4 ms·
If one of those 5 tries to connect e.g. to a remote windows file server .. you now have an open port on your public IP which will accept packets from any IP on
by kiallmacinnes 8y ago
If one of those 5 tries to connect e.g. to a remote windows file server .. you now have an open port on your public IP which will accept packets from any IP on the internet and will forward them to the windows file share service on your desktop.
Add a stateful firewall with connection tracking, and that port is only open to the 1 server you tried to connect to.
- iforgotpassword 8y agoYes that's true, but not a problem for TCP since the attacker had to know the outgoing port from the ephemeral port range your PC or router picked, and then had to take over the running TCP session by additionally knowing the connections state (sequence number etc). For UDP you indeed have higher chances of talking to that device in an unsolicited manner, and this has been exploited by games and later Skype in the past. So yes, indeed more insecure, I stand corrected. I'm still more worried for actual exploits or security holes even in modern devices that can do proper firewalling the ISPs provide due to incompetence or laziness. Like the TR069 port being open on many devices two years ago.
- kiallmacinnes 8y agoYes, the modem/router is likely buggy as hell, most "consumer grade" CPEs are. The best defence for that IMO is to remove as much code as possible - like the unnecessary for IPv6 NAT stack..