NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
ORBI RKB50 and UPnP/IGD - Broadcasting in AP mode
I am running a pfSense Router and Firewall now (since Oct 2021) and using my ORBI RBK50 in AP mode (Router Firmware Version V2.7.3.22). I have been trying to find a way to disable the UPnP/IGD funct...
bearhntr wrote:
I cannot understand why there is no DD-WRT for the Orbi. I have looked at Voxel's stuff - but that appears to be a NIGHTMARE!! to implement.
The folks behind DD-WRT simply have not chosen to implement on the Orbi platform. No idea why (or why not).
Voxel's firmware is almost trivial to install. (I have done it myself.) The only "gotcha" is to manually load a specific version of stock firmware first (as described in the READ.ME file.). There are huge sections of the Orbi code that Voxel cannot change because they are proprietary binary files. My guess is that whatever affects UPnP is in that part of the code, and thus Voxel's firmware will behave the same way. (That experiment is more than I want to do right now.)
I remain ignorant about what damage it causes to have the Orbi router announce what it is and what it might be capable of, while clearly not claiming to to be an internet gateway (IGD). I am used to kids saying, "Oh Grand Pa. You just don't get it." (and maybe I really don't.) My little network did not seem to melt down when I put that test Orbi into AP mode.
I appreciate your responses and testing...
Looks like it is time to move up my UBIQUITI (UNIFI) migration.
When (or if) I get the urge to invest in a new WiFi solution, I foresee a real challenge in selecting from the enormous variety of products from major players: Asus, Amazon (eero ), Google (Nest), Linksys (Atlas, Velop), Netgear (Nighthawk, Orbi), TP-Link (Deco), Ubiquiti.
I know lots about Netgear's shortcomings but have no experience with the other brands. Oh, my.
Networking trivia is a key part of diagnosing many problems that come up on the forum. For example, it turns out that IGMP Snooping on Ethernet switches can interfere with network connections in ways that are not obvious. That is why so many times people will ask, "Is there a switch in the network?" I would love to file away a note about "UPnP when Orbi in AP Mode" that describes what problem users are likely to mention so I can ask, "Is this Orbi in AP mode?"
Well - Security is Security.....is well......Security.
If your system is secure - and you state that when ORBI is in AP mode - UPnP/IGD is not active....it should not be found by ANY SCAN. Let alone a third-party product which is not really "looking" for it. It just sees that packets are coming from the UPnP/IGD ports is still active.
You have proved this - you put ORBI in Router mode and disable UPnP and got no hits - then set ORBI to AP mode - and 'ouila' it starts sending packets for UPnP/IGD. This is a SERIOUS SECURITY FLAW if you ask me.I will be going with UBUQUITY (when and IF they ever start carrying inventory again).
Once someone has connected to the internal LAN, there are so many potential security risks to exploit.
- Many routers, such as Netgear's host web servers for management (ports 80 and 443).
- There is a DHCP server (somewhere) accepting DHCP requests.
- Some device is providing DNS lookup. (My Pi-hole also has a web server for management)
- Media servers accept connections.
- Security cameras accept connections on all sorts of ports.
- My FTP server is open to the LAN (but not the internet).
- Printers accept connections (mine even has a web interface).
- I have switches with web management interfaces.
- The list goes on and on...
I believe the third party UPnP Scanner finds the Orbi in AP mode because that's the way UPnP is supposed to work. Devices 'find each other'.
Hacking is really out of my league, so I am at a loss to imagine how serious this security issue is. What damage can an evil person inflict by exploiting it? That's what will determine the priority Netgear assigns to working to fix it. Right now, they appear to be consumed with a "Emergency red flag priority ticket" because Orbi 750 and 850 systems cannot be reached with the Orbi app or through the web interface.
Ubiquiti makes really cool stuff. Sorry their supply chain has ground to a halt.