Filet-O-Firewall suggestions



  • Recognizing that UPnP has always been problematic and generally not recommended by security experts it seems as though some researchers have taken the threat to a new level: https://threatpost.com/upnp-trouble-puts-devices-behind-firewall-at-risk/114493/

    What caught my eye was that the demo they did was actually on a pfSense router! In any case, they suggest that a website containing their code can exploit a client browser configured to run javascript into making UPnP requests of the router. A lot of requests. They suggest that, barring outright disabling of UPnP, randomizing UUID and URLs would at least mitigate brute force attacks.

    I utilize pfSense at apartment buildings where UPnP is helpful to tenants with easy port mapping to services through the firewall. It makes my life easier as well. Any suggestions?

    arri


  • LAYER 8 Netgate

    UPnP is disabled by default.

    Everyone who has a brain knows that giving software the ability to install inbound firewall rules without authentication/permission is a bad idea.

    If I were you I'd be giving public IP addresses to your tenants and letting them run their own firewalls.

    If they want a managed solution, they can pay for it.


  • Rebel Alliance Developer Netgate

    Add ACLs to UPnP to limit the ports they can use.

    Also 2.2.5 snapshots have an updated version of miniupnpd which, I believe, has some sort of fix for this.



  • @jimp:

    Add ACLs to UPnP to limit the ports they can use.

    This is the best answer regardless.

    @jimp:

    Also 2.2.5 snapshots have an updated version of miniupnpd which, I believe, has some sort of fix for this.

    They added DNS rebinding protection to miniupnpd, which is in the version in 2.2.5 snapshots. That effectively prevents this from being an issue.


Log in to reply