Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

261–270 of 311 posts

Re: My NAS exposes itself over the internet without permission

#261

Post by BrandoElFollito »

BlueTemplar wrote: post #253
zinekeller wrote: post #216

Earlier quoted context omitted.

Because "most ISPs" are actually wrong, it's "most American ISPs". In rest of the world, unless you're explicitly requested static IPs, your IPv4 (and IPv6) addresses are being rotated (usually either daily or weekly). There's a reason why dynamic DNS services are popular. P.S. If your security paradigm relies on IP addresses being semi-stable, you need to overhaul it.

This is wrong, at least in Europe, static IP is considered to be best practice.

I live in France and work in IT and never heard about this "best practice". Who claims that?

In use the highest fibre offering from Orange and have a dynamic IP. Fixed IP is for "professionals".

Re: My NAS exposes itself over the internet without permission

#262

Post by BlueTemplar »

7steps2much wrote: post #127
eikenberry wrote: post #121

Earlier quoted context omitted.

So is this issue mostly with consoles? I've always kept UPnP off and we do lots of gaming here without a problem, but pretty much all PC gaming.

I can't say for sure, but I have never ever seen a PC game using UPnP. That said, I have only ever seen it once with a console, a PS3 in this case. And, don't quote me on this, but most PC games are not Peer-To-Peer. They often come with their own server software.

Yeah, which pretty much requires you to do manual port forwarding. And if you're behind a CGNAT, you can't host.

Re: My NAS exposes itself over the internet without permission

#263

Post by BlueTemplar »

clajiness wrote: post #87
dijit wrote: post #80

Earlier quoted context omitted.

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

I'm gaming on my Xbox right now with specific ports forwarded. I guess "absolutely must" is a bit much, huh? UPNP has no place in a secure network.

Well, NAT itself has pretty much no place on a network these days, so the point is kind of moot...

Re: My NAS exposes itself over the internet without permission

#264

Post by BlueTemplar »

nobody9999 wrote: post #40
my123 wrote: post #32

Earlier quoted context omitted.

Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...

>Without UPnP, you specifically have to configure your NAT for this... While I realize that configuring nftables/iptables is beyond most folks, there are many firewalls out there that have a GUI/webui which makes this dead simple. Not sure why this should be an issue in 2021, except for users' trained-in helplessness.

Since this is 2021, you should use IPv6, which doesn't need NAT.

Re: My NAS exposes itself over the internet without permission

#265

Post by BlueTemplar »

the8472 wrote: post #149
mnd999 wrote: post #95

Earlier quoted context omitted.

Suffix should always be static with SLAAC because it’s your MAC address. Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. If you’re using DHCPv6 then the DHCP server should take care of DNS as it would for v4.

> Suffix should always be static with SLAAC because it’s your MAC address. Except for devices that randomize mac addresses. Normally even those that do that only try do so when connecting to a new network but that's not always reliable. > Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. I'm doubtful that all applications make that distinction and adverti…

These issues will keep happening, in completely unrelated domains, as long there are not fines for violating security best practices.

Re: My NAS exposes itself over the internet without permission

#266

Post by BlueTemplar »

mnd999 wrote: post #95
the8472 wrote: post #45

Earlier quoted context omitted.

Opening ports for a specific machine with dynamic IPv6 addresses can be difficult though. If the suffix stays stable then with iptables you can use netmasks where you mask out the prefix rather than the suffix. If both prefix and suffix are dynamic you need a solution that takes dhcp or host names into account. Not all router firmwares support something like that. Another alternative is to use UPnP or PCP with authen…

Suffix should always be static with SLAAC because it’s your MAC address. Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. If you’re using DHCPv6 then the DHCP server should take care of DNS as it would for v4.

AFAIK the goal is to get rid of MAC adresses entirely - so how is this going to work?

Re: My NAS exposes itself over the internet without permission

#267

Post by BlueTemplar »

geocrasher wrote: post #142

The article focuses on the security issues surrounding his new NAS, and that's fine. But the problem isn't security. It's Trust. Consumers generally trust that manufacturers will follow Best Practices and that security is part of the deal: I pay you money, you give me a quality product that Just Works and is Secure. False. Products are made to be sold at a profit . You can imagine that some engineer at that company k…

Yeah, until we see these companies get large fines for not following the best practices, and the engineers in charge lose their licenses, nothing will change.

Re: My NAS exposes itself over the internet without permission

#268

Post by BlueTemplar »

BrandoElFollito wrote: post #261
BlueTemplar wrote: post #253

Earlier quoted context omitted.

This is wrong, at least in Europe, static IP is considered to be best practice.

I live in France and work in IT and never heard about this "best practice". Who claims that? In use the highest fibre offering from Orange and have a dynamic IP. Fixed IP is for "professionals".

RIPE : https://www.ripe.net/publications/docs/ripe-690#5-2--why-non...

That's funny, because I kind of have the "lowest" fiber offering from Orange, and I don't think my IP ever changed ? (I wouldn't bet on it thought.)

Re: My NAS exposes itself over the internet without permission

#269

Post by mnd999 »

BlueTemplar wrote: post #266
mnd999 wrote: post #95

Earlier quoted context omitted.

Suffix should always be static with SLAAC because it’s your MAC address. Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. If you’re using DHCPv6 then the DHCP server should take care of DNS as it would for v4.

AFAIK the goal is to get rid of MAC adresses entirely - so how is this going to work?

I don’t think that is the goal, no.

Re: My NAS exposes itself over the internet without permission

#270

Post by BlueTemplar »

mnd999 wrote: post #269
BlueTemplar wrote: post #266

Earlier quoted context omitted.

AFAIK the goal is to get rid of MAC adresses entirely - so how is this going to work?

I don’t think that is the goal, no.

There was always a tension between the Internet and Ethernet guys, the Internet guys have won, so Ethernet-specific concept like MAC adresses are on their way out ?
Post reply on HN