Automatic UPnP port forwarding is still exposing TNAS to the public internet, since 2021

[turoplo]

This issue has been previously reported (and claimed to be fixed) multiple times now.

Documented previously by other people here:
2021 - https://www.storagereview.com/news/terr ... -over-upnp
2023 - viewtopic.php?t=4750

I just bought a F2-212, and I have been working to get it set up.

I've installed the most recent version of ARM TOS 5, 5.1.73-00078, and the System control panel says that "Current system is the latest version".
BIOS/InitBoot version is 313.

STEPS TO DUPLICATE:
(1) Set a valid manual ip-address for the TNAS in the Network control panel (interface tab, editing LAN-1 port, IPv4, "Use the manual configuration noted below...").
(2) Restart the TNAS.

RESULT:
When the F2-212 TNAS restarts, the TNAS automatically uses UPnP to request that my router forward 8 ports directly to that internal ip-address of the TNAS, exposing those ports of the TNAS to the entire internet through my router's public ip-address instead of being "available only on the local network" the way it says in the General tab of the Network panel.

ftp - PUBLIC_ROUTER_IP:6221 to INTERNAL_TNAS_IP:21
http_pri - PUBLIC_ROUTER_IP:8800 to INTERNAL_TNAS_IP:8800
http_ssl - PUBLIC_ROUTER_IP:5443 to INTERNAL_TNAS_IP:5443
ftp_data - PUBLIC_ROUTER_IP:2000 to INTERNAL_TNAS_IP:20
sshd - PUBLIC_ROUTER_IP:22 to INTERNAL_TNAS_IP:22
http - PUBLIC_ROUTER_IP:8181 to INTERNAL_TNAS_IP:8181
telnetd - PUBLIC_ROUTER_IP:23 to INTERNAL_TNAS_IP:23
pt - PUBLIC_ROUTER_IP:9091 to INTERNAL_TNAS_IP:9091


OTHER DETAILS:

If I change the ports for HTTP and HTTPS in the TNAS settings, those custom ports will also be forwarded from the router's public ip-address to the local TNAS ip-address, in addition to the default 8181 and 5443 ports.

This happens even when "Enable Security Isolation Mode" is checked in the Security control panel (HTTPS requests from the public internet do try to connect to the local TNAS and then time out).

If "Enable Security Isolation Mode" is not checked, accessing port 8181 or 5443 (or whatever the custom HTTPS ports are in settings) on my router's public ip-address will connect to the TNAS and bring up the TOS UI.

FTP, Telnet, and SSH services are disabled on the TNAS.
It doesn't make any difference whether the "Set as default Gateway" checkbox is checked or unchecked when editing the LAN-1 port settings.
The "Enable UPnP discovery service" checkbox in the Discovery control panel is unchecked, and most likely unrelated to this.

[Gremlin]

Try turning off upnp on your router

[RyanYang]

Thank you for your feedback! We've reported this issue to the lab. Due to some scheduling conflicts, the ARM version of TOS has not been updated in a timely manner. We will release a fix as soon as possible.

[turoplo]

Try turning off upnp on your router

It's not the router or UPnP that is doing anything wrong, and having UPnP turned on is the default for pretty much all of the ISP routers around here.

If I hadn't decided to learn how to manually forward a port instead of allowing plex to set it up automatically, I might not have known that the TNAS was exposing those ports on the router's public ip-address unless/until something bad happened.

The router my ISP provides is definitely not great for lots of reasons, but this is 100% something that TOS should not be doing.

Thank you for your feedback! We've reported this issue to the lab. Due to some scheduling conflicts, the ARM version of TOS has not been updated in a timely manner. We will release a fix as soon as possible.

Thanks. I hope it happens soon.

[Gremlin]

That upnp is turned on by default makes it no better than your complaint about The TOS operating system. Protect your network and turn upnp off, however you can.

[turoplo]

That upnp is turned on by default makes it no better than your complaint about The TOS operating system. Protect your network and turn upnp off, however you can.

Everything is a trade off between security and convenience, including deciding to buy and use a NAS off the shelf.

UPnP is a risk, but it isn't inherently any more or less secure than manual port forwarding if/when it is being used correctly.
People who don't want it can turn it off on the router to make their network more secure. They shouldn't be required to do so.

TOS is automatically opening ports through the firewall and exposing itself to the public internet, when the router's firewall would normally block those incoming connections, and it doesn't notify the user in any way.
There doesn't seem to be any way to turn these automatic UPnP requests off on the TNAS, and there is no scenario where what TOS is doing is the correct thing to do.

[evaluatelocal]

That upnp is turned on by default makes it no better than your complaint about The TOS operating system. Protect your network and turn upnp off, however you can.

Everything is a trade off between security and convenience, including deciding to buy and use a NAS off the shelf.

UPnP is a risk, but it isn't inherently any more or less secure than manual port forwarding if/when it is being used correctly.
People who don't want it can turn it off on the router to make their network more secure. They shouldn't be required to do so.

TOS is automatically opening ports through the firewall and exposing itself to the public internet, when the router's firewall would normally block those incoming connections, and it doesn't notify the user in any way.
There doesn't seem to be any way to turn these automatic UPnP requests off on the TNAS, and there is no scenario where what TOS is doing is the correct thing to do.

Agree with your approach. Risks are definitely involved when using digital applications or services. Your analysis is really convincing.