211–220 of 311 posts
Earlier quoted context omitted.
Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...
> Notably, it is a must for VoIP Wouldn't making STUN work be a better alternative?
> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
Do you have a router you recommend? Ideally something running free software
Earlier quoted context omitted.
This is completely false. Almost all home networks use port-restricted NAT, which allows for STUN for NAT traversal. You do not need UPnP to play games, even those that have peer to peer multiplayer. Also STUN for VOIP does not increase latency. It tells you your external IP and port. Edit: Port symmetric —> port restricted
I get the feeling you’ve never ran n>1 Xbox Ones connecting to Xbox Live at the same time. Without UPnP only one will be able to connect.
Earlier quoted context omitted.
I'm sorry, I didn't mean to come off as offensive. I agree that it would be bothersome to convert from uPnP to non-uPnP, but you really only need to set it up once. Then any new devices you add to your network don't require individual workarounds.
It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in…
Isn't it more difficult to justify keeping it on when you can't trust devices not to, literally as the article shows, punch gaping holes in your network? 4 ports and if you didn't know too look...
At a bare minimum, if you MUST have uPnP, then those devices need to be on their own "unsafe" network with another network further in or next to it that has uPnP disabled.
> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
Nothing wrong with uPnP. If you’re worried about something opening up ports on your network, you’re already compromised.
Earlier quoted context omitted.
Because the prefix stays the same. And many ISPs that provide IPv6 don’t rotate very often, if at all.
For most ISPs the IPv4 acts exactly the same way, being almost but not quite stable. I don't understand how that's a downside to IPv6.
P.S. If your security paradigm relies on IP addresses being semi-stable, you need to overhaul it.
Earlier quoted context omitted.
> Games consoles are the best example. Not with you there bud - we have multiple game consoles and my firewall doesn’t even support UPNP. I also have never set up and DNAT or ‘punched holes’ in it to Mae them work. They just do.
I have replied elsewhere about Xbox Live, but it's generally an impossibility (without advanced forwarding or UPnP) to have two consoles (of the same type - e.g. two Xbox One consoles or two Nintendo Switch consoles), connected to the internet, both able to access ALL online features, at the exact same time. Out of the box on most consumer networks, you're going to be able to access things like the store, downloading…
Earlier quoted context omitted.
Aren't these two points slightly contradictory? > the author depends on NAT as a security feature, when it was never designed to be one > UPnP is a convenience feature, and is disabled in all security focused networks. uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your netwo…
UPNP doesn't "punch holes in NAT." It is dynamically configuring NAT to provide a specific translation. The same kind of dynamic translation happens the other way for any allowed outgoing traffic, and lots of old NAT traversal tricks made use of that before UPNP was a thing. The hole was always there. People get this topic confused all the time because the majority of network devices doing NAT are also acting as fire…
Earlier quoted context omitted.
It'll be fine. They'll be on two pretty arbitrary public ports, but it works just fine if you have a vaguely sane nat implementation in your router. That's the whole point of nat punching. And even if you have an incredibly broken nat implementation that won't accept UDP packets from other sources than the server you originally connected to, there's a fallback pathway at the first layer of that port 3074 protocol tha…
This Xbox help article explains how having a "Moderate" or "Strict" NAT can affect you and how it can be solved: https://support.xbox.com/en-GB/help/hardware-network/connect... I don't think anything has fundamentally changed in this area since the days of the Xbox 360. Back then it was a PITA to get two or more consoles working properly without UPnP, and I can't see anything about the problem that would be different…
Earlier quoted context omitted.
For most ISPs the IPv4 acts exactly the same way, being almost but not quite stable. I don't understand how that's a downside to IPv6.
Because "most ISPs" are actually wrong, it's "most American ISPs". In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). There's a reason why dynamic DNS services are popular. P.S. If your security paradigm relies on IP addresses being semi-stable, you need to overhaul it.
Fair, but that's still IPv4 and IPv6 rotating at the same rate.