5 ms·

What, they can't use UPnP like a good citizen?

by thanatos519 5y ago

OldTimeCoffee 5y ago
Because UPnP is disabled by default on a lot of routers.
- yrro 5y ago
  Maybe if the network administrator has disabled UPnP that is a hint that they don't want to allow random devices to expose themselves to the entire internet?!
- deleted 5y ago
  [deleted]
GekkePrutser 5y ago
I don't think upnp is used a lot anymore as it's also really handy for malware makers
- 1_player 5y ago
  What? It's used by tons of legitimate applications as well. Not only malware benefits from being able to accept connections from the Internet. Games, torrents and other p2p services, etc.
  - GekkePrutser 5y ago
    I play a lot of games and I've never had any issues not having UPnP. They got used to working around it. Probably with centralised servers. I never liked the P2P model anyway, dedicated servers are more fun because you can influence the gamemode, add mods etc. For torrents I don't know... If I were to torrent I would not do it without VPN anyhow.
- tux3 5y ago
  Malware that's already on your system can do whatever it wants. NAT punching is not some complicated dark art for people who already have working exploits...
  - GekkePrutser 5y ago
    No but it stops them using your system as a C&C node accepting connections from external systems. It doesn't stop it per se but it makes it a lot harder. Part of security is not being the easiest target on the block.
- eternityforest 5y ago
  Programmers need to stop trying to kill UPnP. The buggy firmware that allowed control from outside had nothing to do with UPnP, it was... just buggy firmware implementing it wrong. And it can be easily detected with online testers. I always leave UPnP on, and I've never seen it disabled by default, nor would I ever want them to do that. When the router does it right, it's just a small extra convenience for malware that can only be used when they already compromised your system. If they are in your network already, they can already do whatever they want.
  - tjoff 5y ago
    No need. UPnP is already dead. Edit: and to add on that, programmers are the absolutely only people on earth that wish it wasn't dead.
  - OldTimeCoffee 5y ago
    It's disabled on all AT&T Residential Gateways and can't be enabled, you have to use port forwarding or put another router behind it using IP Passthrough. It's also disabled by default on EdgeRouters and can only be enabled in the ConfigTree or CLI. On UniFi it's disabled, but can be enabled in the GUI. It's a convenience over control item. Most things do NAT traversal pretty well anyway, UPnP IGD has run it's course at this point. PCP is better in every way, push for that instead.
    - DanAtC 5y ago
      How is PCP any better? It would allow malware to open ports just the same.
      - OldTimeCoffee 5y ago
        I don't think that's really a problem you can solve regardless. A STUN server would make most NAT irrelevant anyway. Most firewalls are setup to allow established connections, so you just need to create an outbound connection to allow the inbound. You can basically use the same techniques as SIP/RTP when they do NAT traversal. PCP is better than UPnP IGD, most importantly because it time limits the opening so port reuse is easier. I wouldn't use either in practice. I wouldn't suggest NAT-PMP either. I wouldn't use port forwarding if I could avoid it as well. I'd use destination NAT with a source IP range I knew in advance so it wouldn't show as easily in port scans. Someone is likely to tell me why that's a terrible idea, but it's my (current) preferred method.
exikyut 5y ago
Because it wound up with the sufficient complexity and implementational discohesion as to be broken, existentially insecure, or both: https://computer.rip/2021-11-26-no-u-pnp.html https://computer.rip/2021-11-26-no-u-pnp.html (https://news.ycombinator.com/item?id=29356874 https://news.ycombinator.com/item?id=29356874)
deleted 5y ago
[deleted]

What, they can't use UPnP like a good citizen?

OldTimeCoffee 5y ago

Because UPnP is disabled by default on a lot of routers.

yrro 5y ago
Maybe if the network administrator has disabled UPnP that is a hint that they don't want to allow random devices to expose themselves to the entire internet?!
deleted 5y ago
[deleted]

GekkePrutser 5y ago

I don't think upnp is used a lot anymore as it's also really handy for malware makers

1_player 5y ago
What? It's used by tons of legitimate applications as well. Not only malware benefits from being able to accept connections from the Internet. Games, torrents and other p2p services, etc.
- GekkePrutser 5y ago
  I play a lot of games and I've never had any issues not having UPnP. They got used to working around it. Probably with centralised servers. I never liked the P2P model anyway, dedicated servers are more fun because you can influence the gamemode, add mods etc. For torrents I don't know... If I were to torrent I would not do it without VPN anyhow.
tux3 5y ago
Malware that's already on your system can do whatever it wants. NAT punching is not some complicated dark art for people who already have working exploits...
- GekkePrutser 5y ago
  No but it stops them using your system as a C&C node accepting connections from external systems. It doesn't stop it per se but it makes it a lot harder. Part of security is not being the easiest target on the block.
eternityforest 5y ago
Programmers need to stop trying to kill UPnP. The buggy firmware that allowed control from outside had nothing to do with UPnP, it was... just buggy firmware implementing it wrong. And it can be easily detected with online testers. I always leave UPnP on, and I've never seen it disabled by default, nor would I ever want them to do that. When the router does it right, it's just a small extra convenience for malware that can only be used when they already compromised your system. If they are in your network already, they can already do whatever they want.
- tjoff 5y ago
  No need. UPnP is already dead. Edit: and to add on that, programmers are the absolutely only people on earth that wish it wasn't dead.
- OldTimeCoffee 5y ago
  It's disabled on all AT&T Residential Gateways and can't be enabled, you have to use port forwarding or put another router behind it using IP Passthrough. It's also disabled by default on EdgeRouters and can only be enabled in the ConfigTree or CLI. On UniFi it's disabled, but can be enabled in the GUI. It's a convenience over control item. Most things do NAT traversal pretty well anyway, UPnP IGD has run it's course at this point. PCP is better in every way, push for that instead.
  - DanAtC 5y ago
    How is PCP any better? It would allow malware to open ports just the same.
    - OldTimeCoffee 5y ago
      I don't think that's really a problem you can solve regardless. A STUN server would make most NAT irrelevant anyway. Most firewalls are setup to allow established connections, so you just need to create an outbound connection to allow the inbound. You can basically use the same techniques as SIP/RTP when they do NAT traversal. PCP is better than UPnP IGD, most importantly because it time limits the opening so port reuse is easier. I wouldn't use either in practice. I wouldn't suggest NAT-PMP either. I wouldn't use port forwarding if I could avoid it as well. I'd use destination NAT with a source IP range I knew in advance so it wouldn't show as easily in port scans. Someone is likely to tell me why that's a terrible idea, but it's my (current) preferred method.

exikyut 5y ago

Because it wound up with the sufficient complexity and implementational discohesion as to be broken, existentially insecure, or both: https://computer.rip/2021-11-26-no-u-pnp.html https://computer.rip/2021-11-26-no-u-pnp.html (https://news.ycombinator.com/item?id=29356874 https://news.ycombinator.com/item?id=29356874)

deleted 5y ago

[deleted]