Other than your router you should not have ANYTHING directly on the internet these days.

There is just too much surface area for device software now and cost pressure doesn't allow for security to be much of a priority.

With the QNAP cloud service, even if the server was behind a firewall/NAT, you could still directly access the NAS from the internet. So, you could still get caught with this.

Source: I have a QNAP NAS and after the first week, I couldn’t figure out who was trying to login to it as an admin account. Thankfully, I had changed all the passwords, but by default it had connected to their cloud service and was remotely accessible. I’m still not 100% sure I have it completely secured.

> you could still directly access the NAS from the internet

Not unless you intentionally opened a port on the router to allow inbound access. Even default cable modems come with every port blocked by default.

Even cloud-enabled services require that the machine behind the modem/router open the connection first, so unless you're getting MITM there's no externally available access.

Actually, enabling the myQNAPcloud service comes with a "Auto router configuration" which makes the NAS send uPNP requests to the router for opening inbound ports. So unless uPNP is disabled on the router (which in most cases would have to be done manually at some point), you don't need to intentionally open a port for inbound access, the QNAP NAS will do it automatically...

>No you can't, unless someone intentionally opened a port on the router to allow inbound access.

That's what I used to think. Then I found out about upnp on routers. I'd like to have a quiet talk with whoever thought that was a good idea.

QNAP has something called QLink which I believe is a NAT traversal scheme that gets the NAS to open a link to the QNAP servers. No port forwarding is necessary.

No reason to believe a random offf the shelf router is any more secure than any other device

It's probably better to only have one random possibly unsecure device connected to the Internet than a dozen random possibly unsecure devices.

I'd like to hear what HN folks would most comfortably put as that router (device/software).

I have this pc engines apu2 openbsd setup. Upgrading openbsd is kind of a pain, but other than that, it has been trouble free:

https://github.com/elad/openbsd-apu2

In the last 5 years, it has crashed zero times.

Once, after a power loss, fsck blocked until I pressed y over and over again.

FreeNAS on an X11SBA-LN4F. Its an awesome board for a home router. With a 100W 80+ Gold PSU this thing pulls like 3-5W from the wall most of the time. I'm tempted to just get a 12V brick as it can run off just a DC power supply instead of a full ATX but hey if it works it works why mess with it.

https://www.supermicro.com/en/products/motherboard/X11SBA-LN...

Oops, didn't mean FreeNAS, I meant pfsense there. All this talk about NAS'es put FreeNAS on the mind.

I use a pcengines APU2C4 (AMC x86 cpu SBC with integrated network switch) with VyOS as my external router.

https://routersecurity.org/ brought me to https://www.peplink.com/products/soho-series/

But I would love to understand my router better and why/how to trust it, or that I've configured it the best way, to protect from threats both inside and outside my LAN.

When I tried to research this last time I heard that dd-wrt were more on top of CVEs than OpenWRT, so I picked them. No idea if that's correct though

I use a Unifi USG despite the anti-ubnt security hype. I also use pcengines apu2 with ubuntu focal as VPN routers.

I like the Ubiquiti EdgeRouter X since it doesn't try to be as magic and cloud-enabled as the USG (yes there is UNMS but they don't push you use it like they do on the Unifi gear)

At work I use fortigate equipment and keep it updated.

At home I have sold my soul to Bezos and just use an Eero.

personally I have something like this: ISP modem ---> Netgear (for guests) ---> pfSsense ---> My network with the VPN server for dialling in.

I would of added a second pfSense for the NAS and cloud but I thought it would be an overkill.

openwrt on a wrt1200ac

So are you completely against self-hosting services or do you apply this only to closed (IoT) appliances?

Your service should probably be sitting behind the firewall/router/proxy. But you really should consider your options and if the service itself needs to be exposed directly to the internet.

I think it's insane to do. I wouldn't want to open my NAS up to the internet. I can VPN into my home network if I need to access it remotely.

I think it's a bad idea as well but I don't blame people for doing so because of how QNAP markets them.

Competing products are marketed in the same way.

I can't imagine attaching anything directly to the internet outside my router.

And you likely have UPnP disabled.

The device can be hacked even within LAN. These gadgets sometimes use UPnP and open ports on routers. A lot of ISP provided routers support UPnP.

If you use Google or Apple photos you are connecting to their computers that are exposed directly to the internet, but I would much rather own my data rather than have these corporations own it. The question in my mind is why these NAS companies are so comparatively terrible at writing secure software.

Yes, I made the suggestions to both QNAP and Synology for having an simple single option to disable ALL Cloud function and Internet connection. I want an Intranet NAS. Not an Internet NAS.

But they seems to think they dont add value without the Internet stuff.

I dont use any of the Internet stuff. I only want my files to be shared within the network in my home. And doing it myself require so much tinkering.

Assuming you aren't talking about completely air gapped parallel IT infra: The alternative comes with different administration burdens after which you've built an insecure internal network that is still indirectly internet connected and can be breached. If it's not that in the beginning, it will become one, due to human factors.

Nope. My Synology is only reachable via a VPN. Even connecting to the Plex server on it requires a VPN.