When is Port Forwarding Safe? What devices/programs/apps or Never?

[biggen]

Yeah those are outgoing ports to the internet. That’s what I was saying that corporate firewalls may lock those down to prevent their employees to connecting to certain services but it’s strange a homeowner would run into those issues. I don’t know why IMAP is in that list. That’s email related and not having anything to due with wifi calling at all.

Odd indeed.

 

[tigerwillow1]

Doesn't a VPN require a port to be open? (Innocent question, not trying to start a debate).

 

[Mike A.]

Doesn't a VPN require a port to be open? (Innocent question, not trying to start a debate).

Yes. 1194 UDP by default for OpenVPN. In that case though you're only able to connect with the right key. Assuming no exploit at least. There have been a few.

 

[samplenhold]

Not an IT expert here. When I use Shields UP, no ports are seen. Everything is fine.

But when I first tried the BI Remote Access Wizard I had hits on my modem/router within 4 minutes of setting it up. I immediately took it down.

 

[wittaj]

Not an IT expert here. When I use Shields UP, no ports are seen. Everything is fine.

But when I first tried the BI Remote Access Wizard I had hits on my modem/router within 4 minutes of setting it up. I immediately took it down.

Interesting. What about with VPN setup on the router - what happens with Shields UP then?

I just looked at Shields UP page and it looked like a webpage I would put together (not good LOL) - I guess bare bones is good, but didn't look polished. Anyone else use that with success or what other programs to truly assess one's vulernability?

 

[Mike A.]

Need to be careful about looking at port scan results. A lot don't scan all ports. A lot are TCP only vs UDP. A lot report results in confusing ways.

Best is to run nmap yourself from outside of your network.

 

[biggen]

A lot of those hits are just rando port scanners looking for common exploits. They just scan IP ranges looking to see what is open. If you run a SSH server on the typical port 22 you will see all kinds of attempted connections of root or admin or user etc... in the log files. People are still silly enough to run services with admin as the user and admin as the password so automated port scanners will try and connect with those credentials.

 

[looney2ns]

Interesting. What about with VPN setup on the router - what happens with Shields UP then?

I just looked at Shields UP page and it looked like a webpage I would put together (not good LOL) - I guess bare bones is good, but didn't look polished. Anyone else use that with success or what other programs to truly assess one's vulernability?

Shields up and Steve Gibson the owner have been around since the stone age. Steve only cares about it working, not about flash.
I've used it many times.

Steve Gibson - Google Search

 

[alastairstevenson]

Anyone else use that with success or what other programs to truly assess one's vulernability?

ShieldsUp! works perfectly well, and provides a good range of test selections, it's down to the user to make the choices they need.
Checking for listening ports is a straightforward enough task.

But it's not doing vulnerability scans - just listening port scans.

 

[The Automation Guy]

I'll throw my 2 cents in.....

Port forwarding is never "safe". A VPN connection is really the only acceptable way to access your home's local network while you are not local. In the past, I have used port forwarding for a few services and to my knowledge my system was never compromised. But that was when I was younger and dumber..... I would never use port forwarding on a network today.

Obviously VPNs are more complicated to set up (but honestly not that hard either). But the average non-technical person probably cannot do it themselves. This is why the internet says it is OK to use port forwarding. If they told the truth, 95% of the population wouldn't be able to access their media or nanny cameras while away from home and that is just no way to live. So rather than tell the truth, the internet allows people to live in ignorant bliss. It's just one of a thousand ways that we (as a society) have decided that convenience is more important than security

It's also just one of a thousand ways that big business has decided that their profits are more important than our security. There isn't going to be a push for "internet security" when it means that thousands of products out there would be exposed for creating potential security issues in the name of convenience and fewer support calls. You definitely aren't going to have any of those companies (ie any of the big players that could actually make a difference) lead the charge for better internet security either because they stand to loose a lot of money (from both lost sales and higher support call volume).

 

[reflection]

25+ years as a network engineer here.

The perspective for a home user will be different from an enterprise. In general, port-forwarding is a means to expose certain ports to a destination. It's up to the destination to "protect" itself. You would not port-forward a certain port to all destinations.

For a home user, the a residential router is your firewall, NAT gateway, and VPN gateway all in one. You terminate VPN tunnels at the router (for remote access to your house). This router is exposed to the Internet so it has to "protect" itself. This router only listens on certain ports and protocols. One of the ports it listens on is TCP 443 (if you are running OpenVPN as an example). OpenVPN uses the OpenSSL crypto library and builds your VPN tunnel to encrypt your remote sessions.

Let's say you have two routers such that Internet connects to router1, router1 connects to router2.

internet----router1-----router2----home_network

what if router1 had port-forwarding setup so that it passed TCP 443 only to router2? And router2 terminated your VPN tunnels? Would this be safe? It would be as safe as above because router2 would be listening on TCP 443 to build the VPN connection. Router2 was designed to connect directly to the internet, but in this case it's only seeing TCP 443 which router1 forwarded to it.

what if router2 was VPN gateway using IPSec instead of SSL-VPN? Then you would have to forward UDP500, UDP4500, and ESP to router2. Same "safeness" or "unsafeness" depending how well you trust your router2.

what if router2 was an appliance designed for VoIP communications with the strictest adherence to FIPS 140-2 (which none of your residential routers do)? And the VoIP appliance builds a VPN tunnel back its provider (e.g. ATT). Same "safeness"

For an enterprise, the topology might look more like this

internet----router1-----firewall----dmz_network
                            |
                      router2/layer3_switch

NATing happens at router1 or the firewall. If router1 doesn't NAT, then it routes traffic to the firewall. The firewall typically has multiple roles, one of which can be the VPN server. In any case, router1 will either route or port-forward.

So the point is that port-forwarding is just a mechanism in networking to pass desired traffic for a certain need. Just like routing, or NAT, or VLANs, or MPLS, or CEoIP, etc. (the list goes on forever). Whether safe or not depends on how you use it. Sometimes you have no choice. There are definitely legitimate applications for port-forwarding. If you want to host any type of server at home (webserver, Minecraft), you have to get the traffic to your server somehow. Hopefully you have these servers in a DMZ-network that is segmented.

 

[Teken]

Just some perspective as it relates to video security and how its done in very serious environments. None of these sites use or have remote access to view the video feed. All of video feed is viewed and contained locally to insure complete security and privacy. Besides that a vast majority of these sites have the system physically isolated from the main network.

Again, this is to insure the highest levels of security, privacy, and redundancy . . .

You simply can't hack something that isn't physically or electrically on the same network without being on site. On a related tangent our team setup one of the first back scatter imaging systems in North America. Well, it didn't take long for some yahoo to say:

How come we can't access and view this new tech on my smart phone

Welps, one only needs to go on YouTube to see all of the leaked back scatter video's . . .

There's a reason for having both alarm security and video security completely isolated from anything else in a building. Because of the endless hacks and less than honorable people who feel the need to publish everything for the world to see! If you truly care about your personal security and privacy don't connect your video security to the internet - ever.

 

[mikeynags]

But what about the many sites that are not selling a service like whatismyipaddress.com

"Port forwarding is an excellent way to preserve public IP addresses. It can protect servers and clients from unwanted access, "hide" the services and servers available on a network, and limit access to and from a network. Port forwarding is transparent to the end user and adds an extra layer of security to networks.

In short, port forwarding is used to keep unwanted traffic off networks. It allows network administrators to use one IP address for all external communications on the Internet while dedicating multiple servers with different IPs and ports to the task internally. Port forwarding is useful for home network users who may wish to run a Web server or gaming server on one network."

This reads like it was written by someone who doesn't know what they are talking about. Port forwarding does nothing to make the connection more secure. If anything, it does the opposite. VPN is the most secure way to go along with other "layers" of protection like multi-factor authentication.

 

[wittaj]

It is amazing how much bad information is out there, and like myself and others have said, these companies don't want to deal with consumers calling "I can't see my cameras" or "I can't get my printer working", so they develop these workarounds that unfortunately add vulnerabilities into the consumers home system.

General public likes ease even if it costs. Anyone remember the days when several camera sellers would require people to have go into their router and set up port-forwarding. That was a mess to these companies fielding all these calls and needing to know how to do it in every brand of router. So once they could figure out P2P and QR codes to make it simple for the consumer, they went that route. And even then I bet they field tons of calls...

 

[Mike A.]

This reads like it was written by someone who doesn't know what they are talking about. Port forwarding does nothing to make the connection more secure. If anything, it does the opposite. VPN is the most secure way to go along with other "layers" of protection like multi-factor authentication.

Given how they started out re preserving IPs, I think maybe what they're trying to say is that it's more secure vs exposing entire machines out there on IPs of their own (though nobody really does that anymore) or passing all traffic through to something inside vs just a single port. But that's splitting hairs to give them the benefit of doubt. So, yeah, poorly written for the intended audience at a practical level.

 

[wittaj]

Check out this post about why port forwarding isn't safe.

That easy to watch someone else inside their house and they are using Blue Iris, which would be on a PC most likely up to date with the most recent Windows security and firewall protection...port forwarding simply blows a hole into your system and bypasses all security measures...so imagine how easy it is on a camera or NVR with firmware never updated...

ever do a Blue Iris search and turn up random cameras with real people in them?

Holy port forward

ipcamtalk.com

 

[alastairstevenson]

Check out this post about why port forwarding isn't safe.

And this one too!

Hikvision Honeypot Hackathon

We get quite a lot of posts about port forwarding - and quite a lot of good advice in response about the risks, and pointers to more secure remote access methods. And we still get posts related to the Hikvision backdoor vulnerability, where camera passwords are mysteriously lost, or cameras...

ipcamtalk.com

 

[smoothie]

I agree with what others in this thread have stated, that port forwarding is not secure, not safe and simply a bad idea. A VPN run on a quality edge device is the most secure method of remote access.

An "edge device" is the division between your private LAN(s) and the open internet, this is most commonly some device that has firewall capabilities which may or may not be bundled into a router/modem. A true edge device is designed to be exposed to the open internet and is hardened accordingly. It is meant to withstand the unrelenting onslaught that is the open internet. An edge device will be probed and attacked continuously from around the world simply by being connected to the internet. If you would like to see what a legitimate probe has to say about your system the ShieldsUp from GRC as others have mentioned is an excellent probe. If you would like to see what the internet has previously recorded and logged about your public IP take a look at Shodan which provides information about any public IP address. You can find your public ip address by searching google for "what is my ip" or sites such as "

https://whatismyipaddress.com

" that others have mentioned.

The trouble with port forwarding is that you are taking that unrelenting pressure off the edge device which, ideally, has been designed to withstand it and allowing it to forward to the internal device which is virtually guaranteed to NOT be as capable of withstanding it. You are now relying on the internal LAN device to not be compromised by the strength of its design and coding. How many times have you heard of security cameras and baby monitors or the like being compromised ? Of some random person talking out of some unsuspecting persons devices in their homes. The number of cameras and other such devices that have well known hard-coded (meaning unchangeable) usernames and passwords is huge. The list of reasons NOT to port forwards goes on and on.

A quality firewall with no port forwarding or remote access of any kind is simply a solid wall, largely impervious and unyielding, it is for all intents and purposes a one way valve.

A properly configured VPN would be like a bank vault door. The vulnerabilities it exposes are limited and designed to mitigate as much risk as is possible by hardware engineers and software coders whose careers focus on this protection and strength.

Port forwarding can run the gamut from low risk if the device on the inside is a properly configured Linux server running WireGuard VPN all the way to utterly open and insecure such as an IoT device with known hard-coded username and password.

An IoT, or Internet of Things, device is any device that isn't a high level device (e.g. desktop, laptop, phone, tablet) that is designed to connect to a network of some kind. Common examples of IoT devices are cameras, NVRs, speakers, refrigerator, thermostats, smart light bulbs and smart home devices in general. Depending on the device the port forwarding points to an attacker could use it as a foothold into your home network and laterally move to infect printers or computers etc. There are countless articles written about the network security aspect of all IoT devices being non-existent, all IoT devices are built without a thought towards security or at best as passing consideration to it.

I personally like pfSense or OPNsense for my firewall/edge device. It is fully featured and capable. It can become quite technically complicated so it may only be suitable for the technically adept or those willing to research and learn. While I have never personally used the UnFi system from Ubiquiti I have heard it is a good platform.

Just my 2c on the topic.

 

[alastairstevenson]

Just my 2c on the topic.

Actually worth a lot more.
An excellent post, many thanks!

 

[smoothie]

Here is a visualization of the kind of activity your internet connection must endure. This is a screenshot of my firewall being attacked by a set of public IP addresses from the Netherlands (NL). This is an arbitrary week that I picked at random out of my logs from 2021/07/15 to 2021/07/22. I do not have DNS pointing to my public IP address, I have no persistent services or ports exposed on my public IP, in other words there is nothing unique or interesting about my public IP address that would make it more of a target than your public IP address. Most firewalls obscure this info because it isn't relevant or useful unless you are a computer geek. So in an ordinary week with nothing exposed on my system I was the target of 74,341 port scans, probes, attacks and traffic in general, keep in mind this does NOT include traffic that is a response to my originating connects such as websites displaying a webpage I visit.

Keep in mind that GeoIP info isn't 100% reliable and accurate, just ask these Kansas farmers: Kansas family sues mapping company for years of 'digital hell'