Hacker News Reader

Comment by malfist | Hacker News Reader

Why would you disable UPnP? You're gonna break most collaboration tools/video games/etc.

Disabling UPnP doesn't break much. I've used enterprise firewalls at home for years, none of them have UPnP, I've never noticed a problem arising from that lack. I don't have a problem with video games or collaboration tools

UPnP allows devices inside your network to open ports to the outside world without your knowledge. I think everyone should avoid it if they can get by without it

It’s absolutely required for most multiplayer games. Many need random ports and some even refuse to work if UPnP is blocked even if you manually open a port for them.

I've never had UPnP enabled and I don't have any problems doing online gaming / flight sim / video chatting / etc.

Same. I've found the biggest problem was SNAT rewriting the (source) port number. netfilter, by default, doesn't do this. pf does but you can configure it not to.

On series X you can set up port forwarding really easily. I had to do it for openwrt

What's your solution for the grandmother who just wants to make a zoom call to her grandson? Have her log into her router portal and setup a static ip for her laptop and then port forwarding routes for zoom?

STUN servers? Also, while I (not GP) do think UPnP is dangerous, I also think it's only something you disable if you know you can live without.

I don't think zoom uses UPnP. If it did, that would cause problems on corporate networks that typically have UPnP disabled.

To be frank, that's exactly the problem with NAT-PMP et al. assuming that there's no router bugs: the ability to forward ports has been abused to set up bot relays on hacked IoT devices. This is why I predict that even in IPv6 era we would still have to rely on a TURN-equivalent.

That's exactly the problem with NAT-PMP?

So what's your alternative for peer to peer connections? Static routing that the common end user can't figure out? Re-centralize connections?

UPnP is necessary.

I'm simply pointing the problem, a real-world an realistic problem, and you're acting like it's a non-issue. Point me a CGNATted network which has enable port forwarding. Does it break a lot of things? Oh, absolutely. Did the carriers still not activated it? Yes. Automatic port forwarding is only beautiful when you know how would your device react. It's ugly when you're a network administrator who don't control all devices.

There is no "perfect" solution here because the real world is a messy place with devices that you cannot personally vouch for.

Reply on news.ycombinator.com