16 ms·
Closing the port does not change anything about the attempts. Nor about the success rate of the attempts, if you aren't being an idiot with insecure passwords.
by fencepost 8y ago
Closing the port does not change anything about the attempts. Nor about the success rate of the attempts, if you aren't being an idiot with insecure passwords.
How about "No open port = no concern about possibly vulnerable services running on open ports"? I actually worry less about passwords and more about overflows, protocol problems and parse errors these days.
- zAy0LfpBZLC8mAC 8y agoYeah, sure, but (a) then those problems potentially also affect the VPN endpoint, so it's still a trade-off (b) much of the complex protocol machinery often is behind the authentication barrier, so the risk of just exposing the port to the public isn't necessarily that big, and (c) a firewall doesn't necessarily protect your vulnerable service, often there are browsers on the inside that an attacker could use to access those "protected" services. My point isn't that blocking off ports at the firewall is always pointless, but that it's usually a trade-off, and keeping a vulnerable service running behind the firewall can still be a risk, and many "hacking attempts" are just irrelevant if you follow general best security practices, so it's pointless to do anything specifically to prevent them.