Why would anybody need UPNP anyway? This has always been a mystery to me.
Mostly to make P2P software work (which includes gaming software, such as voice chat or serverless multiplayer games)
My NAS exposes itself over the internet without permission
201–210 of 311 posts
Re: My NAS exposes itself over the internet without permission
#202The article focuses on the security issues surrounding his new NAS, and that's fine. But the problem isn't security. It's Trust. Consumers generally trust that manufacturers will follow Best Practices and that security is part of the deal: I pay you money, you give me a quality product that Just Works and is Secure. False. Products are made to be sold at a profit . You can imagine that some engineer at that company k…
That was supposed to say "has terrible security habits." But the time to edit has passed. sigh.
Re: My NAS exposes itself over the internet without permission
#203Earlier quoted context omitted.
I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.
IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GU…
> IPv6 can be a privacy issue
Why do people throw this out there as if it's a fact we all agree on?
I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes.
So... why keep saying this?
Re: My NAS exposes itself over the internet without permission
#204Earlier quoted context omitted.
It's unlikely that you will have an "OPEN NAT" status on more than one console without UPnP at the same time. Depending on the game you're playing, that may or may not be an issue. It can stop you connecting to certain players in a peer to peer scenario.
It'll be fine. They'll be on two pretty arbitrary public ports, but it works just fine if you have a vaguely sane nat implementation in your router. That's the whole point of nat punching. And even if you have an incredibly broken nat implementation that won't accept UDP packets from other sources than the server you originally connected to, there's a fallback pathway at the first layer of that port 3074 protocol tha…
The last I looked on PS4, they expected you to use a particular port. I don't think there was a dynamic portion, just forward port X to the PS4. I could absolutely be wrong though, it's been a while.
Re: My NAS exposes itself over the internet without permission
#205Earlier quoted context omitted.
> Games consoles are the best example. Not with you there bud - we have multiple game consoles and my firewall doesn’t even support UPNP. I also have never set up and DNAT or ‘punched holes’ in it to Mae them work. They just do.
I have replied elsewhere about Xbox Live, but it's generally an impossibility (without advanced forwarding or UPnP) to have two consoles (of the same type - e.g. two Xbox One consoles or two Nintendo Switch consoles), connected to the internet, both able to access ALL online features, at the exact same time. Out of the box on most consumer networks, you're going to be able to access things like the store, downloading…
Only one of the two sides needs UPnP, no?
Re: My NAS exposes itself over the internet without permission
#206Earlier quoted context omitted.
IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GU…
> IPv6 can be a privacy issue Why do people throw this out there as if it's a fact we all agree on? I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes. So... why keep saying this?
Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.
Re: My NAS exposes itself over the internet without permission
#207Earlier quoted context omitted.
UPNP is pretty important for a lot of online games.
Yeah, you can’t really “manage your firewall” when consumer software doesn’t open fixed ports and assumes upnp.
Why not? Which consumer software breaks?
Normally people say games. I have disabled upnp on my firewall and there're two gaming PCs, a PS3, a PS4 and a PS5 running happily behind it. I just finished a Demon Soul's session with voice chat with friends with no problems. NAT type 2, because I managed my firewall to enable this.
Re: My NAS exposes itself over the internet without permission
#208Earlier quoted context omitted.
I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.
IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GU…
IPv6 privacy issue? You know that you get /32 block, you can change your IP from that block every hour if you want.
The issue with IPv6 is that links are significantly slower than IPv4 links today.
Re: My NAS exposes itself over the internet without permission
#209Earlier quoted context omitted.
I've replied to a couple of others, normally I would have recommended Ubiquiti, but I no longer do. Not just because of their recent breach debackle, but because their software quality has declined since some of their best developers left. The short but not so useful answer is, run something with pfSense or similar, I hear PCEngines hardware works well and is open source from the bootloader up. Ubiquiti has hardware…
Considering linksys WRT3200ACM. Heard pfsense is not good with wireless.
I switched to pfsense* from a WRT. Awful router! It uses a cloud service to log in and nine times out of ten the awfulness that is their app cannot "locate a Linksys router on the network" even from a phone using the routers WiFi. I even tried flashing OpenWRT which was much better but the hardware still sucked and had to be restarted often. Cannot recommend (sadly I did recommend it to a friend before I knew how awful it is and he has the exact same problems even though he owns a different WRT model (1900 I think)).
* I'd recommend OPNsense over pfsense. If nothing else then because they break licenses (pfsense is NOT open source as they claim. You cannot built from the sources they provide).
Re: My NAS exposes itself over the internet without permission
#210Earlier quoted context omitted.
> IPv6 can be a privacy issue Why do people throw this out there as if it's a fact we all agree on? I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes. So... why keep saying this?
Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.
For most ISPs the IPv4 acts exactly the same way, being almost but not quite stable. I don't understand how that's a downside to IPv6.