasn't gotten anywhere, _no one_ wants to dig through all that unless they really really have to. Security depends on securing the routing and address allocation.…
Usually, inbound IPv6 are firewalled by the ISP router just fine. As far as I know, there is UPnP with IPv6 though there seems to be some work into that direction. Also, current CGNAT setups tend to close connections before they should according to RFCs: https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-...
All the IPv6 routing security has to be done with IPv4 as well. ARP -> NDP, prevent source address spoofing, DHCP guard/ RA guard are basically two sides of the same coin. Serious networking hardware supports this for years or there are firmware updates supporting it. For about the last 5 years, supporting IPv6 became much easier, almost as easy as supporting IPv4 for most of the real world use cases. Anyway, the reality is, we don't really have much choice other than to migrate to IPv6 sooner or later.
Re: My NAS exposes itself over the internet without permission
#186Earlier quoted context omitted.
I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.
This sort of thinking is endemic in industrial networks; they finally internalized basic ipv4 concepts in the late 00s and never considered maybe the stateful tracking required for UPNP and other NAT tricks also might exist without it. I've set up several private v6 networks to deal with renewable energy projects in which the integrator used the same ipv4 address blocks on every single one, and the whole 6to4 transla…
There are many, many networking and originally UNIX tools tricks (e.g. SSH) you can show to the poor people supporting industrial networks/ hardware. I have written some of my tricks down in this OrgPage: https://www.orgpad.com/s/UHUor4 there are screenshots for Linux and Windows for some things related to SSHFS, SOCKS Proxy and more. Click units with shadows to open them. From time to time, I update it to reflect new tricks.
This knowledge saved at least 2 companies hundreds if not thousands of euros in on-site support, hardware and other expenses. Funnily, while these things are quite hacky, they tend to work better than most of the dedicated hardware I have seen in practice, while keeping you/ the technician/ engineer in control. With any kind of working infrastructure, you can estimate how good your solutions are because you don't get called at random times and from monitoring/ explicit contact you just see/ hear the things work fine.
Re: My NAS exposes itself over the internet without permission
#187Earlier quoted context omitted.
Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.
Aren't these two points slightly contradictory? > the author depends on NAT as a security feature, when it was never designed to be one > UPnP is a convenience feature, and is disabled in all security focused networks. uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your netwo…
UPNP doesn't "punch holes in NAT." It is dynamically configuring NAT to provide a specific translation. The same kind of dynamic translation happens the other way for any allowed outgoing traffic, and lots of old NAT traversal tricks made use of that before UPNP was a thing.
The hole was always there. People get this topic confused all the time because the majority of network devices doing NAT are also acting as firewalls of varying efficacy. There are basically no non-firewall routers anymore, they all have at least simple network address ACLs.
The purpose of upnp is touchless configuration. If you care about security, that is orthogonal to your goals, and so it must be restricted by some other policy enforcement.
Re: My NAS exposes itself over the internet without permission
#188Earlier quoted context omitted.
Do you have a router you recommend? Ideally something running free software
Look at the range of devices from GL.inet. They run a custom version of openwrt with a nice UI on top. But most are upstreamed and you can flash vanilla openwrt on them. They re quite cheap as well. I m not affiliated with them but I have bought devices from them. I use one between the router s ISP and my home network.
The 2 hub valica mesh model is a contender :)
Re: My NAS exposes itself over the internet without permission
#189Earlier quoted context omitted.
I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.
IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GU…
Ubiquiti's router offerings are rather poor, VPNs can't roll over to WAN2 automatically, redundant tunnels are hard to configure, IPv6 support is a mess, asking Ubiquiti for support gets you an unhelpful chat that redirects you to help articles you've already read.
Other players in this space have had these capabilities for over a decade, and you can call to get help. Ubiquiti might be inexpensive, but its still more than double the price of Grandstream's SoHo/SMB router and access point offerings while offering equivalent support and features.
Really neither of these offerings are good outside the SoHo and single location business space. I wish for OpenWRT, OPNsense or WatchGuard's configurability wrapped in a single interface that lets you see the router, switches and access points performance live while letting you alter their settings, without seriously kneecapped router capabilities.
Re: My NAS exposes itself over the internet without permission
#190Why would anybody need UPNP anyway? This has always been a mystery to me.