3 ms·

I still don’t understand how someone can end up accidentally exposing things to the public internet. With every ISP I have ever had in my country, it’s all NAT

I still don’t understand how someone can end up accidentally exposing things to the public internet. With every ISP I have ever had in my country, it’s all NAT by default. Whatever I connect to my network, wired or wireless, would not be publicly accessible just like that unless I really really went out of my way to make it publicly accessible. How do so many people end up exposing these cameras to the public internet? Are their ISPs not using NAT by default? Are the users jumping through hoops in order to open it up?

Phil_Latio 4mo ago
UPnP is not disabled by default on all routers, especially older ones. So devices may just try to port-forward certain control or media ports.
1e1a 4mo ago
Many consumer routers allow any connected device to configure port forwarding using UPnP. If you want, you can play around with this using a client such as miniupnpc's example client.
fc417fc802 4mo ago
Is your ISP doing CGNAT? At least in the US that's not the norm. Most people have publicly routable IPv4 addresses (even if they rotate somewhat frequently) and most routers are configured to support UPnP out of the box. This is an example of everything working as intended. The cameras are supposed to be accessable when you're not at home. Of course the cameras ought to ship with randomized default auth on a sticker attached to the unit the same way any half decent router does these days but they don't.
bbor 4mo ago
These are cameras sold specifically to be available over the open internet, I guess.
deleted 4mo ago
[deleted]
microgpt 4mo ago
The professional installers know how to get real public IPs from their ISPs (for a price). They're using a different instruction book than the consumer with the cheap Chinese home camera.
marysol5 4mo ago
UPnP exists, it's a really weird bit of technology that goes against all ideas of "security". "Hey, so I can just do a HTTP request to the router and open a port? Neat" Used to use it back in the day when my ISP didn't allow for port forwarding, but did allow UPnP, so had a cron job that re-opened it every x hours when it reset.

Phil_Latio 4mo ago

UPnP is not disabled by default on all routers, especially older ones. So devices may just try to port-forward certain control or media ports.

1e1a 4mo ago

Many consumer routers allow any connected device to configure port forwarding using UPnP. If you want, you can play around with this using a client such as miniupnpc's example client.

fc417fc802 4mo ago

Is your ISP doing CGNAT? At least in the US that's not the norm. Most people have publicly routable IPv4 addresses (even if they rotate somewhat frequently) and most routers are configured to support UPnP out of the box. This is an example of everything working as intended. The cameras are supposed to be accessable when you're not at home. Of course the cameras ought to ship with randomized default auth on a sticker attached to the unit the same way any half decent router does these days but they don't.

bbor 4mo ago

These are cameras sold specifically to be available over the open internet, I guess.

deleted 4mo ago

[deleted]

microgpt 4mo ago

The professional installers know how to get real public IPs from their ISPs (for a price). They're using a different instruction book than the consumer with the cheap Chinese home camera.

marysol5 4mo ago

UPnP exists, it's a really weird bit of technology that goes against all ideas of "security". "Hey, so I can just do a HTTP request to the router and open a port? Neat" Used to use it back in the day when my ISP didn't allow for port forwarding, but did allow UPnP, so had a cron job that re-opened it every x hours when it reset.