Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

191–200 of 311 posts

Re: My NAS exposes itself over the internet without permission

#191

Post by nobody9999 »

benlivengood wrote: post #90
nobody9999 wrote: post #40

Earlier quoted context omitted.

>Without UPnP, you specifically have to configure your NAT for this... While I realize that configuring nftables/iptables is beyond most folks, there are many firewalls out there that have a GUI/webui which makes this dead simple. Not sure why this should be an issue in 2021, except for users' trained-in helplessness.

> Not sure why this should be an issue in 2021, except for users' trained-in helplessness. Kids hosting games on random ports (terraria, etc.) benefit from UPnP. I'd rather enable it than manually enter firewall rules for each game or give them admin access to the firewall. UPnP is only an additional risk if you have malware inside your network already and then it mostly allows malware to host services in a simpler w…

>UPnP is only an additional risk if you have malware inside your network already

I'm not sure where you get that idea. Once a hole is poked (depending on the perimeter device/software in use), it stays poked and you've expanded your attack surface.

I make sure that there's no dynamically defined external access to my network. Can you guarantee that no software in use on your network is free of vulnerabilities? I'm not talking about malware here, just your run-of-the-mill software bugs.

If you think the answer is no, then why don't you share your network details with us and let's have a go? Then we'll see how much of an extra risk upnp might be.

What's that? You'd prefer not to do so? If there's no risk, then it shouldn't be a problem, right?

My suggestion is (obviously, I hope) an idle one and more intended as food for thought.

>Kids hosting games on random ports (terraria, etc.) benefit from UPnP. I'd rather enable it than manually enter firewall rules for each game or give them admin access to the firewall.

That may be a valid use case for you. However, claiming that it doesn't increase your attack surface/risk profile doesn't magically make it so.

I'm not telling you what you should or shouldn't do, but I do disagree with your rationalizations about why allowing upnp to expose your perimeter doesn't increase your risk profile.

Re: My NAS exposes itself over the internet without permission

#192

Post by young_unixer »

DarkmSparks wrote: post #143
takeda wrote: post #43

Earlier quoted context omitted.

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

IMHO IPv6 is an ISP problem, I don't need every (any, really) of my devices accessible from outside my personal VPN, and IPV4 private space is more than sufficient for that. IPv6 is overly complex, therefore insecure. Thanks to the US Patriot Act I dont even trust the VPN stuff tbh.

I have the opposite problem, where I actually want one of my devices to be publicly accesible but my ISP only provides NAT.

And they even disable UPnP from some of their routers for "security reasons".

Re: My NAS exposes itself over the internet without permission

#193

Post by monocasa »

daveoc64 wrote: post #184
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

People make blanket statements like this without thinking of how it is used by popular consumer devices. As others have said it's really necessary for some consumer devices to work properly - especially if you have more than one of the same device. Games consoles are the best example. If you have one console only, then you can usually forward ports manually, but if you have two or more of the same console, and want t…

That's not true, at least for xbox live. It's NAT punching will gladly use UPnP if available, but doesn't rely on it, even for multiple devices on the same public IP.

Re: My NAS exposes itself over the internet without permission

#194

Post by djrogers »

> Unfortunately, disabling uPnP these days is too much of a hit to convenience,

No. Just, no. There is NOTHING you need on your network that should require UPNP. It’s a horrible, insecure, and completely irresponsible protocol that does not need to exist.

Re: My NAS exposes itself over the internet without permission

#196

Post by happyopossum »

daveoc64 wrote: post #184
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

People make blanket statements like this without thinking of how it is used by popular consumer devices. As others have said it's really necessary for some consumer devices to work properly - especially if you have more than one of the same device. Games consoles are the best example. If you have one console only, then you can usually forward ports manually, but if you have two or more of the same console, and want t…

> Games consoles are the best example.

Not with you there bud - we have multiple game consoles and my firewall doesn’t even support UPNP. I also have never set up and DNAT or ‘punched holes’ in it to Mae them work. They just do.

Re: My NAS exposes itself over the internet without permission

#197

Post by daveoc64 »

monocasa wrote: post #193
daveoc64 wrote: post #184

Earlier quoted context omitted.

People make blanket statements like this without thinking of how it is used by popular consumer devices. As others have said it's really necessary for some consumer devices to work properly - especially if you have more than one of the same device. Games consoles are the best example. If you have one console only, then you can usually forward ports manually, but if you have two or more of the same console, and want t…

That's not true, at least for xbox live. It's NAT punching will gladly use UPnP if available, but doesn't rely on it, even for multiple devices on the same public IP.

It's unlikely that you will have an "OPEN NAT" status on more than one console without UPnP at the same time.

Depending on the game you're playing, that may or may not be an issue.

It can stop you connecting to certain players in a peer to peer scenario.

Re: My NAS exposes itself over the internet without permission

#198

Post by monocasa »

daveoc64 wrote: post #197
monocasa wrote: post #193

Earlier quoted context omitted.

That's not true, at least for xbox live. It's NAT punching will gladly use UPnP if available, but doesn't rely on it, even for multiple devices on the same public IP.

It's unlikely that you will have an "OPEN NAT" status on more than one console without UPnP at the same time. Depending on the game you're playing, that may or may not be an issue. It can stop you connecting to certain players in a peer to peer scenario.

It'll be fine. They'll be on two pretty arbitrary public ports, but it works just fine if you have a vaguely sane nat implementation in your router. That's the whole point of nat punching. And even if you have an incredibly broken nat implementation that won't accept UDP packets from other sources than the server you originally connected to, there's a fallback pathway at the first layer of that port 3074 protocol that bridges p2p messages through live's backend.

As another example, last time I checked WebRTC didn't use UPnP, but has all the same issues as a fundamentally P2P UDP protocol. They use STUN/ICE/TURN, live uses custom protocols filling the same niches.

Re: My NAS exposes itself over the internet without permission

#199

Post by daveoc64 »

happyopossum wrote: post #196
daveoc64 wrote: post #184

Earlier quoted context omitted.

People make blanket statements like this without thinking of how it is used by popular consumer devices. As others have said it's really necessary for some consumer devices to work properly - especially if you have more than one of the same device. Games consoles are the best example. If you have one console only, then you can usually forward ports manually, but if you have two or more of the same console, and want t…

> Games consoles are the best example. Not with you there bud - we have multiple game consoles and my firewall doesn’t even support UPNP. I also have never set up and DNAT or ‘punched holes’ in it to Mae them work. They just do.

I have replied elsewhere about Xbox Live, but it's generally an impossibility (without advanced forwarding or UPnP) to have two consoles (of the same type - e.g. two Xbox One consoles or two Nintendo Switch consoles), connected to the internet, both able to access ALL online features, at the exact same time.

Out of the box on most consumer networks, you're going to be able to access things like the store, downloading updates etc.

To play with certain players on peer to peer games (which are less common these days) or have a voice chat with certain players, you will need to port forward (manually or with UPnP).

You either need to forward ports manually (which can obviously only be done to one console), or use UPnP. The Xbox One and later does have an option to manually ask it to use a different port on multiple consoles for some features (so that you can port forward separately to consoles), but I am unsure if that will solve all issues in such an environment.

Re: My NAS exposes itself over the internet without permission

#200

Post by daveoc64 »

monocasa wrote: post #198
daveoc64 wrote: post #197

Earlier quoted context omitted.

It's unlikely that you will have an "OPEN NAT" status on more than one console without UPnP at the same time. Depending on the game you're playing, that may or may not be an issue. It can stop you connecting to certain players in a peer to peer scenario.

It'll be fine. They'll be on two pretty arbitrary public ports, but it works just fine if you have a vaguely sane nat implementation in your router. That's the whole point of nat punching. And even if you have an incredibly broken nat implementation that won't accept UDP packets from other sources than the server you originally connected to, there's a fallback pathway at the first layer of that port 3074 protocol tha…

This Xbox help article explains how having a "Moderate" or "Strict" NAT can affect you and how it can be solved:

https://support.xbox.com/en-GB/help/hardware-network/connect...

I don't think anything has fundamentally changed in this area since the days of the Xbox 360. Back then it was a PITA to get two or more consoles working properly without UPnP, and I can't see anything about the problem that would be different now.

Nintendo has a similar page:

https://www.nintendo.co.uk/Support/Nintendo-Switch/Troublesh...

So does Sony:

https://manuals.playstation.net/document/gb/ps4/settings/nw_...

Post reply on HN