5 ms·
> Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including ret
by chx 10y ago
> Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including retrieving the external IP address of the device, enumerate existing port mappings, and add or remove port mappings.
Are you bloody kidding me? Why do you even have a firewall, rudimentary as it is, then?
- geococcyxc 10y agoNot all home routers are allowing this by default. I don't have any hard numbers to offer, but my feeling is that only very old and today's very crappy ones do.
- closeparen 10y agoUPnP comes from the view that NAT is an unfortunate artifact of residential ISPs only giving out one IPv4 address per household, not a crucial security strategy. If you really think of your NATing router as a security device, turn off UPnP. Though I'm not sure how much good that will do, as any device can still phone home or reverse tunnel.
- chx 10y agoSure but port scanning and forming a massive botnet is impossible if they are not even capable of listening on an open port which NAT gives you for free. It's like the lemonade you could make when life you gives you lemons. Except now it's spoiled too.
- closeparen 10y agoOn the other hand, UPnP is the only currently viable strategy for average people to run devices on their home networks and control them from the internet without looping in a third party server.