Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

231–240 of 311 posts

Re: My NAS exposes itself over the internet without permission

#231

Post by dcow »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

Or/also, nag your ISP to give you an IPv6 prefix (or switch to Comcast, because they delegate you a /62). If you still want to manage a stateful firewall then go for it. But we shouldn't still need this NAT traversal crap in an IPv6 world.

Re: My NAS exposes itself over the internet without permission

#232

Post by Tildey »

devwastaken wrote: post #230

Are there actually good alternatives to consumer NAS that don't break the bank? I'd love to just throw a raspi4b at some HDD's - but no sata, and no ECC. And the hard drives need to be kept safe from their vibrations.

Some USB drives with a Pi is a decent solution, given that the most cost effective option for HDDs is usually shucking WD easystores anyway. USB HDDs usually have decent vibration damping and cooling also. USB might be less ideal than SATA, same with ECC, but you’re also saving a major amount of money, % wise.

Re: My NAS exposes itself over the internet without permission

#233

Post by ComodoHacker »

kaliszad wrote: post #186
netflixandkill wrote: post #105

Earlier quoted context omitted.

This sort of thinking is endemic in industrial networks; they finally internalized basic ipv4 concepts in the late 00s and never considered maybe the stateful tracking required for UPNP and other NAT tricks also might exist without it. I've set up several private v6 networks to deal with renewable energy projects in which the integrator used the same ipv4 address blocks on every single one, and the whole 6to4 transla…

There are many, many networking and originally UNIX tools tricks (e.g. SSH) you can show to the poor people supporting industrial networks/ hardware. I have written some of my tricks down in this OrgPage: https://www.orgpad.com/s/UHUor4 there are screenshots for Linux and Windows for some things related to SSHFS, SOCKS Proxy and more. Click units with shadows to open them. From time to time, I update it to reflect ne…

Your link doesn't open in my Firefox, unfortunately.

Re: My NAS exposes itself over the internet without permission

#234

Post by 10000truths »

imwillofficial wrote: post #224
young_unixer wrote: post #192

Earlier quoted context omitted.

I have the opposite problem, where I actually want one of my devices to be publicly accesible but my ISP only provides NAT. And they even disable UPnP from some of their routers for "security reasons".

Why the sarcastic quotes around “security reasons”? Mom and pop need same defaults. An argument can be made that disabling it is a same default.

OP is not talking about disabled by default, he’s talking about disabled permanently, i.e. you literally cannot turn uPnP on because the ISP disables the functionality. I know that AT&T does this with their BGW210-700. Security is good, but locking people out of basic features is not.

Re: My NAS exposes itself over the internet without permission

#236

Post by Ballas »

devwastaken wrote: post #230

Are there actually good alternatives to consumer NAS that don't break the bank? I'd love to just throw a raspi4b at some HDD's - but no sata, and no ECC. And the hard drives need to be kept safe from their vibrations.

Perhaps look at some of the Odroid Homecloud solutions? They have some limitations, but are cheap and easy to use.

Re: My NAS exposes itself over the internet without permission

#237

Post by InafuSabi »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

There are ISP's out there which disallow the use of gateways other than theirs to enter their WAN. That means you are stuck with whatever config it allows.

I have root access to mine, so I can configure it to my liking, but the device is _not_ blinking out in quality, needing to be reset at least once every 14 days, otherwise it starts chocking when I need to transmit my radio stations over the NET

These type of ISP's make a lot of cash, selling bulk purchased cheap hardware, esp mine, which still sells services over copper using VDSL & ADSL2. Their FTTH speeds are also inconveniently capped on VDSL speeds

Re: My NAS exposes itself over the internet without permission

#238

Post by gfxgirl »

InafuSabi wrote: post #237
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

There are ISP's out there which disallow the use of gateways other than theirs to enter their WAN. That means you are stuck with whatever config it allows. I have root access to mine, so I can configure it to my liking, but the device is _not_ blinking out in quality, needing to be reset at least once every 14 days, otherwise it starts chocking when I need to transmit my radio stations over the NET These type of ISP'…

Can you not just put something behind their gateway?

Re: My NAS exposes itself over the internet without permission

#239

Post by Hamuko »

zinekeller wrote: post #216
Dylan16807 wrote: post #210

Earlier quoted context omitted.

For most ISPs the IPv4 acts exactly the same way, being almost but not quite stable. I don't understand how that's a downside to IPv6.

Because "most ISPs" are actually wrong, it's "most American ISPs". In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). There's a reason why dynamic DNS services are popular. P.S. If your security paradigm relies on IP addresses being semi-stable, you need to overhaul it.

>In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly).

I'm in the rest of the world and my non-static IP address almost never changes. I actually memorised my external IP address at one point since I saw it so often.

Re: My NAS exposes itself over the internet without permission

#240

Post by nullify88 »

batch12 wrote: post #217
daveoc64 wrote: post #199

Earlier quoted context omitted.

I have replied elsewhere about Xbox Live, but it's generally an impossibility (without advanced forwarding or UPnP) to have two consoles (of the same type - e.g. two Xbox One consoles or two Nintendo Switch consoles), connected to the internet, both able to access ALL online features, at the exact same time. Out of the box on most consumer networks, you're going to be able to access things like the store, downloading…

This is not true based on my experience with multiple switches and xbox one consoles.

It does depend on the game. A P2P game like Call of Duty will have problems when played simultaneously on more than one console because the external port can not be shared.

What happens though is that another external port gets forwarded to 3074 instead.

3074 -> 3074

3075 -> 3074

3076 -> 3074 etc.

Its likely uPnP does this automatically as even uPnP won't be able to map multiple devices to the same external port but it does make the process convenient.

Post reply on HN