3 ms·

I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive fir

I hear this and I'm always curious how this happens. The Linux distributions I've used, the home routers I've encountered, etc, all default to a restrictive firewall that only needs to be changed if you want stuff allowed through.

withinboredom 5y ago
The thing is, once you start to do any complicated firewall setup where defaults can no longer be restrictive, you are bound to screw it up at some point.
- mentat 5y ago
  What kind of firewall work didn't have default drop? Once you take that off the table you really do have a problem but I've only seen that one in 20 years of professional work.
  - withinboredom 5y ago
    I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.
    - X-Istence 5y ago
      Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear. At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.
      - withinboredom 5y ago
        My consumer router has vlan support…
nunez 5y ago
Yeah, incorrect firewall rules are a HUGE problem at super large companies that aren't doing infra-as-code at scale yet. Sysadmins/server engineering/DevOps/SRE, Networks, and Security are usually hard silos at big companies. "DevOps" gets a request from an app team to open a port between subnet A and subnet B. DevOps asks Networks to do it. Security needs to approve it before Networks can do it (usually). A cohort of VPs somewhere need to approve it if those subnets are "production" (i.e. subject to serious fines if the data therein fails audit). Networks outsources the request to their global services team in India/Phillippines/China/Brazil since it's literally a single command, but they are done in bulk. These changes are only done afterhours, partly because of outsourcing latency, partly because of regulations. The firewall person types in the wrong port. Emergency change request gets filed to fix. Fixed in 1-3 days after the CTO/CIO and some SVPs approve it (and maybe yells at people for wasting their time). The requester asks for the wrong port. Too bad, so sad, you're waiting another week. The app team asked for the wrong port. Same outcome as the DevOps person.

withinboredom 5y ago

The thing is, once you start to do any complicated firewall setup where defaults can no longer be restrictive, you are bound to screw it up at some point.

mentat 5y ago
What kind of firewall work didn't have default drop? Once you take that off the table you really do have a problem but I've only seen that one in 20 years of professional work.
- withinboredom 5y ago
  I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.
  - X-Istence 5y ago
    Once you are working with VLAN's you are out of the bailiwick of consumer hardware, and you should be looking at more enterprise grade gear. At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.
    - withinboredom 5y ago
      My consumer router has vlan support…

nunez 5y ago

Yeah, incorrect firewall rules are a HUGE problem at super large companies that aren't doing infra-as-code at scale yet. Sysadmins/server engineering/DevOps/SRE, Networks, and Security are usually hard silos at big companies. "DevOps" gets a request from an app team to open a port between subnet A and subnet B. DevOps asks Networks to do it. Security needs to approve it before Networks can do it (usually). A cohort of VPs somewhere need to approve it if those subnets are "production" (i.e. subject to serious fines if the data therein fails audit). Networks outsources the request to their global services team in India/Phillippines/China/Brazil since it's literally a single command, but they are done in bulk. These changes are only done afterhours, partly because of outsourcing latency, partly because of regulations. The firewall person types in the wrong port. Emergency change request gets filed to fix. Fixed in 1-3 days after the CTO/CIO and some SVPs approve it (and maybe yells at people for wasting their time). The requester asks for the wrong port. Too bad, so sad, you're waiting another week. The app team asked for the wrong port. Same outcome as the DevOps person.