I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.

Yeah, incorrect firewall rules are a HUGE problem at super large companies that aren't doing infra-as-code at scale yet.

Sysadmins/server engineering/DevOps/SRE, Networks, and Security are usually hard silos at big companies.

"DevOps" gets a request from an app team to open a port between subnet A and subnet B.

DevOps asks Networks to do it. Security needs to approve it before Networks can do it (usually). A cohort of VPs somewhere need to approve it if those subnets are "production" (i.e. subject to serious fines if the data therein fails audit).

Networks outsources the request to their global services team in India/Phillippines/China/Brazil since it's literally a single command, but they are done in bulk. These changes are only done afterhours, partly because of outsourcing latency, partly because of regulations.

The firewall person types in the wrong port. Emergency change request gets filed to fix. Fixed in 1-3 days after the CTO/CIO and some SVPs approve it (and maybe yells at people for wasting their time).

The requester asks for the wrong port. Too bad, so sad, you're waiting another week.

The app team asked for the wrong port. Same outcome as the DevOps person.

The thing is, once you start to do any complicated firewall setup where defaults can no longer be restrictive, you are bound to screw it up at some point.

What kind of firewall work didn't have default drop? Once you take that off the table you really do have a problem but I've only seen that one in 20 years of professional work.

I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.

Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear.

At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.

My consumer router has vlan support…

As far as consumer routers go, wouldn’t it be trivial to re-tool the usual port forwarding interface to simply accept connections to a specific address-port? That combined with a internal block-all-inbound rule would be quite hard for a user to footgun themselves horribly with.

From a quick search, UPnP seems capable of automating this for user convenience, especially with stateless addressing.

Are you sure you haven't? NAT in fact doesn't stop connections, so if you accidentally didn't configure the firewall then you won't be saved by NAT.

Odds are that there weren't many people in a position to connect to you, and probably nobody actually did so, but it would certainly have been possible without a firewall in place.

there's plenty of instances of shitty applications setting up massive port forwarding rules using upnp