4 ms·

Firewall is unreliable as well. What if someone temporarily disables it and exposes vulnerable services? What if RabbitMQ opens a new port that you forgot to bl

Firewall is unreliable as well. What if someone temporarily disables it and exposes vulnerable services? What if RabbitMQ opens a new port that you forgot to block in a firewall? Firewall is a hacky workaround, not a proper solution.

ozim 4y ago
I wonder what configuration you use - because by default firewalls usually block all incoming traffic unless you make rule to allow traffic or configure specifically to allow all incoming traffic - but with that setting you could just uninstall firewall or turn it off. I also have not seen RabbitMQ opening anything on my firewalls on installation or during the operation. There are some annoying applications that add firewall rules but RabbitMQ was not one. If someone is solving issues by disabling whole firewall, his access should be revoked immediately from anything related to infra. Firewall is a proper solution, learn how to use it properly instead of coming up with excuses.
- datavirtue 4y ago
  Winner!
- codedokode 4y ago
  > because by default firewalls usually block all incoming traffic In Debian by default all connections are allowed. And it makes sense: if you open a port, you probably want to be able to connect to it, otherwise why would you open it? It doesn't make sense if you open a port (to accept connections) and then block this port with a firewall. Of course this applies to cases when you have a single node, I understand that you might need firewall if you have several nodes.
  - ikiris 4y ago
    why even run a firewall at that point, clearly you put the box on the internet, you want to connect to it. /s
8organicbits 4y ago
Are you suggesting to bind to localhost in addition to a firewall, or are you anti-firewall? The firewall solution to a new/unexpected open port is a default deny rule. That's a commonly used best practice. There's nothing to forget.
- codedokode 4y ago
  > The firewall solution to a new/unexpected open port is a default deny rule. In case with a single node, it doesn't make sense. If you open a port, you probably want to be able to connect to it, otherwise why would you open it? And if you don't want anyone to connect, then don't open a port. There is no need for a firewall in case with a single node, unless you want custom rules like "only host A can connect to host B". There should not be "unexpected" open ports. Software should not open ports on external interfaces unless permitted by administrator. RabbitMQ should just have a switch to disable all unnecessary clustering features, but for some reason they don't want to implement it.

ozim 4y ago

I wonder what configuration you use - because by default firewalls usually block all incoming traffic unless you make rule to allow traffic or configure specifically to allow all incoming traffic - but with that setting you could just uninstall firewall or turn it off. I also have not seen RabbitMQ opening anything on my firewalls on installation or during the operation. There are some annoying applications that add firewall rules but RabbitMQ was not one. If someone is solving issues by disabling whole firewall, his access should be revoked immediately from anything related to infra. Firewall is a proper solution, learn how to use it properly instead of coming up with excuses.

datavirtue 4y ago
Winner!
codedokode 4y ago
> because by default firewalls usually block all incoming traffic In Debian by default all connections are allowed. And it makes sense: if you open a port, you probably want to be able to connect to it, otherwise why would you open it? It doesn't make sense if you open a port (to accept connections) and then block this port with a firewall. Of course this applies to cases when you have a single node, I understand that you might need firewall if you have several nodes.
- ikiris 4y ago
  why even run a firewall at that point, clearly you put the box on the internet, you want to connect to it. /s

8organicbits 4y ago

Are you suggesting to bind to localhost in addition to a firewall, or are you anti-firewall? The firewall solution to a new/unexpected open port is a default deny rule. That's a commonly used best practice. There's nothing to forget.

codedokode 4y ago
> The firewall solution to a new/unexpected open port is a default deny rule. In case with a single node, it doesn't make sense. If you open a port, you probably want to be able to connect to it, otherwise why would you open it? And if you don't want anyone to connect, then don't open a port. There is no need for a firewall in case with a single node, unless you want custom rules like "only host A can connect to host B". There should not be "unexpected" open ports. Software should not open ports on external interfaces unless permitted by administrator. RabbitMQ should just have a switch to disable all unnecessary clustering features, but for some reason they don't want to implement it.