.NET

The next-generation BBS software

  • Old and new a 1980s computer can join
  • Real hardware a chip on your shelf
  • Free software GPL v3 or later
  • No internet needed a local network is enough
  • You write the rules and you are the appeal
  • No ads no one sells your time
  • No platforms nobody in the middle
  • No hosting fees it runs at your place
  • No outside costs your power, your Wi-Fi
  • No cloud nobody else's server

Let people outside your home join

Port forwardingA router setting that lets people outside your home reach one device inside it, on one numbered port. is the step that turns a board on your desk into a board anyone can join from anywhere, where the BBS world says "call". It is one setting on your router, and it is the setting with the most consequences, so this page is blunt about what it does before it tells you how.

Read this first. You are opening a door in your own network, and you are the only person responsible for what comes through it. Nobody here can see your network, your router, or what else is on it. If you do not understand what a port is, stop and read until you do. If the network belongs to your employer, your landlord, your university or your parents, ask them first.

Try this before you look anything up. From firmware 1.2.2 the board can ask your router to set the forward up itself, which on a router that answers means there is no menu on this page for you to find.

It is worth a keypress before an evening of research. If your router answers, you can let the board do the whole thing and there is nothing on this page to look up, though everything the next two sections say about the risks still holds, and that section says so itself. If the board comes back saying your address is not on the internet, then no router setting of any kind would ever have worked, and it is much better to find that out now. If no router answers at all, read on: forwarding the port by hand works on any router.

What you are doing

Your router blocks unsolicited traffic from the internet by default. That default is the single largest thing protecting the devices in your house: printers, cameras, NAS boxes, a television, anything that was built by somebody in a hurry and has not been updated since.

A port forward makes one exception to it. You are telling the router: traffic arriving on this port is expected, send it to this machine. Done correctly, exactly one program on exactly one device becomes reachable. Done carelessly, you can expose something you never meant to.

The specific risks

Telnet is plain text. This is a BBS, and the protocol has no encryption. Every password typed by every visitor crosses the open internet in the clear, and anybody positioned between a visitor and your board can read all of it. That is a property of the protocol, not a bug in this software, and it was true of every board in 1985 too. Tell the people who join, and never reuse a password on a telnet board. A board on an ESP32-S3 also takes SSH, which is encrypted, on the same port and on its own, 6422 as shipped: forward that one too if you want visitors from outside to use it with SyncTERM.

Letting the board do the asking covers both: it asks for the port callers dial and, on a board with an SSH port of its own, for that one as well. It never asks for the backup window's port, which is meant to stay on your own network.

Or let the board ask your router

Most routers will set a forward up for a device that asks them from inside the house, and from firmware 1.2.2 the board can do the asking. It is the same mechanism a games console or a video call uses when it works without anybody opening a menu.

This opens the same door. Everything above is still true: the port is open to the whole internet, you will be scanned, your address becomes public, and telnet carries passwords in the clear. The only thing that changes is who types the setting in.

Switching it on

Nothing else changes. The board listens on the same port it always did, and callers on your own network reach it the same way.

How it asks

There are three protocols for this and the board tries them in order: PCP, then NAT-PMP, then UPnP. They do the same job, and routers differ in which one they answer.

Where any of them works, what you end up with is exactly the forward you would have made by hand: a caller reaches your router, and your router sends them to the board. Nothing of ours sits in the middle, and nothing of ours has to keep running for it to work.

Mapped is not the same as reachable

PORTMAP says mapped, and it never says reachable, because those are two different claims. The board can see that the router agreed. It cannot see whether anything from the internet actually arrives, because that needs somebody outside to try. Dial your own board from a phone on mobile data, with the phone's Wi-Fi switched off, to find out.

What it can leave behind

A forward made this way is normally a lease. The board asks for two hours and renews it halfway through, so a board switched off for good has its forward expire by itself within a couple of hours.

Some routers will not do leases. They answer that the only forward they can make is one that never expires, and the board takes it, because the alternative is no forward at all. PORTMAP then shows Lease: none.

A forward that never expires outlives the board. Setting Have router forward back to no while the board is running gives it back. Unplugging the board does not, because nothing on the board runs once the power is gone. The forward stays in the router, pointing at an address the router may later hand to some other device. If you are retiring a board, switch the setting off first, or delete the forward in the router yourself.

A forward you made by hand has exactly the same property. This is not a new kind of risk; it is one you would not have thought to go looking for.

What to know about the security of it

UPnP has a reputation, and some of it is earned. Two different questions get run together when people repeat it, so they are worth taking apart.

Can somebody on the internet open a port in your router this way? For two of the three protocols, no, and their specifications say so in those terms. NAT-PMP's, RFC 6886, requires that a gateway "MUST NOT accept mapping requests destined to the NAT gateway's external IP address or received on its external network interface", and PCP's, RFC 6887, says a server "MUST silently ignore PCP requests arriving on any other interface" than the one it normally hears that client on.

UPnP's specification carries no such requirement, and UPnP is the one most home routers have. Nothing in it obliges a router to listen on the inside only, so whether yours does is its manufacturer's decision rather than the standard's, and some of them got it wrong. When Rapid7 asked every address on the internet in 2012, 81 million of them answered a UPnP question from outside, and about 17 million of those also offered the part that makes forwards. In 2018 Akamai found roughly 65,000 routers carrying forwards a stranger had put there from the internet and was pushing traffic through.

That is a badly built or badly set up router rather than the usual one, and it is nothing to do with the board, which asks from inside your network the way every router expects. It is worth knowing because it is the one thing on this page you cannot check from the board and cannot fix with a setting on it: it is your router's firmware. Keep that up to date. If you want it shut for certain, switching UPnP off in the router closes the whole thing, for the board and for everything else on your network, and plenty of people run that way on purpose.

What you take on by switching this on is on your own side of the router, and it is the part people repeat least. There is no password and no prompt. Any device on your network can ask the router for a forward and get one, and the router does not tell you it happened. A laptop with something nasty on it, or a cheap gadget that has not been updated since it was made, can open a port to itself by exactly the same route the board uses. That is the design and not a fault in any particular router: these protocols were written for a home network where everything on it was assumed to be trusted.

So the setting ships switched off, and leaving it off and forwarding the port by hand is a perfectly reasonable choice. Forwarding by hand costs you one more evening and it is an evening you are in charge of.

It will tell you when your ISP is in the way

The useful side effect: the router hands back its own outside address, and PORTMAP shows it. If that address is a private one, your router is not on the internet directly and no forward of any kind will ever work, by hand or otherwise. That is CGNAT or a double NAT, the thing most likely to waste your evening, and PORTMAP says NOT on the internet in those words rather than letting a working mapping look like a reachable board.

For somebody behind a carrier NAT that is the whole answer rather than a step on the way: there was never a setting to find. Switching the setting on to learn it costs nothing either, because a forward made on a router that is not itself on the internet reaches nobody: that is the same fact that makes the answer bad news. Set it back to no afterwards if you like.

If no router answers at all, the board cannot tell you this, because there is no reply to read the address out of.

If the router gives you a different number

A router that already has your port spoken for can give the board a different outside number instead. The board publishes the number it actually got, so your listing shows what callers should dial. Anyone you gave the old number to by hand needs the new one.

Two things that will stop it working

Before blaming the router, check these. Between them they account for most failures, and the second one cannot be fixed by any setting at all.

Both of these are a question about one number, your router's own outside address, and finding it usually means logging into the router. From firmware 1.2.2 the board can read it off the router for you: switch the setting above on, and PORTMAP shows the outside address the router handed back and says whether it is on the internet at all.

If it comes back NOT on the internet, you are behind one of the two above and that is your answer: there was never a router setting to find, and you have saved yourself the evening. Nothing of yours was exposed by asking, because a forward on a router that is not on the internet reaches nobody, and you can set the setting back to no.

Also worth knowing: these rules are IPv4 only on effectively all consumer routers. IPv6 is handled separately, usually as a firewall rule rather than a forward, because there is no address translation to undo.

The same port outside and in

A forward has two port numbers. The outside one, which routers also call the external port, is the one visitors connect to from the internet. The inside one, the internal port, is where the router sends them on the board. The simplest forward uses the same number for both, 6400 outside to 6400 on the board, and every router page below does it that way.

Some routers can do nothing else. They have one port box, not two, and send a call to the same number it arrived on. eero is one: its page says so. On a router like that, the number callers dial and the number the board listens on have to be the same.

One board per port

Your home has one address on the internet, and one outside port on it can go to one device and no more. So a second board behind the same router needs an outside port of its own: 6400 for the first board, say, and 6401 for the second. One board per port.

The way that works on every router is to give each board its own port to listen on, so every forward is the same number outside and in. From firmware 1.1.0 that is Port on the network page of CONFIG, used from the next restart.

So set the second board's Port to 6401, restart it, and forward 6401 to 6401 at that board's address. Callers on your own network dial it on 6401 as well.

A router that can send one outside number to a different number inside gives you the other way: leave both boards on 6400 and forward 6401 outside to 6400 on the second board. Then the second board has to tell the directory which number callers dial, which is Outside on the announce page of CONFIG: the port callers dial from the internet.

This directory lists one board per internet address by itself. A second board from the same address waits for the person who runs the directory to let it through.

A name that follows your address

Unless you pay your internet provider for a fixed address, the one your home has on the internet changes now and then. Anybody who wrote down the old numbers dials nothing.

Pick your router

Menu names move between firmware versions, and vendors rename things without warning. Where a vendor does not document something, these pages say so rather than guessing, because a confidently wrong menu path wastes more of your time than an honest gap.

A safer way to try it first

You do not have to open anything to run a board. On your own network it works immediately, and people on the same Wi-Fi can connect by address or by unleashed.local with a free app for joining. To let people outside reach it without opening a port, use a VPN into your own network or a tunnel from a machine you rent. Both work, and neither puts your address on a scanner's list.

Forward the port when you have decided you want a public board, not to find out whether the software works.