Hacker News Reader

> Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including retrieving the external IP address of the device, enumerate existing port mappings, and add or remove port mappings.

Are you bloody kidding me? Why do you even have a firewall, rudimentary as it is, then?

View on HN

UPnP comes from the view that NAT is an unfortunate artifact of residential ISPs only giving out one IPv4 address per household, not a crucial security strategy.

If you really think of your NATing router as a security device, turn off UPnP. Though I'm not sure how much good that will do, as any device can still phone home or reverse tunnel.

Sure but port scanning and forming a massive botnet is impossible if they are not even capable of listening on an open port which NAT gives you for free. It's like the lemonade you could make when life you gives you lemons. Except now it's spoiled too.

On the other hand, UPnP is the only currently viable strategy for average people to run devices on their home networks and control them from the internet without looping in a third party server.

Not all home routers are allowing this by default. I don't have any hard numbers to offer, but my feeling is that only very old and today's very crappy ones do.

Reply on news.ycombinator.com