Hacker News Reader

Comment by karmicthreat | Hacker News Reader

Other than your router you should not have ANYTHING directly on the internet these days.

There is just too much surface area for device software now and cost pressure doesn't allow for security to be much of a priority.

View on HN

With the QNAP cloud service, even if the server was behind a firewall/NAT, you could still directly access the NAS from the internet. So, you could still get caught with this.

Source: I have a QNAP NAS and after the first week, I couldn’t figure out who was trying to login to it as an admin account. Thankfully, I had changed all the passwords, but by default it had connected to their cloud service and was remotely accessible. I’m still not 100% sure I have it completely secured.

> you could still directly access the NAS from the internet

Not unless you intentionally opened a port on the router to allow inbound access. Even default cable modems come with every port blocked by default.

Even cloud-enabled services require that the machine behind the modem/router open the connection first, so unless you're getting MITM there's no externally available access.

>No you can't, unless someone intentionally opened a port on the router to allow inbound access.

That's what I used to think. Then I found out about upnp on routers. I'd like to have a quiet talk with whoever thought that was a good idea.

QNAP has something called QLink which I believe is a NAT traversal scheme that gets the NAS to open a link to the QNAP servers. No port forwarding is necessary.

Actually, enabling the myQNAPcloud service comes with a "Auto router configuration" which makes the NAS send uPNP requests to the router for opening inbound ports. So unless uPNP is disabled on the router (which in most cases would have to be done manually at some point), you don't need to intentionally open a port for inbound access, the QNAP NAS will do it automatically...

No reason to believe a random offf the shelf router is any more secure than any other device

It's probably better to only have one random possibly unsecure device connected to the Internet than a dozen random possibly unsecure devices.

I'd like to hear what HN folks would most comfortably put as that router (device/software).

I use a Unifi USG despite the anti-ubnt security hype. I also use pcengines apu2 with ubuntu focal as VPN routers.

I like the Ubiquiti EdgeRouter X since it doesn't try to be as magic and cloud-enabled as the USG (yes there is UNMS but they don't push you use it like they do on the Unifi gear)

At work I use fortigate equipment and keep it updated.

At home I have sold my soul to Bezos and just use an Eero.

personally I have something like this: ISP modem ---> Netgear (for guests) ---> pfSsense ---> My network with the VPN server for dialling in.

I would of added a second pfSense for the NAS and cloud but I thought it would be an overkill.

I use a pcengines APU2C4 (AMC x86 cpu SBC with integrated network switch) with VyOS as my external router.

https://routersecurity.org/ brought me to https://www.peplink.com/products/soho-series/

But I would love to understand my router better and why/how to trust it, or that I've configured it the best way, to protect from threats both inside and outside my LAN.

I have this pc engines apu2 openbsd setup. Upgrading openbsd is kind of a pain, but other than that, it has been trouble free:

https://github.com/elad/openbsd-apu2

In the last 5 years, it has crashed zero times.

Once, after a power loss, fsck blocked until I pressed y over and over again.

FreeNAS on an X11SBA-LN4F. Its an awesome board for a home router. With a 100W 80+ Gold PSU this thing pulls like 3-5W from the wall most of the time. I'm tempted to just get a 12V brick as it can run off just a DC power supply instead of a full ATX but hey if it works it works why mess with it.

https://www.supermicro.com/en/products/motherboard/X11SBA-LN...

Oops, didn't mean FreeNAS, I meant pfsense there. All this talk about NAS'es put FreeNAS on the mind.

openwrt on a wrt1200ac

When I tried to research this last time I heard that dd-wrt were more on top of CVEs than OpenWRT, so I picked them. No idea if that's correct though

So are you completely against self-hosting services or do you apply this only to closed (IoT) appliances?

Your service should probably be sitting behind the firewall/router/proxy. But you really should consider your options and if the service itself needs to be exposed directly to the internet.

Reply on news.ycombinator.com