291–300 of 311 posts
> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…
Earlier quoted context omitted.
There are many, many networking and originally UNIX tools tricks (e.g. SSH) you can show to the poor people supporting industrial networks/ hardware. I have written some of my tricks down in this OrgPage: https://www.orgpad.com/s/UHUor4 there are screenshots for Linux and Windows for some things related to SSHFS, SOCKS Proxy and more. Click units with shadows to open them. From time to time, I update it to reflect ne…
Your link doesn't open in my Firefox, unfortunately.
You can also try this not-shortened link: https://www.orgpad.com/o/AWhUSD7lhAjYC0sw-9lcDd
Earlier quoted context omitted.
Usually, inbound IPv6 are firewalled by the ISP router just fine. As far as I know, there is UPnP with IPv6 though there seems to be some work into that direction. Also, current CGNAT setups tend to close connections before they should according to RFCs: https://anderstrier.dk/2021/01/11/my-isp-is-killing-my-idle-... All the IPv6 routing security has to be done with IPv4 as well. ARP -> NDP, prevent source address sp…
Pretty often, IPv6 is NOT firewalls (or the firewall is opt-in which in practice amounts to the same thing).
Earlier quoted context omitted.
Pretty often, IPv6 is NOT firewalls (or the firewall is opt-in which in practice amounts to the same thing).
Perhaps. Do you have concrete examples? As with everything: "Trust, but verify." https://en.wikipedia.org/wiki/Trust,_but_verify
Earlier quoted context omitted.
I do not understand what you are saying. Do you imply thet IPv4 is non-existant in Asia?? How having ran out of IPv4 means that there is no "rea" Internet? Honestly - it would be great if IPv6 caught up but the standard, first choice is IPv4.
My bad, I should have said that "some" Asian countries never had enough IPv4 addresses to start with. AFAIK this explains why India is one of the world leaders in IPv6 deployment ? (I've also heard that IPv6-only networks are not uncommon in some Asiatic countries ?) IPv6 has been slowly rolled out for more than a decade now, though AFAIK the standard has only been finalized in 2017. Since 2017, first choice should h…
Earlier quoted context omitted.
My bad, I should have said that "some" Asian countries never had enough IPv4 addresses to start with. AFAIK this explains why India is one of the world leaders in IPv6 deployment ? (I've also heard that IPv6-only networks are not uncommon in some Asiatic countries ?) IPv6 has been slowly rolled out for more than a decade now, though AFAIK the standard has only been finalized in 2017. Since 2017, first choice should h…
Internet stands for interconnected network, with the capital "I" signifying that it's "the" interconnected network.
Earlier quoted context omitted.
The source port would be random and conmunication would ride on that established connection. An exposed port is not necessary for client initiated communication.
Yes, you're talking about a device behind NAT which initiates a connection to an external service. However, we're talking about a service listening behind NAT (in this case Call of Duty on an Xbox at home) that needs to be listening for connections initiated by other Xboxes to establish a P2P connection. This is what port forwarding enables and this is what uPnP automates.
Earlier quoted context omitted.
Your link doesn't open in my Firefox, unfortunately.
I tried just now in two different Firefox (ESR and current) versions and it works. Perhaps you have to enable JavaScript, since OrgPad is a web application? You can also try this not-shortened link: https://www.orgpad.com/o/AWhUSD7lhAjYC0sw-9lcDd
Earlier quoted context omitted.
Aren't these two points slightly contradictory? > the author depends on NAT as a security feature, when it was never designed to be one > UPnP is a convenience feature, and is disabled in all security focused networks. uPnP punches holes in a NAT. If you shouldn't be trusting NAT to protect you anyway, why bother disabling a feature that's designed to punch holes in it? Just set up your firewall to protect your netwo…
UPNP doesn't "punch holes in NAT." It is dynamically configuring NAT to provide a specific translation. The same kind of dynamic translation happens the other way for any allowed outgoing traffic, and lots of old NAT traversal tricks made use of that before UPNP was a thing. The hole was always there. People get this topic confused all the time because the majority of network devices doing NAT are also acting as fire…
Another reply to my comment suggests that at least some consumer routers open a firewall port up as well, meaning that UPnP is still a potential security hole on those routers. (This might actually be required by the IGD protocol spec for all I know, that would be unfortunate...)
Earlier quoted context omitted.
IPv6 can be a privacy issue, sure, but it's no less secure, my firewall is still blocking all incoming IPv6 traffic. The issues with IPv6, in my experience come from its relative complexity, compared to IPv4, and also from forgetting to manage it at all, as it often uses different tools, firewalls, e.g. ip6tables vs iptables, or the fact that Ubiquiti EdgeRouters don't expose ANY IPv6 firewall configuration in the GU…
> IPv6 can be a privacy issue Why do people throw this out there as if it's a fact we all agree on? I've heard of one potential privacy issue 20 years ago, which was that IPv6 autoconf used the MAC address for the host part of the address, but this has long since been replaced with regularly rotating random suffixes. So... why keep saying this?