5 ms·

Other than your router you should not have ANYTHING directly on the internet these days. There is just too much surface area for device software now and cost p

Other than your router you should not have ANYTHING directly on the internet these days. There is just too much surface area for device software now and cost pressure doesn't allow for security to be much of a priority.

comboy 5y ago
I'd like to hear what HN folks would most comfortably put as that router (device/software).
- sneak 5y ago
  I use a Unifi USG despite the anti-ubnt security hype. I also use pcengines apu2 with ubuntu focal as VPN routers.
  - kalleboo 5y ago
    I like the Ubiquiti EdgeRouter X since it doesn't try to be as magic and cloud-enabled as the USG (yes there is UNMS but they don't push you use it like they do on the Unifi gear)
- karmicthreat 5y ago
  At work I use fortigate equipment and keep it updated. At home I have sold my soul to Bezos and just use an Eero.
- White_Wolf 5y ago
  personally I have something like this: ISP modem ---> Netgear (for guests) ---> pfSsense ---> My network with the VPN server for dialling in. I would of added a second pfSense for the NAS and cloud but I thought it would be an overkill.
- azdle 5y ago
  I use a pcengines APU2C4 (AMC x86 cpu SBC with integrated network switch) with VyOS as my external router.
- nfoz 5y ago
  https://routersecurity.org/ https://routersecurity.org/ brought me to https://www.peplink.com/products/soho-series/ https://www.peplink.com/products/soho-series/ But I would love to understand my router better and why/how to trust it, or that I've configured it the best way, to protect from threats both inside and outside my LAN.
- hedora 5y ago
  I have this pc engines apu2 openbsd setup. Upgrading openbsd is kind of a pain, but other than that, it has been trouble free: https://github.com/elad/openbsd-apu2 https://github.com/elad/openbsd-apu2 In the last 5 years, it has crashed zero times. Once, after a power loss, fsck blocked until I pressed y over and over again.
- vel0city 5y ago
  FreeNAS on an X11SBA-LN4F. Its an awesome board for a home router. With a 100W 80+ Gold PSU this thing pulls like 3-5W from the wall most of the time. I'm tempted to just get a 12V brick as it can run off just a DC power supply instead of a full ATX but hey if it works it works why mess with it. https://www.supermicro.com/en/products/motherboard/X11SBA-LN4F https://www.supermicro.com/en/products/motherboard/X11SBA-LN...
  - vel0city 5y ago
    Oops, didn't mean FreeNAS, I meant pfsense there. All this talk about NAS'es put FreeNAS on the mind.
- rubatuga 5y ago
  openwrt on a wrt1200ac
- strictfp 5y ago
  When I tried to research this last time I heard that dd-wrt were more on top of CVEs than OpenWRT, so I picked them. No idea if that's correct though
ClumsyPilot 5y ago
No reason to believe a random offf the shelf router is any more secure than any other device
- Hamuko 5y ago
  It's probably better to only have one random possibly unsecure device connected to the Internet than a dozen random possibly unsecure devices.
mbreese 5y ago
With the QNAP cloud service, even if the server was behind a firewall/NAT, you could still directly access the NAS from the internet. So, you could still get caught with this. Source: I have a QNAP NAS and after the first week, I couldn’t figure out who was trying to login to it as an admin account. Thankfully, I had changed all the passwords, but by default it had connected to their cloud service and was remotely accessible. I’m still not 100% sure I have it completely secured.
- tomnipotent 5y ago
  > you could still directly access the NAS from the internet Not unless you intentionally opened a port on the router to allow inbound access. Even default cable modems come with every port blocked by default. Even cloud-enabled services require that the machine behind the modem/router open the connection first, so unless you're getting MITM there's no externally available access.
  - callmeal 5y ago
    >No you can't, unless someone intentionally opened a port on the router to allow inbound access. That's what I used to think. Then I found out about upnp on routers. I'd like to have a quiet talk with whoever thought that was a good idea.
  - criddell 5y ago
    QNAP has something called QLink which I believe is a NAT traversal scheme that gets the NAS to open a link to the QNAP servers. No port forwarding is necessary.
  - rickdeckard 5y ago
    Actually, enabling the myQNAPcloud service comes with a "Auto router configuration" which makes the NAS send uPNP requests to the router for opening inbound ports. So unless uPNP is disabled on the router (which in most cases would have to be done manually at some point), you don't need to intentionally open a port for inbound access, the QNAP NAS will do it automatically...
dvdkon 5y ago
So are you completely against self-hosting services or do you apply this only to closed (IoT) appliances?
- karmicthreat 5y ago
  Your service should probably be sitting behind the firewall/router/proxy. But you really should consider your options and if the service itself needs to be exposed directly to the internet.

comboy 5y ago

I'd like to hear what HN folks would most comfortably put as that router (device/software).

sneak 5y ago
I use a Unifi USG despite the anti-ubnt security hype. I also use pcengines apu2 with ubuntu focal as VPN routers.
- kalleboo 5y ago
  I like the Ubiquiti EdgeRouter X since it doesn't try to be as magic and cloud-enabled as the USG (yes there is UNMS but they don't push you use it like they do on the Unifi gear)
karmicthreat 5y ago
At work I use fortigate equipment and keep it updated. At home I have sold my soul to Bezos and just use an Eero.
White_Wolf 5y ago
personally I have something like this: ISP modem ---> Netgear (for guests) ---> pfSsense ---> My network with the VPN server for dialling in. I would of added a second pfSense for the NAS and cloud but I thought it would be an overkill.
azdle 5y ago
I use a pcengines APU2C4 (AMC x86 cpu SBC with integrated network switch) with VyOS as my external router.
nfoz 5y ago
https://routersecurity.org/ https://routersecurity.org/ brought me to https://www.peplink.com/products/soho-series/ https://www.peplink.com/products/soho-series/ But I would love to understand my router better and why/how to trust it, or that I've configured it the best way, to protect from threats both inside and outside my LAN.
hedora 5y ago
I have this pc engines apu2 openbsd setup. Upgrading openbsd is kind of a pain, but other than that, it has been trouble free: https://github.com/elad/openbsd-apu2 https://github.com/elad/openbsd-apu2 In the last 5 years, it has crashed zero times. Once, after a power loss, fsck blocked until I pressed y over and over again.
vel0city 5y ago
FreeNAS on an X11SBA-LN4F. Its an awesome board for a home router. With a 100W 80+ Gold PSU this thing pulls like 3-5W from the wall most of the time. I'm tempted to just get a 12V brick as it can run off just a DC power supply instead of a full ATX but hey if it works it works why mess with it. https://www.supermicro.com/en/products/motherboard/X11SBA-LN4F https://www.supermicro.com/en/products/motherboard/X11SBA-LN...
- vel0city 5y ago
  Oops, didn't mean FreeNAS, I meant pfsense there. All this talk about NAS'es put FreeNAS on the mind.
rubatuga 5y ago
openwrt on a wrt1200ac
strictfp 5y ago
When I tried to research this last time I heard that dd-wrt were more on top of CVEs than OpenWRT, so I picked them. No idea if that's correct though

ClumsyPilot 5y ago

No reason to believe a random offf the shelf router is any more secure than any other device

Hamuko 5y ago
It's probably better to only have one random possibly unsecure device connected to the Internet than a dozen random possibly unsecure devices.

mbreese 5y ago

With the QNAP cloud service, even if the server was behind a firewall/NAT, you could still directly access the NAS from the internet. So, you could still get caught with this. Source: I have a QNAP NAS and after the first week, I couldn’t figure out who was trying to login to it as an admin account. Thankfully, I had changed all the passwords, but by default it had connected to their cloud service and was remotely accessible. I’m still not 100% sure I have it completely secured.

tomnipotent 5y ago
> you could still directly access the NAS from the internet Not unless you intentionally opened a port on the router to allow inbound access. Even default cable modems come with every port blocked by default. Even cloud-enabled services require that the machine behind the modem/router open the connection first, so unless you're getting MITM there's no externally available access.
- callmeal 5y ago
  >No you can't, unless someone intentionally opened a port on the router to allow inbound access. That's what I used to think. Then I found out about upnp on routers. I'd like to have a quiet talk with whoever thought that was a good idea.
- criddell 5y ago
  QNAP has something called QLink which I believe is a NAT traversal scheme that gets the NAS to open a link to the QNAP servers. No port forwarding is necessary.
- rickdeckard 5y ago
  Actually, enabling the myQNAPcloud service comes with a "Auto router configuration" which makes the NAS send uPNP requests to the router for opening inbound ports. So unless uPNP is disabled on the router (which in most cases would have to be done manually at some point), you don't need to intentionally open a port for inbound access, the QNAP NAS will do it automatically...

dvdkon 5y ago

So are you completely against self-hosting services or do you apply this only to closed (IoT) appliances?

karmicthreat 5y ago
Your service should probably be sitting behind the firewall/router/proxy. But you really should consider your options and if the service itself needs to be exposed directly to the internet.