1

I am at the design stage of an embedded system which requires an incoming connection to be forwarded through a consumer-grade router. This will carry an encrypted connection eventually.

I see three options here:

  1. Setup port-forwarding from the router to the system with HTTPS.
  2. Use UPnP to setup temporary port forwarding with HTTPS.
  3. Use UDP hole punching and custom encryption on top.

The other end of the connection is a mobile device which will not have a public IP with a controllable firewall, so cannot be connected to in the other direction.

Improve this question
3
  • There are only few details in your question, but since one of your options is UDP hole punching it would mean, that you have the option of creating a tunnel from behind the router, i.e. inside. In this case it is not clear why you don't simply open a TCP connection from the inside and use TLS on top of it. – Steffen Ullrich Apr 23 '15 at 5:14
  • 1
    Questions of the form "Which is more secure" tend to be unanswerable. What is your threat model? Why would it matter if people can send packets to your embedded device? Surely you'll authenticate and access control incoming connections (if you don't, then this is where you're making a mistake)? Unless there is a specific attack on the transport layer you want to address, there isn't much of a difference between the 3 alternatives. – Steve Dodier-Lazaro Apr 23 '15 at 8:31
  • What do you expect the connection to do? Does it require speed - TCP is often not the best solution for raw throughput. – Ian Apr 23 '15 at 12:11
1

If I clearly get your question. You have three option to do a P2P connection with remote party. 1) UPnP 2) Port forwarding 2) UDP hole punching. I think UDP hole punching will be secure one, but it is hard to establish P2P connection using UDP hole punching when one of the party behind Symmetric NAT.

UPnP: Generally this concept has some security issue. Administrative credential does not required during port allocation using UPnP protocol. So if you enable UPnP in your router/NAT device then there is high possibility to allocate port by malware programs and pass information from your computer to a remote point.

Port forwarding: This is old technique, if the forwarded port disclosed to some other third parties then there is high possibility to DoS attack.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.