Filet-O-Firewall suggestions
-
Recognizing that UPnP has always been problematic and generally not recommended by security experts it seems as though some researchers have taken the threat to a new level: https://threatpost.com/upnp-trouble-puts-devices-behind-firewall-at-risk/114493/
What caught my eye was that the demo they did was actually on a pfSense router! In any case, they suggest that a website containing their code can exploit a client browser configured to run javascript into making UPnP requests of the router. A lot of requests. They suggest that, barring outright disabling of UPnP, randomizing UUID and URLs would at least mitigate brute force attacks.
I utilize pfSense at apartment buildings where UPnP is helpful to tenants with easy port mapping to services through the firewall. It makes my life easier as well. Any suggestions?
arri
-
UPnP is disabled by default.
Everyone who has a brain knows that giving software the ability to install inbound firewall rules without authentication/permission is a bad idea.
If I were you I'd be giving public IP addresses to your tenants and letting them run their own firewalls.
If they want a managed solution, they can pay for it.
-
Add ACLs to UPnP to limit the ports they can use.
Also 2.2.5 snapshots have an updated version of miniupnpd which, I believe, has some sort of fix for this.
-
Add ACLs to UPnP to limit the ports they can use.
This is the best answer regardless.
Also 2.2.5 snapshots have an updated version of miniupnpd which, I believe, has some sort of fix for this.
They added DNS rebinding protection to miniupnpd, which is in the version in 2.2.5 snapshots. That effectively prevents this from being an issue.
