Research blog of Armis, an IoT security company, publishing vulnerability disclosures such as BlueBorne, Urgent/11 and NAT Slipstreaming.
HN commenters cite its research as evidence that NAT and firewalls can be bypassed and that Bluetooth stacks have serious flaws.
You don't need to be a firewall expert to use a firewall. Stateful firewalls have been around for longer than I can remember. The default for any consumer firewall is "disable by default", as they should be.
Now with NAT we need to be disable UPnP, and deal with "NAT types" on gaming consoles. Or Nintendo Switches breaking your LAN because Nintendo tells you to put your switch into the DMZ: https://en-americas-support.nintendo.com/app/answers/detail/a_id/22272/~/how-to-set-up-a-routers-port-forwarding-for-a-nintendo-switch-console
Because of NAT, we now need to deal with firewalls _and_ port forwarding. Plus, because of https://www.armis.com/research/nat-slipstreaming-v2-0/, your IPv4 firewall is practically disabled _because_ of NAT workarounds embedded into your router. You can pick between having a firewall on IPv4 or allowing WebRTC on any of your devices.
I've dealt with this before. It's a pain.
Look at this security research about bypassing NATs: https://www.armis.com/research/nat-slipstreaming-v20/
Look at the section "Creating NAT pinholes to any internal IP using the H.323 ALG" for example.
This is using a bug ("feature") that your CGNAT may have implemented (depending on the brand of CGNAT used). Fairly likely that one of those NAT slipstreaming vectors will allow you to punch a hole through it.
Is this reliable enough to actually use for self hosting stuff? Probably not. If you do, tell me :)
Edit: even the oldest versions of this technique (https://samy.pl/natpin/) may work for you. Depends if you're lucky. You don't need any of the exploit details that make this into an attack, only the basic concept of using NAT ALGs for unintended purposes.
Did you know a website can scan your lan through a browser now?
https://developer.chrome.com/blog/local-network-access
Did you know that a lot of current home router NAT implementations are currently broken, in particular for UDP traffic handling, and you can therefore spoof your way into the network?
https://www.armis.com/research/nat-slipstreaming-v2-0/
A lot of router vulnerabilities floating around out there.
Ever hear of UPnP/UPnP2? Did you know that applications can trigger your router to open inbound ports for you?
There have also been some 0 click exploits lately, those are fun. You don't have to do anything at all!
https://github.com/Defense-Intelligence-Agency/Zero-Click-Exploit-Deployment-Framework
Yeah, you're still at risk, and moreso because you're not aware of how open you are.
For me it's both about the privacy and vulnerabilities in the Bluetooth stack such as https://www.armis.com/blueborne/
According to the article, you need Sep 9 2017 security patch level, but my 5 year old phone is on Sep 1 2017 level. No way I'm going to have Bluetooth turned on in untrusted areas. While I'm unlikely to get hacked on the street or in a store, it gets more likely in places like a bus or a train (while commuting).
Do Apple keep security updates over the old versions? That could be an easy way to be forced to update.
Theses 2 relatively recents vulnerabilities are pretty good reason to have to update.
https://www.krackattacks.com/
https://www.armis.com/blueborne/
> But I'm still struggling to come up with a way to accidentally expose that on the internet.
See, e.g., https://www.armis.com/research/nat-slipstreaming-v20/ and
https://samy.pl/slipstream/