3 ms·

NAT sucks but is harder to misconfigure. I’ve never accidentally let something through NAT. But accidentally not configuring a firewall? Everyone does that an

NAT sucks but is harder to misconfigure. I’ve never accidentally let something through NAT. But accidentally not configuring a firewall? Everyone does that and has done that and will forever do it.

BenjiWiebe 5y ago
I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.
- withinboredom 5y ago
  The thing is, once you start to do any complicated firewall setup where defaults can no longer be restrictive, you are bound to screw it up at some point.
  - mentat 5y ago
    What kind of firewall work didn't have default drop? Once you take that off the table you really do have a problem but I've only seen that one in 20 years of professional work.
    - withinboredom 5y ago
      I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.
      - X-Istence 5y ago
        Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear. At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.
        withinboredom 5y ago
        My consumer router has vlan support…
- nunez 5y ago
  Yeah, incorrect firewall rules are a HUGE problem at super large companies that aren't doing infra-as-code at scale yet. Sysadmins/server engineering/DevOps/SRE, Networks, and Security are usually hard silos at big companies. "DevOps" gets a request from an app team to open a port between subnet A and subnet B. DevOps asks Networks to do it. Security needs to approve it before Networks can do it (usually). A cohort of VPs somewhere need to approve it if those subnets are "production" (i.e. subject to serious fines if the data therein fails audit). Networks outsources the request to their global services team in India/Phillippines/China/Brazil since it's literally a single command, but they are done in bulk. These changes are only done afterhours, partly because of outsourcing latency, partly because of regulations. The firewall person types in the wrong port. Emergency change request gets filed to fix. Fixed in 1-3 days after the CTO/CIO and some SVPs approve it (and maybe yells at people for wasting their time). The requester asks for the wrong port. Too bad, so sad, you're waiting another week. The app team asked for the wrong port. Same outcome as the DevOps person.
blibble 5y ago
there's plenty of instances of shitty applications setting up massive port forwarding rules using upnp
yakkers 5y ago
As far as consumer routers go, wouldn’t it be trivial to re-tool the usual port forwarding interface to simply accept connections to a specific address-port? That combined with a internal block-all-inbound rule would be quite hard for a user to footgun themselves horribly with. From a quick search, UPnP seems capable of automating this for user convenience, especially with stateless addressing.
Dagger2 5y ago
Are you sure you haven't? NAT in fact doesn't stop connections, so if you accidentally didn't configure the firewall then you won't be saved by NAT. Odds are that there weren't many people in a position to connect to you, and probably nobody actually did so, but it would certainly have been possible without a firewall in place.

NAT sucks but is harder to misconfigure. I’ve never accidentally let something through NAT. But accidentally not configuring a firewall? Everyone does that and has done that and will forever do it.

BenjiWiebe 5y ago

I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.

withinboredom 5y ago
The thing is, once you start to do any complicated firewall setup where defaults can no longer be restrictive, you are bound to screw it up at some point.
- mentat 5y ago
  What kind of firewall work didn't have default drop? Once you take that off the table you really do have a problem but I've only seen that one in 20 years of professional work.
  - withinboredom 5y ago
    I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.
    - X-Istence 5y ago
      Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear. At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.
      - withinboredom 5y ago
        My consumer router has vlan support…
nunez 5y ago
Yeah, incorrect firewall rules are a HUGE problem at super large companies that aren't doing infra-as-code at scale yet. Sysadmins/server engineering/DevOps/SRE, Networks, and Security are usually hard silos at big companies. "DevOps" gets a request from an app team to open a port between subnet A and subnet B. DevOps asks Networks to do it. Security needs to approve it before Networks can do it (usually). A cohort of VPs somewhere need to approve it if those subnets are "production" (i.e. subject to serious fines if the data therein fails audit). Networks outsources the request to their global services team in India/Phillippines/China/Brazil since it's literally a single command, but they are done in bulk. These changes are only done afterhours, partly because of outsourcing latency, partly because of regulations. The firewall person types in the wrong port. Emergency change request gets filed to fix. Fixed in 1-3 days after the CTO/CIO and some SVPs approve it (and maybe yells at people for wasting their time). The requester asks for the wrong port. Too bad, so sad, you're waiting another week. The app team asked for the wrong port. Same outcome as the DevOps person.

blibble 5y ago

there's plenty of instances of shitty applications setting up massive port forwarding rules using upnp

yakkers 5y ago

As far as consumer routers go, wouldn’t it be trivial to re-tool the usual port forwarding interface to simply accept connections to a specific address-port? That combined with a internal block-all-inbound rule would be quite hard for a user to footgun themselves horribly with. From a quick search, UPnP seems capable of automating this for user convenience, especially with stateless addressing.

Dagger2 5y ago

Are you sure you haven't? NAT in fact doesn't stop connections, so if you accidentally didn't configure the firewall then you won't be saved by NAT. Odds are that there weren't many people in a position to connect to you, and probably nobody actually did so, but it would certainly have been possible without a firewall in place.