5 ms·

I disagree wrt NAT. It creates huge problems for many p2p applications.

by apitman 6mo ago

M95D 6mo ago
I wouldn't call port forwarding "huge problems". It's only one minor router setting and if you don't want to deal with it, there's the abomination called upnp.
- vel0city 6mo ago
  > I wouldn't call port forwarding "huge problems". Port forwarding has massive problems if you're running applications expecting certain ports and need multiple hosts to have public access to those ports.
  - M95D 6mo ago
    I can't think of any application that needs "certain ports" and it's not a public server application. Why would a home net have a public server app? And why would it have more than one? Public servers would use a firewall, a load balancer, possibly a reverse proxy that does TLS too, between the internet and real app servers anyway. If anyone needs to host multiple servers from their home net, I would expect them to know this.
    - vel0city 6mo ago
      Maybe I've got a media server with a web interface, my owncloud instance, a web UI to my SDRs, and some other web app I'd like to have public. Now I need a reverse proxy as well, yet another piece of infrastructure to maintain. Trying to firewall it so only my friend's house can use the media server and I can connect to the owncloud from the office and thenSDR from anywhere is messier and more complicated. Or I can just have each device have its own public firewall rules and not have to maintain a reverse proxy as well and deal with its own complications. I've had game consoles with matchmaking issues with multiple consoles fighting over the same collection of ports
      - M95D 6mo ago
        I can't say anything about consoles. I never had one, but I accept what you say is true. About the other stuff... well... maybe I'm too old, but I think you're doing it wrong. 1) Those aren't public services and they are NOT expecting certain ports. Public means that a random guy on the internet is able to connect to your service without any prior knowledge about it. HTTP(S) for web pages is one of those services. Owncloud is not, even if it uses HTTPS. 2) Since they're not public, each of those services can have its own port. 3) You shouldn't expose that stuff on the internet, even with a firewall. Use a VPN if you want access when you're away. Or a SSH tunnel. Or at least port knocking.
        vel0city 6mo ago
        > Those aren't public services They're services I wish to consume outside my home > they are NOT expecting certain ports Damn near everything expects to be HTTPS/443 > Public means that a random guy on the internet is able to connect to your service without any prior knowledge about it Public just means I have the option to allowing that traffic or not. I can choose to filter it through a lot of different means. IP filtering, authentication, etc. > each of those services can have its own port So I change having easy to remember names for weird odd ports and hope all the other applications handle these changes fine and deal with odd port forwarding issues. > You shouldn't expose that stuff on the internet, even with a firewall. Use a VPN if you want access when you're away. Or a SSH tunnel. Or at least port knocking. Wouldn't it be nice to have the option to not have to rely on such things and just be able to connect to things directly? And to have that identity stay consistent both in and out if the "local" network? ipv6 is awesome.
        M95D 6mo ago
        > They're services I wish to consume outside my home Like I said, not public. > Damn near everything expects to be HTTPS/443 So let it. Forward your own chosen port to 443 of the machine with the service. > Public just means I have the option to allowing that traffic or not. Nope. That's not what it means. > So I change having easy to remember names for weird odd ports [...] Easy to remember names comes from some DNS service, which can't work unless your public IP address stays the same and you can run your own public NS and can receive recursion from your main NS provider. In most parts of the world, I think, IP changes every time you restart the router, even IPv6. So what you have there isn't exactly typical for home users. That one extra service and complication that you don't actually need. I don't have to remember anything HTTP(S). No ports, no IPs, no names, nothing. I use bookmarks. > Wouldn't it be nice to have the option to not have to rely on such things and just be able to connect to things directly? Wouldn't it be nice if there were no bad guys on the internet, no bots, and no zero days? > ipv6 is awesome. For Google and for you, maybe. But let me know how much you like it after your first cryptolocker. I suppose your backup storage is also public on the internet?

I disagree wrt NAT. It creates huge problems for many p2p applications.

by apitman 6mo ago

I disagree wrt NAT. It creates huge problems for many p2p applications.

M95D 6mo ago

I wouldn't call port forwarding "huge problems". It's only one minor router setting and if you don't want to deal with it, there's the abomination called upnp.

vel0city 6mo ago
> I wouldn't call port forwarding "huge problems". Port forwarding has massive problems if you're running applications expecting certain ports and need multiple hosts to have public access to those ports.
- M95D 6mo ago
  I can't think of any application that needs "certain ports" and it's not a public server application. Why would a home net have a public server app? And why would it have more than one? Public servers would use a firewall, a load balancer, possibly a reverse proxy that does TLS too, between the internet and real app servers anyway. If anyone needs to host multiple servers from their home net, I would expect them to know this.
  - vel0city 6mo ago
    Maybe I've got a media server with a web interface, my owncloud instance, a web UI to my SDRs, and some other web app I'd like to have public. Now I need a reverse proxy as well, yet another piece of infrastructure to maintain. Trying to firewall it so only my friend's house can use the media server and I can connect to the owncloud from the office and thenSDR from anywhere is messier and more complicated. Or I can just have each device have its own public firewall rules and not have to maintain a reverse proxy as well and deal with its own complications. I've had game consoles with matchmaking issues with multiple consoles fighting over the same collection of ports
    - M95D 6mo ago
      I can't say anything about consoles. I never had one, but I accept what you say is true. About the other stuff... well... maybe I'm too old, but I think you're doing it wrong. 1) Those aren't public services and they are NOT expecting certain ports. Public means that a random guy on the internet is able to connect to your service without any prior knowledge about it. HTTP(S) for web pages is one of those services. Owncloud is not, even if it uses HTTPS. 2) Since they're not public, each of those services can have its own port. 3) You shouldn't expose that stuff on the internet, even with a firewall. Use a VPN if you want access when you're away. Or a SSH tunnel. Or at least port knocking.
      - vel0city 6mo ago
        > Those aren't public services They're services I wish to consume outside my home > they are NOT expecting certain ports Damn near everything expects to be HTTPS/443 > Public means that a random guy on the internet is able to connect to your service without any prior knowledge about it Public just means I have the option to allowing that traffic or not. I can choose to filter it through a lot of different means. IP filtering, authentication, etc. > each of those services can have its own port So I change having easy to remember names for weird odd ports and hope all the other applications handle these changes fine and deal with odd port forwarding issues. > You shouldn't expose that stuff on the internet, even with a firewall. Use a VPN if you want access when you're away. Or a SSH tunnel. Or at least port knocking. Wouldn't it be nice to have the option to not have to rely on such things and just be able to connect to things directly? And to have that identity stay consistent both in and out if the "local" network? ipv6 is awesome.
        M95D 6mo ago
        > They're services I wish to consume outside my home Like I said, not public. > Damn near everything expects to be HTTPS/443 So let it. Forward your own chosen port to 443 of the machine with the service. > Public just means I have the option to allowing that traffic or not. Nope. That's not what it means. > So I change having easy to remember names for weird odd ports [...] Easy to remember names comes from some DNS service, which can't work unless your public IP address stays the same and you can run your own public NS and can receive recursion from your main NS provider. In most parts of the world, I think, IP changes every time you restart the router, even IPv6. So what you have there isn't exactly typical for home users. That one extra service and complication that you don't actually need. I don't have to remember anything HTTP(S). No ports, no IPs, no names, nothing. I use bookmarks. > Wouldn't it be nice to have the option to not have to rely on such things and just be able to connect to things directly? Wouldn't it be nice if there were no bad guys on the internet, no bots, and no zero days? > ipv6 is awesome. For Google and for you, maybe. But let me know how much you like it after your first cryptolocker. I suppose your backup storage is also public on the internet?