Adventures in UPnP with Curl and Netcat

coolaj86.com

37 points·goodburb··4 comments

UPnP for port mapping is such a nice, convenient security hole. There have been a few cases where I have needed to forward a port without access to the router's WebUI and 8/10 times, in a residential setting, UPnP saves the day. I normally use miniupnpc, but it's pretty cool seeing this done with curl.

My home fiber connection is unfortunately behind a CGNAT. However, I was surprised the other day that somehow Valheim/Playfab was able to punch a hole through both my NAT and the CGNAT. I'm assuming this is some sort of UPnP trickery, but I haven't been able to determine if it's the application's doing or my gateway sending a request to the CGNAT.

I am almost full IPv6 for what I am using on the net.

But... Hacker News, Slashdot... wink! wink! ping6! ping6! PleaAaaaaAase!

But the time at which I will FINALLY disable ipv4 is getting really close now.

Hopefully you are not saying that you plan to disable firewall once you all in on IPv6. This is pretty reckless and bad security practice. And even if your machines are secure _today_, who says there will not be insecure device tomorrow.

So UPnP (or its equivalent) will still be very relevant in IPv6 world. Probably even more as you no longer have stable internal addresses, the prefix comes from your ISP.

Reply on news.ycombinator.com