17 ms·

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy from someone like TrueNAS.

bunnyfoofoo 6y ago
Edited: deleted my comment as I was unintentionally offensive.
- rovr138 6y ago
  Is there a reason why the software claims it’s not available over the internet but still is because of something it did? Because that’s a bug.
- kn100 6y ago
  To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep playing those with it disabled. Sysadminning at home is only fun for a short while, I do this stuff at work, I'd rather keep my home setup as simple as I can help it. As usual, various solutions are available, I described one here. Disabling uPnP is an option for some, and I encourage those who want to go that route to go that route.
  - hluska 6y ago
    I agree with bunnyfoofoo’s conclusion - maybe not the tone but certainly the conclusion. It’s tough to trust an article that makes security claims while ignoring so many self imposed security holes.
  - edoceo 6y ago
    It's not offensive. But you were offended. Big difference.
    - dxdm 6y ago
      I'm wondering what definition of the word "offensive" you're using.
      - edoceo 6y ago
        Offensive as Rude. Then @kn100 assigns to @bunnyfoofoo the offending behaviour. It's the personal responsibility thing. "I'm offended" vs "You're offensive".
        adamweld 6y ago
        I think it's pretty clear than the author believes he may have offended people with his statement, and is rephrasing in a more precise manner to avoid confusion.
      - vczf 6y ago
        To be very exact, being offended is a choice, in that nobody can offend you if you don't let them. You can always choose to not take offense. (The statement in question does seem rude and dismissive to me, however.)
        washadjeffmad 6y ago
        I believe the eminent feminist and humanitarian, Elanor Roosevelt, would have agreed with the fairness of your assessment. https://quoteinvestigator.com/2012/04/30/no-one-inferior/ https://quoteinvestigator.com/2012/04/30/no-one-inferior/
    - bayindirh 6y ago
      Actually, I also found grandparent's (bunnyfoofoo) tone offensive. It's borderline derogatory, since it disregards the situation of the original author in many levels, plus everyone fixates on the wrong point. UPnP has its security implications, but it doesn't mean that random appliances can just open ports through it without any settings whatsoever. Everybody has the freedom to have opinions and free to express them, however we shouldn't disregard other person's situation while expressing our opinion. Talking about theoretical best practices is always easy in a vacuum. Addendum: I want to congratulate bunny for trying to learn from his/her mistakes, for being honest and sincere. I wanted to leave it here since there's no other way to contact. I also made a lot of mistakes and HN taught me how to discuss this stuff, so you're at the right place.
  - uberswe 6y ago
    I think some people miss the point of the article. That a NAS like Terramaster F2-210 shouldn't open ports externally and if they do there should be options to turn this feature off.
  - washadjeffmad 6y ago
    It was clear you didn't want to disable UPnP support on the entire network, but I couldn't tell whether you'd tried disabling it on the NAS. Does the following disable the FS2-210's local UPnP? Go to TOS Desktop> Control Panel> Network Services> Discovery Service> UPnP Discovery > Uncheck "Enable UPnP discovery service" https://help.terra-master.com/TOS/view/?lang/en-us/flag/discovery https://help.terra-master.com/TOS/view/?lang/en-us/flag/disc... I assume this won't break anything you don't want broken (ie- automatic port forwards), but I'm with you that the option is needlessly ambiguous.
    - kn100 6y ago
      This option was and is disabled - I should have mentioned this in the blog post
  - bunnyfoofoo 6y ago
    I'm sorry, I didn't mean to come off as offensive. I agree that it would be bothersome to convert from uPnP to non-uPnP, but you really only need to set it up once. Then any new devices you add to your network don't require individual workarounds.
    - kn100 6y ago
      It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in a somewhat fruitless fight with the stuff I can control to keep the uPnP port punching under control somewhat. It's definitely a bug in the nas that it continues to punch ports no matter how it is configured. Plenty of software gives you the option of not punching ports.
      - rubatuga 6y ago
        You keep saying "whatever" software wouldn't work without UPnP, but you are failing to give us concrete examples.
        deleted 6y ago
        [deleted]
        imwillofficial 6y ago
        You are responding to His blog, and He shared His reasoning. Go find your own examples on your network. Even better if you can’t find anything and have UPNP disabled.
      - zippergz 6y ago
        FWIW I have never had upnp enabled and I don't recall any cases where it's caused a problem for me. Certainly my wife and I are on videoconferences all day and they work fine. I am completely with you that I can't have network configurations that make the network unusable, confusing, or inconvenient for my family, but are you sure that upnp falls into that category? I'm sure you have different applications than I do, but I think we're pretty normal...
- crazygringo 6y ago
  You mean ignoring the fact that a NAS which claims to not be available over the internet is available over the internet? The correct solution is the NAS manufacturer needs to correct the issue and provide a software update. This article shouldn't be ignored at all. Your supposed "correct solution" does nothing to fix the root issue.
- imwillofficial 6y ago
  Man, I have to catch myself all the time with this.
ancarda 6y ago
Do you have a router you recommend? Ideally something running free software
- annoyingnoob 6y ago
  OPNsense or pfSense
  - anonymousiam 6y ago
    I have used both OPNsense and pfSense. I currently OpenWRT which I find to be full featured, secure, and lightweight.
- alias_neo 6y ago
  Hardware wise, I run Ubiquiti EdgeMAX but I wouldn't recommend them anymore, their software has gone down hill since many of their best developers left. Software wise, pfSense is where it's at, but I don't have experience with their own hardware other than the ones we ran at work all failed due to a silicon flaw in the Intel SoCs they ran.
  - 7steps2much 6y ago
    > Ubiquiti EdgeMAX but I wouldn't recommend them anymore Sadly there isn't exactly a lot of alternatives in the hobbyist network setup area ... It's basically just ubiquity and mikrotik at this point as far as I know
    - zokier 6y ago
      I've heard good things about Turris hardware too, but no personal experience. https://www.turris.com/en/omnia/overview/ https://www.turris.com/en/omnia/overview/
  - JoshTriplett 6y ago
    > Software wise, pfSense is where it's at Recent events suggest that the people behind pfSense are not especially responsible stewards; see https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... and https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/ .
deburo 6y ago
I also found this weird, and this got me to check if it was enabled on my business firewall devices: turns out they don't even support UPnP. Is it just consumer routers that support it nowadays? Shouldn't that feature just be nuked? EDIT: Well it sounds like a feature for pro users that know what they are doing and control all devices on the network. Even then, security appliances (eg. from SonicWall) don't support it. I don't know, this is probably a niche feature for a few occasions.
- my123 6y ago
  Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...
  - nobody9999 6y ago
    >Without UPnP, you specifically have to configure your NAT for this... While I realize that configuring nftables/iptables is beyond most folks, there are many firewalls out there that have a GUI/webui which makes this dead simple. Not sure why this should be an issue in 2021, except for users' trained-in helplessness.
    - hluska 6y ago
      Ugh, users trained in helplessness. I just had an utterly annoying conversation with my cell phone provider whose reps have been trained in helplessness and thus fail to follow really simple security procedures. This phrase is a thing of nightmares now. Stay tuned for a really scary Haunted House full of users trained in helplessness...coming Halloween 2021.
    - benlivengood 6y ago
      > Not sure why this should be an issue in 2021, except for users' trained-in helplessness. Kids hosting games on random ports (terraria, etc.) benefit from UPnP. I'd rather enable it than manually enter firewall rules for each game or give them admin access to the firewall. UPnP is only an additional risk if you have malware inside your network already and then it mostly allows malware to host services in a simpler way, but capable malware will be able to use TCP hole punching to establish arbitrary connections between infected networks.
KozmoNau7 6y ago
The issue is letting untrusted or badly behaved devices on the network. UPnP works great, if you control which devices get on your network. Static port forwarding combined with DHCP gets annoying quickly, you end up having to set up static assignments for every device that may need a port forwarded, which can be a lot, with modern multiplayer gaming and p2p. And for applications that select a random port on startup, such as some bittorrent clients, you either have to manually forward the port every time or select a static port. UPnP serves a purpose and is extremely convenient, as long as you trust the devices on your network.
- lostlogin 6y ago
  > And for applications that select a random port on startup, such as some bittorrent clients, you either have to manually forward the port every time or select a static port. What if you run them over a VPN? I don’t use torrents much but have a client containerised with OpenVPN. I’m not a networking expert but I had assumed (with all the dangers that comes with) that this moved the problem to the VPN provider?
  - mercora 6y ago
    it will work as long as you are the one initiating the connection. if some peer suspects you have a wanted piece available i.e. from another peer in the swarm it can not communicate the intent to get that piece from you to your client directly. i think BitTorrent can relay messages through intermediate peers to make your client establish the connection to that other peer (reversing the initiator). Otherwise peers will exchange other peers that are visible to them so that your client might eventually learn how the other peer that wanted that piece is reachable and connects to it. So it actually will work without port forwarding but reaching your client will be harder and thus less peers inside the swarm will be available to you or them, likely making it slower.
- daniellarusso 6y ago
  So, keeping track of which device on your network belongs to which MAC address, and reserving an address for each, is that what you mean by ‘annoying’ - the administration of that?
procombo 6y ago
Doesn't TrueNAS (was FreeNAS) connect to iXsystem servers from the NAS and from the NAS web interface?
kalleboo 6y ago
UPnP is also sometimes used to refer to some forms of zeroconf/mDNS/Bonjour/DLNA. Maybe he is under the impression if he turns off UPnP on his router (the automatic port forwarding feature), that his LAN device discovery features will break?
sdflhasjd 6y ago
UPNP is pretty important for a lot of online games.
- Spivak 6y ago
  Yeah, you can’t really “manage your firewall” when consumer software doesn’t open fixed ports and assumes upnp.
  - Daho0n 6y ago
    Why not? Which consumer software breaks? Normally people say games. I have disabled upnp on my firewall and there're two gaming PCs, a PS3, a PS4 and a PS5 running happily behind it. I just finished a Demon Soul's session with voice chat with friends with no problems. NAT type 2, because I managed my firewall to enable this.
    - BlueTemplar 6y ago
      Have you tried a client/server style game not relying on Steam multiplayer?
      - Daho0n 6y ago
        It makes no difference since as I wrote I manage the firewall to allow this. But yes, since none of the games on consoles use Steam. If NAT wasn't set up I would get NAT type 3 on the PlayStations for example. ETA: My point was to get an example of something that breaks "because it doesn't work without upnp". I have yet to see a game that doesn't support a fixed set of ports.
- Tepix 6y ago
  Which ones? I have it turned off and haven't had any issues with games.
  - sdflhasjd 6y ago
    Games that use Peer-to-peer lobbies instead of dedicated servers, more popular with multiplayer co-op games. Typically, it can be possible to join another lobby, but impossible to host (insofar as other people can't connect to it)
takeda 6y ago
I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.
- mavhc 6y ago
  NAT can mean 2 things, 1 to 1, and 1 to many. Firewall is a concept not a thing. IPv6 could be set up so every computer has an internal address and you choose to map external to internet using 1 to 1 NAT.
  - imwillofficial 6y ago
    As a former maintainer of firewalls... You are wrong. From beginning to end, utterly, and completely. ::Pets His firewalls lovingly:: “Don’t listen to Him, He didn’t mean it.”
  - nix23 6y ago
    Ah yeah the good old IPv6-NAT....
- rubatuga 6y ago
  Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.
  - nemosaltat 6y ago
    This is what I did a couple years ago. The documentation for OpenWRT is great, and Luci/LDE makes it approachable if you don’t feel comfortable managing from the CLI. I have one VLAN for my “privileged” devices and one for the “IO(shi)T” devices.
  - kaylynb 6y ago
the8472 6y ago
Opening ports for a specific machine with dynamic IPv6 addresses can be difficult though. If the suffix stays stable then with iptables you can use netmasks where you mask out the prefix rather than the suffix. If both prefix and suffix are dynamic you need a solution that takes dhcp or host names into account. Not all router firmwares support something like that. Another alternative is to use UPnP or PCP with authentication.
- mnd999 6y ago
  Suffix should always be static with SLAAC because it’s your MAC address. Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. If you’re using DHCPv6 then the DHCP server should take care of DNS as it would for v4.
  - the8472 6y ago
    > Suffix should always be static with SLAAC because it’s your MAC address. Except for devices that randomize mac addresses. Normally even those that do that only try do so when connecting to a new network but that's not always reliable. > Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. I'm doubtful that all applications make that distinction and advertise the right address. If they just use some external "what is my IP" service to determine their address because that's what they did for IPv4 then they'll get the privacy address and advertise that to peers because that'll be picked by default for outgoing connections. Being able to allow incoming connections to a port for any address belonging to a particular machine would be less error-prone.
    - BlueTemplar 6y ago
      These issues will keep happening, in completely unrelated domains, as long there are not fines for violating security best practices.
  - BlueTemplar 6y ago
    AFAIK the goal is to get rid of MAC adresses entirely - so how is this going to work?
hh3k0 6y ago
> If the author really cares, go one step further and replace the ISP owned router with something with more control. I wanted to do that for a while now. Do you happen to have a good suggestion regarding whose products are worthwhile?
- alias_neo 6y ago
  Its muddy right now, I run Ubiquiti EdgeMAX switches and EdgeRouter at home, but I wouldn't recommend them right now (see another comment of mine, or check out the subreddit), for NAS I run TrueNAS, on a home built server.
  - daniellarusso 6y ago
    For your NAS, to you have a mobo and case recommendation?
    - eikenberry 6y ago
      Not OP, but I built a NAS not that long ago. For the case I purchased the Fractal Design Node 304 (https://www.fractal-design.com/products/cases/node/node-304/black/ https://www.fractal-design.com/products/cases/node/node-304/...) and am very happy with it. For the Mobo I suggest finding a decent board (AMD based one if you want ECC RAM) and then use a PCI-e controller card to support the hard drives you need. It is hard to find a nice MB with all the SATA ports you need, using an external card gives you a lot more options. When I researched it everyone recommended an "LSI Logic Controller Card LSI00301 SAS 9207-8i" (eg. https://www.amazon.com/LSI-Controller-LSI00301-9207-8i-Internal/dp/B008J49G9A/ https://www.amazon.com/LSI-Controller-LSI00301-9207-8i-Inter...) and it has performed very well for me. If you go that way you'll need a SAS to SATA cable, they are easy to find as well.
- spockz 6y ago
  Up until a week ago I would have suggested the UniFi. Since the latest snafu, the handling of the breach not the breach itself, I’m not so sure anymore what would be the best alternative. Perhaps just their EdgeRouter devices or a mikrotik device. The snafu: https://news.ycombinator.com/item?id=26638145 https://news.ycombinator.com/item?id=26638145
watermelon0 6y ago
Sure, UPnP can open ports to the outside world, but that's something that might be desired in some cases. However, devices should default to local access only, and offer an option to expose them to the world, with appropriate warning.
- kn100 6y ago
  This is exactly my opinion and exactly how I use uPnP. I can't control exactly what runs on my network since I'm not the only one using it, but I can guard certain parts of my network more thoroughly.
  - rubatuga 6y ago
    You have to choose: security or convenience.
    - rembicilious 6y ago
      “They that would give up a little convenience for a little security deserve neither and they shall lose them both.” -Beenjammin Frankmon
    - imwillofficial 6y ago
      It’s a sliding scale, otherwise you’d run an airgapped network and hand carry your info into and out of your home on CDs...
      - MomoXenosaga 6y ago
        Reminds me of a state secretary who decided to use gmail because it was more convenient than the secure smartphone provided to him. Ofcourse for most people who aren't dealing with state secrets convenience is a priority.
- zokier 6y ago
  > However, devices should default to local access only Unfortunately we need to act based on what is and not what should be.
testfoobar 6y ago
Agreed. My router firewall drops all packets from my NAS to my WAN. Doesn’t matter what software it runs.
dijit 6y ago
On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.
- clajiness 6y ago
  I'm gaming on my Xbox right now with specific ports forwarded. I guess "absolutely must" is a bit much, huh? UPNP has no place in a secure network.
  - dijit 6y ago
    This is not a reasonable solution for most people, it requires intimate knowledge of the games you play (which ports they use), a static IP for your console and no more than one player/console per household. Heaven forbid you have a PC game and a Xbox game that have conflicting ports. And, I just have to say: you open arbitrary ports to your game console from the internet and talk about security.
  - easton 6y ago
    n>1, not n=1.
  - BlueTemplar 6y ago
    Well, NAT itself has pretty much no place on a network these days, so the point is kind of moot...
- rubatuga 6y ago
  This is completely false. Almost all home networks use port-restricted NAT, which allows for STUN for NAT traversal. You do not need UPnP to play games, even those that have peer to peer multiplayer. Also STUN for VOIP does not increase latency. It tells you your external IP and port. Edit: Port symmetric —> port restricted
  - waffle_ss 6y ago
    I get the feeling you’ve never ran n>1 Xbox Ones connecting to Xbox Live at the same time. Without UPnP only one will be able to connect.
atmosx 6y ago
Indeed, UPNP effectively turns on "auto-pilot". The fridge running on 10 years old firmware might open ports dynamically. Networks featuring UPNP should be marked as "open/insecure".
- KozmoNau7 6y ago
  If your fridge has a MAC address, you have much much deeper problems than UPnP.
xyst 6y ago
also dont buy Ubiquiti gear :)
rufius 6y ago
Honest question - what would I use UPnP for? I discovered a similar issue as the blog poster with my QNAP NAS which was easily remedied by disabling UPnP. I’ve not noticed any issues. We can do all the same things we did before. My Xbox and Switch still do online multiplayer just fine. I remember hearing Xbox/PS3-4 and UPnP mentioned together but it’s been a while.
- rand49an 6y ago
  UPnP allows devices to open up firewall ports for themselves to allow traffic to reach them inbound. Games (for example) that that host a server on the users local machine may require an open port to allow access inbound so UPnP can help with this. Now-a-days it's not used much and quite frankly it was always a fairly bad idea.
  - BlueTemplar 6y ago
    Nowadays you should use IPv6 anyway, which doesn't need NAT.
stilisstuk 6y ago
So I don't know about routers or networks. I live in a an apartment. Which router (+ a extra point / 2 hub mesh) is recommended these days. There seems to be a plethora of options. But most of always end with ubiquity, which today feels like a bad choice. Also kind of expensive. Preferable something Completely local. No cloud service. Preferable opens source. I live in EU. (Sorry if it's bad form to ask for product recommendations, but I am unhappy with/ don't trust, my isp provided router, and gp explicitly mentions buying a router)
- newsclues 6y ago
  Mikrotik
  - katbyte 6y ago
    The ux is... not good and I wouldn’t recommend it for anyone not experienced
    - omnimus 6y ago
      yeah i bought Mikrotik for home and i have no idea what to do there. I tried to do hairpin nat with it and after 3 tutorials i somehow managed to get it working and now i have no clue how does it work or what its it really doing. I think its only for real networking pros
- stefan_ 6y ago
  Can you get rid of your ISP provided router? There are lots of obstacles there.
  - stilisstuk 6y ago
    I don't know to be honest?
- alias_neo 6y ago
  I've replied to a couple of others, normally I would have recommended Ubiquiti, but I no longer do. Not just because of their recent breach debackle, but because their software quality has declined since some of their best developers left. The short but not so useful answer is, run something with pfSense or similar, I hear PCEngines hardware works well and is open source from the bootloader up. Ubiquiti has hardware offloading using Cavium hardware so you need to get some throughout tests if you need high bandwidth in hardware without the offloading hardware.
gsich 6y ago
That sounds like he didn't even try.
rdudek 6y ago
Nothing wrong with uPnP. If you’re worried about something opening up ports on your network, you’re already compromised.
- Daho0n 6y ago
  Like a buggy NAS. So yes, lots wrong with upnp. Letting anything with an IP forward ports is being auto compromised.
milleramp 6y ago
Yes, the real lesson here is, I learned not to trust random vendors and turned off upnp.
daveoc64 6y ago
People make blanket statements like this without thinking of how it is used by popular consumer devices. As others have said it's really necessary for some consumer devices to work properly - especially if you have more than one of the same device. Games consoles are the best example. If you have one console only, then you can usually forward ports manually, but if you have two or more of the same console, and want them to go online at the same time, then you need to use UPnP. If you don't have UPnP enabled on one of the consoles, you'll see issues like being unable to join some games or being unable to do voice chat with certain players.
- monocasa 6y ago
  That's not true, at least for xbox live. It's NAT punching will gladly use UPnP if available, but doesn't rely on it, even for multiple devices on the same public IP.
  - daveoc64 6y ago
    It's unlikely that you will have an "OPEN NAT" status on more than one console without UPnP at the same time. Depending on the game you're playing, that may or may not be an issue. It can stop you connecting to certain players in a peer to peer scenario.
    - monocasa 6y ago
      It'll be fine. They'll be on two pretty arbitrary public ports, but it works just fine if you have a vaguely sane nat implementation in your router. That's the whole point of nat punching. And even if you have an incredibly broken nat implementation that won't accept UDP packets from other sources than the server you originally connected to, there's a fallback pathway at the first layer of that port 3074 protocol that bridges p2p messages through live's backend. As another example, last time I checked WebRTC didn't use UPnP, but has all the same issues as a fundamentally P2P UDP protocol. They use STUN/ICE/TURN, live uses custom protocols filling the same niches.
      - 6y ago
pabs3 6y ago
I would never use the pre-installed software on a device, always replace it with a bare-bones install of a generic Linux/BSD distro and add any packages really needed.
dcow 6y ago
Or/also, nag your ISP to give you an IPv6 prefix (or switch to Comcast, because they delegate you a /62). If you still want to manage a stateful firewall then go for it. But we shouldn't still need this NAT traversal crap in an IPv6 world.
InafuSabi 6y ago
There are ISP's out there which disallow the use of gateways other than theirs to enter their WAN. That means you are stuck with whatever config it allows. I have root access to mine, so I can configure it to my liking, but the device is _not_ blinking out in quality, needing to be reset at least once every 14 days, otherwise it starts chocking when I need to transmit my radio stations over the NET These type of ISP's make a lot of cash, selling bulk purchased cheap hardware, esp mine, which still sells services over copper using VDSL & ADSL2. Their FTTH speeds are also inconveniently capped on VDSL speeds
- gfxgirl 6y ago
  Can you not just put something behind their gateway?
HeadsUpHigh 6y ago
Building your own is probably the easiest of all the options presented.
kn100 6y ago
https://kn100.me/turning-upnp-off/ https://kn100.me/turning-upnp-off/ I've written a follow up, which you may find interesting.

bunnyfoofoo 6y ago

Edited: deleted my comment as I was unintentionally offensive.

rovr138 6y ago
Is there a reason why the software claims it’s not available over the internet but still is because of something it did? Because that’s a bug.
kn100 6y ago
To rephrase this somewhat less offensively (I am the author) "I realised a potential solution but decided the drawbacks of disabling uPnP were larger than the potential risk keeping uPnP enabled poses". My household makes use of many different services that would need to be port forwarded one by one in order to keep everything working, and some games just punch whatever port they like using uPnP so it's hard to keep playing those with it disabled. Sysadminning at home is only fun for a short while, I do this stuff at work, I'd rather keep my home setup as simple as I can help it. As usual, various solutions are available, I described one here. Disabling uPnP is an option for some, and I encourage those who want to go that route to go that route.
- hluska 6y ago
  I agree with bunnyfoofoo’s conclusion - maybe not the tone but certainly the conclusion. It’s tough to trust an article that makes security claims while ignoring so many self imposed security holes.
- edoceo 6y ago
  It's not offensive. But you were offended. Big difference.
  - dxdm 6y ago
    I'm wondering what definition of the word "offensive" you're using.
    - edoceo 6y ago
      Offensive as Rude. Then @kn100 assigns to @bunnyfoofoo the offending behaviour. It's the personal responsibility thing. "I'm offended" vs "You're offensive".
      - adamweld 6y ago
        I think it's pretty clear than the author believes he may have offended people with his statement, and is rephrasing in a more precise manner to avoid confusion.
    - vczf 6y ago
      To be very exact, being offended is a choice, in that nobody can offend you if you don't let them. You can always choose to not take offense. (The statement in question does seem rude and dismissive to me, however.)
      - washadjeffmad 6y ago
        I believe the eminent feminist and humanitarian, Elanor Roosevelt, would have agreed with the fairness of your assessment. https://quoteinvestigator.com/2012/04/30/no-one-inferior/ https://quoteinvestigator.com/2012/04/30/no-one-inferior/
  - bayindirh 6y ago
    Actually, I also found grandparent's (bunnyfoofoo) tone offensive. It's borderline derogatory, since it disregards the situation of the original author in many levels, plus everyone fixates on the wrong point. UPnP has its security implications, but it doesn't mean that random appliances can just open ports through it without any settings whatsoever. Everybody has the freedom to have opinions and free to express them, however we shouldn't disregard other person's situation while expressing our opinion. Talking about theoretical best practices is always easy in a vacuum. Addendum: I want to congratulate bunny for trying to learn from his/her mistakes, for being honest and sincere. I wanted to leave it here since there's no other way to contact. I also made a lot of mistakes and HN taught me how to discuss this stuff, so you're at the right place.
- uberswe 6y ago
  I think some people miss the point of the article. That a NAS like Terramaster F2-210 shouldn't open ports externally and if they do there should be options to turn this feature off.
- washadjeffmad 6y ago
  It was clear you didn't want to disable UPnP support on the entire network, but I couldn't tell whether you'd tried disabling it on the NAS. Does the following disable the FS2-210's local UPnP? Go to TOS Desktop> Control Panel> Network Services> Discovery Service> UPnP Discovery > Uncheck "Enable UPnP discovery service" https://help.terra-master.com/TOS/view/?lang/en-us/flag/discovery https://help.terra-master.com/TOS/view/?lang/en-us/flag/disc... I assume this won't break anything you don't want broken (ie- automatic port forwards), but I'm with you that the option is needlessly ambiguous.
  - kn100 6y ago
    This option was and is disabled - I should have mentioned this in the blog post
- bunnyfoofoo 6y ago
  I'm sorry, I didn't mean to come off as offensive. I agree that it would be bothersome to convert from uPnP to non-uPnP, but you really only need to set it up once. Then any new devices you add to your network don't require individual workarounds.
  - kn100 6y ago
    It's fine, I wasn't personally offended nor should you feel like you need to censor yourself. It's really difficult to justify turning uPnP off when you can't necessarily control every application that runs on your network. My wife is going to get rather annoyed when whatever video conferencing software she uses stops working, and I'm gonna get mad when the game I want to play doesn't work - which is why I engage in a somewhat fruitless fight with the stuff I can control to keep the uPnP port punching under control somewhat. It's definitely a bug in the nas that it continues to punch ports no matter how it is configured. Plenty of software gives you the option of not punching ports.
    - rubatuga 6y ago
      You keep saying "whatever" software wouldn't work without UPnP, but you are failing to give us concrete examples.
      - deleted 6y ago
        [deleted]
      - imwillofficial 6y ago
        You are responding to His blog, and He shared His reasoning. Go find your own examples on your network. Even better if you can’t find anything and have UPNP disabled.
    - zippergz 6y ago
      FWIW I have never had upnp enabled and I don't recall any cases where it's caused a problem for me. Certainly my wife and I are on videoconferences all day and they work fine. I am completely with you that I can't have network configurations that make the network unusable, confusing, or inconvenient for my family, but are you sure that upnp falls into that category? I'm sure you have different applications than I do, but I think we're pretty normal...
crazygringo 6y ago
You mean ignoring the fact that a NAS which claims to not be available over the internet is available over the internet? The correct solution is the NAS manufacturer needs to correct the issue and provide a software update. This article shouldn't be ignored at all. Your supposed "correct solution" does nothing to fix the root issue.
imwillofficial 6y ago
Man, I have to catch myself all the time with this.

ancarda 6y ago

Do you have a router you recommend? Ideally something running free software

annoyingnoob 6y ago
OPNsense or pfSense
- anonymousiam 6y ago
  I have used both OPNsense and pfSense. I currently OpenWRT which I find to be full featured, secure, and lightweight.
alias_neo 6y ago
Hardware wise, I run Ubiquiti EdgeMAX but I wouldn't recommend them anymore, their software has gone down hill since many of their best developers left. Software wise, pfSense is where it's at, but I don't have experience with their own hardware other than the ones we ran at work all failed due to a silicon flaw in the Intel SoCs they ran.
- 7steps2much 6y ago
  > Ubiquiti EdgeMAX but I wouldn't recommend them anymore Sadly there isn't exactly a lot of alternatives in the hobbyist network setup area ... It's basically just ubiquity and mikrotik at this point as far as I know
  - zokier 6y ago
    I've heard good things about Turris hardware too, but no personal experience. https://www.turris.com/en/omnia/overview/ https://www.turris.com/en/omnia/overview/
- JoshTriplett 6y ago
  > Software wise, pfSense is where it's at Recent events suggest that the people behind pfSense are not especially responsible stewards; see https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... and https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/ .

deburo 6y ago

I also found this weird, and this got me to check if it was enabled on my business firewall devices: turns out they don't even support UPnP. Is it just consumer routers that support it nowadays? Shouldn't that feature just be nuked? EDIT: Well it sounds like a feature for pro users that know what they are doing and control all devices on the network. Even then, security appliances (eg. from SonicWall) don't support it. I don't know, this is probably a niche feature for a few occasions.

my123 6y ago
Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network) Without UPnP, you specifically have to configure your NAT for this...
- nobody9999 6y ago
  >Without UPnP, you specifically have to configure your NAT for this... While I realize that configuring nftables/iptables is beyond most folks, there are many firewalls out there that have a GUI/webui which makes this dead simple. Not sure why this should be an issue in 2021, except for users' trained-in helplessness.
  - hluska 6y ago
    Ugh, users trained in helplessness. I just had an utterly annoying conversation with my cell phone provider whose reps have been trained in helplessness and thus fail to follow really simple security procedures. This phrase is a thing of nightmares now. Stay tuned for a really scary Haunted House full of users trained in helplessness...coming Halloween 2021.
  - benlivengood 6y ago
    > Not sure why this should be an issue in 2021, except for users' trained-in helplessness. Kids hosting games on random ports (terraria, etc.) benefit from UPnP. I'd rather enable it than manually enter firewall rules for each game or give them admin access to the firewall. UPnP is only an additional risk if you have malware inside your network already and then it mostly allows malware to host services in a simpler way, but capable malware will be able to use TCP hole punching to establish arbitrary connections between infected networks.

KozmoNau7 6y ago

The issue is letting untrusted or badly behaved devices on the network. UPnP works great, if you control which devices get on your network. Static port forwarding combined with DHCP gets annoying quickly, you end up having to set up static assignments for every device that may need a port forwarded, which can be a lot, with modern multiplayer gaming and p2p. And for applications that select a random port on startup, such as some bittorrent clients, you either have to manually forward the port every time or select a static port. UPnP serves a purpose and is extremely convenient, as long as you trust the devices on your network.

lostlogin 6y ago
> And for applications that select a random port on startup, such as some bittorrent clients, you either have to manually forward the port every time or select a static port. What if you run them over a VPN? I don’t use torrents much but have a client containerised with OpenVPN. I’m not a networking expert but I had assumed (with all the dangers that comes with) that this moved the problem to the VPN provider?
- mercora 6y ago
  it will work as long as you are the one initiating the connection. if some peer suspects you have a wanted piece available i.e. from another peer in the swarm it can not communicate the intent to get that piece from you to your client directly. i think BitTorrent can relay messages through intermediate peers to make your client establish the connection to that other peer (reversing the initiator). Otherwise peers will exchange other peers that are visible to them so that your client might eventually learn how the other peer that wanted that piece is reachable and connects to it. So it actually will work without port forwarding but reaching your client will be harder and thus less peers inside the swarm will be available to you or them, likely making it slower.
daniellarusso 6y ago
So, keeping track of which device on your network belongs to which MAC address, and reserving an address for each, is that what you mean by ‘annoying’ - the administration of that?

procombo 6y ago

Doesn't TrueNAS (was FreeNAS) connect to iXsystem servers from the NAS and from the NAS web interface?

kalleboo 6y ago

UPnP is also sometimes used to refer to some forms of zeroconf/mDNS/Bonjour/DLNA. Maybe he is under the impression if he turns off UPnP on his router (the automatic port forwarding feature), that his LAN device discovery features will break?

sdflhasjd 6y ago

UPNP is pretty important for a lot of online games.

Spivak 6y ago
Yeah, you can’t really “manage your firewall” when consumer software doesn’t open fixed ports and assumes upnp.
- Daho0n 6y ago
  Why not? Which consumer software breaks? Normally people say games. I have disabled upnp on my firewall and there're two gaming PCs, a PS3, a PS4 and a PS5 running happily behind it. I just finished a Demon Soul's session with voice chat with friends with no problems. NAT type 2, because I managed my firewall to enable this.
  - BlueTemplar 6y ago
    Have you tried a client/server style game not relying on Steam multiplayer?
    - Daho0n 6y ago
      It makes no difference since as I wrote I manage the firewall to allow this. But yes, since none of the games on consoles use Steam. If NAT wasn't set up I would get NAT type 3 on the PlayStations for example. ETA: My point was to get an example of something that breaks "because it doesn't work without upnp". I have yet to see a game that doesn't support a fixed set of ports.
Tepix 6y ago
Which ones? I have it turned off and haven't had any issues with games.
- sdflhasjd 6y ago
  Games that use Peer-to-peer lobbies instead of dedicated servers, more popular with multiplayer co-op games. Typically, it can be possible to join another lobby, but impossible to host (insofar as other people can't connect to it)

takeda 6y ago

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

mavhc 6y ago
NAT can mean 2 things, 1 to 1, and 1 to many. Firewall is a concept not a thing. IPv6 could be set up so every computer has an internal address and you choose to map external to internet using 1 to 1 NAT.
- imwillofficial 6y ago
  As a former maintainer of firewalls... You are wrong. From beginning to end, utterly, and completely. ::Pets His firewalls lovingly:: “Don’t listen to Him, He didn’t mean it.”
- nix23 6y ago
  Ah yeah the good old IPv6-NAT....
rubatuga 6y ago
Yep, the author depends on NAT as a security feature, when it was never designed to be one. UPnP is a convenience feature, and is disabled in all security focused networks. If you want convenience and security, set up two VLANs, one for your insecure UPnP devices, and one for your more sensitive devices.
- nemosaltat 6y ago
  This is what I did a couple years ago. The documentation for OpenWRT is great, and Luci/LDE makes it approachable if you don’t feel comfortable managing from the CLI. I have one VLAN for my “privileged” devices and one for the “IO(shi)T” devices.
- kaylynb 6y ago

the8472 6y ago

Opening ports for a specific machine with dynamic IPv6 addresses can be difficult though. If the suffix stays stable then with iptables you can use netmasks where you mask out the prefix rather than the suffix. If both prefix and suffix are dynamic you need a solution that takes dhcp or host names into account. Not all router firmwares support something like that. Another alternative is to use UPnP or PCP with authentication.

mnd999 6y ago
Suffix should always be static with SLAAC because it’s your MAC address. Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. If you’re using DHCPv6 then the DHCP server should take care of DNS as it would for v4.
- the8472 6y ago
  > Suffix should always be static with SLAAC because it’s your MAC address. Except for devices that randomize mac addresses. Normally even those that do that only try do so when connecting to a new network but that's not always reliable. > Even if you’re using privacy extensions (and you should) you should still be able listen on the MAC address one. I'm doubtful that all applications make that distinction and advertise the right address. If they just use some external "what is my IP" service to determine their address because that's what they did for IPv4 then they'll get the privacy address and advertise that to peers because that'll be picked by default for outgoing connections. Being able to allow incoming connections to a port for any address belonging to a particular machine would be less error-prone.
  - BlueTemplar 6y ago
    These issues will keep happening, in completely unrelated domains, as long there are not fines for violating security best practices.
- BlueTemplar 6y ago
  AFAIK the goal is to get rid of MAC adresses entirely - so how is this going to work?

hh3k0 6y ago

> If the author really cares, go one step further and replace the ISP owned router with something with more control. I wanted to do that for a while now. Do you happen to have a good suggestion regarding whose products are worthwhile?

alias_neo 6y ago
Its muddy right now, I run Ubiquiti EdgeMAX switches and EdgeRouter at home, but I wouldn't recommend them right now (see another comment of mine, or check out the subreddit), for NAS I run TrueNAS, on a home built server.
- daniellarusso 6y ago
  For your NAS, to you have a mobo and case recommendation?
  - eikenberry 6y ago
    Not OP, but I built a NAS not that long ago. For the case I purchased the Fractal Design Node 304 (https://www.fractal-design.com/products/cases/node/node-304/black/ https://www.fractal-design.com/products/cases/node/node-304/...) and am very happy with it. For the Mobo I suggest finding a decent board (AMD based one if you want ECC RAM) and then use a PCI-e controller card to support the hard drives you need. It is hard to find a nice MB with all the SATA ports you need, using an external card gives you a lot more options. When I researched it everyone recommended an "LSI Logic Controller Card LSI00301 SAS 9207-8i" (eg. https://www.amazon.com/LSI-Controller-LSI00301-9207-8i-Internal/dp/B008J49G9A/ https://www.amazon.com/LSI-Controller-LSI00301-9207-8i-Inter...) and it has performed very well for me. If you go that way you'll need a SAS to SATA cable, they are easy to find as well.
spockz 6y ago
Up until a week ago I would have suggested the UniFi. Since the latest snafu, the handling of the breach not the breach itself, I’m not so sure anymore what would be the best alternative. Perhaps just their EdgeRouter devices or a mikrotik device. The snafu: https://news.ycombinator.com/item?id=26638145 https://news.ycombinator.com/item?id=26638145

watermelon0 6y ago

Sure, UPnP can open ports to the outside world, but that's something that might be desired in some cases. However, devices should default to local access only, and offer an option to expose them to the world, with appropriate warning.

kn100 6y ago
This is exactly my opinion and exactly how I use uPnP. I can't control exactly what runs on my network since I'm not the only one using it, but I can guard certain parts of my network more thoroughly.
- rubatuga 6y ago
  You have to choose: security or convenience.
  - rembicilious 6y ago
    “They that would give up a little convenience for a little security deserve neither and they shall lose them both.” -Beenjammin Frankmon
  - imwillofficial 6y ago
    It’s a sliding scale, otherwise you’d run an airgapped network and hand carry your info into and out of your home on CDs...
    - MomoXenosaga 6y ago
      Reminds me of a state secretary who decided to use gmail because it was more convenient than the secure smartphone provided to him. Ofcourse for most people who aren't dealing with state secrets convenience is a priority.
zokier 6y ago
> However, devices should default to local access only Unfortunately we need to act based on what is and not what should be.

testfoobar 6y ago

Agreed. My router firewall drops all packets from my NAS to my WAN. Doesn’t matter what software it runs.

dijit 6y ago

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

clajiness 6y ago
I'm gaming on my Xbox right now with specific ports forwarded. I guess "absolutely must" is a bit much, huh? UPNP has no place in a secure network.
- dijit 6y ago
  This is not a reasonable solution for most people, it requires intimate knowledge of the games you play (which ports they use), a static IP for your console and no more than one player/console per household. Heaven forbid you have a PC game and a Xbox game that have conflicting ports. And, I just have to say: you open arbitrary ports to your game console from the internet and talk about security.
- easton 6y ago
  n>1, not n=1.
- BlueTemplar 6y ago
  Well, NAT itself has pretty much no place on a network these days, so the point is kind of moot...
rubatuga 6y ago
This is completely false. Almost all home networks use port-restricted NAT, which allows for STUN for NAT traversal. You do not need UPnP to play games, even those that have peer to peer multiplayer. Also STUN for VOIP does not increase latency. It tells you your external IP and port. Edit: Port symmetric —> port restricted
- waffle_ss 6y ago
  I get the feeling you’ve never ran n>1 Xbox Ones connecting to Xbox Live at the same time. Without UPnP only one will be able to connect.

atmosx 6y ago

Indeed, UPNP effectively turns on "auto-pilot". The fridge running on 10 years old firmware might open ports dynamically. Networks featuring UPNP should be marked as "open/insecure".

KozmoNau7 6y ago
If your fridge has a MAC address, you have much much deeper problems than UPnP.

xyst 6y ago

also dont buy Ubiquiti gear :)

rufius 6y ago

Honest question - what would I use UPnP for? I discovered a similar issue as the blog poster with my QNAP NAS which was easily remedied by disabling UPnP. I’ve not noticed any issues. We can do all the same things we did before. My Xbox and Switch still do online multiplayer just fine. I remember hearing Xbox/PS3-4 and UPnP mentioned together but it’s been a while.

rand49an 6y ago
UPnP allows devices to open up firewall ports for themselves to allow traffic to reach them inbound. Games (for example) that that host a server on the users local machine may require an open port to allow access inbound so UPnP can help with this. Now-a-days it's not used much and quite frankly it was always a fairly bad idea.
- BlueTemplar 6y ago
  Nowadays you should use IPv6 anyway, which doesn't need NAT.

stilisstuk 6y ago

So I don't know about routers or networks. I live in a an apartment. Which router (+ a extra point / 2 hub mesh) is recommended these days. There seems to be a plethora of options. But most of always end with ubiquity, which today feels like a bad choice. Also kind of expensive. Preferable something Completely local. No cloud service. Preferable opens source. I live in EU. (Sorry if it's bad form to ask for product recommendations, but I am unhappy with/ don't trust, my isp provided router, and gp explicitly mentions buying a router)

newsclues 6y ago
Mikrotik
- katbyte 6y ago
  The ux is... not good and I wouldn’t recommend it for anyone not experienced
  - omnimus 6y ago
    yeah i bought Mikrotik for home and i have no idea what to do there. I tried to do hairpin nat with it and after 3 tutorials i somehow managed to get it working and now i have no clue how does it work or what its it really doing. I think its only for real networking pros
stefan_ 6y ago
Can you get rid of your ISP provided router? There are lots of obstacles there.
- stilisstuk 6y ago
  I don't know to be honest?
alias_neo 6y ago
I've replied to a couple of others, normally I would have recommended Ubiquiti, but I no longer do. Not just because of their recent breach debackle, but because their software quality has declined since some of their best developers left. The short but not so useful answer is, run something with pfSense or similar, I hear PCEngines hardware works well and is open source from the bootloader up. Ubiquiti has hardware offloading using Cavium hardware so you need to get some throughout tests if you need high bandwidth in hardware without the offloading hardware.

gsich 6y ago

That sounds like he didn't even try.

rdudek 6y ago

Nothing wrong with uPnP. If you’re worried about something opening up ports on your network, you’re already compromised.

Daho0n 6y ago
Like a buggy NAS. So yes, lots wrong with upnp. Letting anything with an IP forward ports is being auto compromised.

milleramp 6y ago

Yes, the real lesson here is, I learned not to trust random vendors and turned off upnp.

daveoc64 6y ago

People make blanket statements like this without thinking of how it is used by popular consumer devices. As others have said it's really necessary for some consumer devices to work properly - especially if you have more than one of the same device. Games consoles are the best example. If you have one console only, then you can usually forward ports manually, but if you have two or more of the same console, and want them to go online at the same time, then you need to use UPnP. If you don't have UPnP enabled on one of the consoles, you'll see issues like being unable to join some games or being unable to do voice chat with certain players.

monocasa 6y ago
That's not true, at least for xbox live. It's NAT punching will gladly use UPnP if available, but doesn't rely on it, even for multiple devices on the same public IP.
- daveoc64 6y ago
  It's unlikely that you will have an "OPEN NAT" status on more than one console without UPnP at the same time. Depending on the game you're playing, that may or may not be an issue. It can stop you connecting to certain players in a peer to peer scenario.
  - monocasa 6y ago
    It'll be fine. They'll be on two pretty arbitrary public ports, but it works just fine if you have a vaguely sane nat implementation in your router. That's the whole point of nat punching. And even if you have an incredibly broken nat implementation that won't accept UDP packets from other sources than the server you originally connected to, there's a fallback pathway at the first layer of that port 3074 protocol that bridges p2p messages through live's backend. As another example, last time I checked WebRTC didn't use UPnP, but has all the same issues as a fundamentally P2P UDP protocol. They use STUN/ICE/TURN, live uses custom protocols filling the same niches.
    - 6y ago

pabs3 6y ago

I would never use the pre-installed software on a device, always replace it with a bare-bones install of a generic Linux/BSD distro and add any packages really needed.

dcow 6y ago

Or/also, nag your ISP to give you an IPv6 prefix (or switch to Comcast, because they delegate you a /62). If you still want to manage a stateful firewall then go for it. But we shouldn't still need this NAT traversal crap in an IPv6 world.

InafuSabi 6y ago

There are ISP's out there which disallow the use of gateways other than theirs to enter their WAN. That means you are stuck with whatever config it allows. I have root access to mine, so I can configure it to my liking, but the device is _not_ blinking out in quality, needing to be reset at least once every 14 days, otherwise it starts chocking when I need to transmit my radio stations over the NET These type of ISP's make a lot of cash, selling bulk purchased cheap hardware, esp mine, which still sells services over copper using VDSL & ADSL2. Their FTTH speeds are also inconveniently capped on VDSL speeds

gfxgirl 6y ago
Can you not just put something behind their gateway?

HeadsUpHigh 6y ago

Building your own is probably the easiest of all the options presented.

kn100 6y ago

https://kn100.me/turning-upnp-off/ https://kn100.me/turning-upnp-off/ I've written a follow up, which you may find interesting.