5 ms·

It seems that it might be more appropriate to simply have your default firewall rule be to drop incoming traffic, and to then open only those ports you need. I

by ckuehl 12y ago

It seems that it might be more appropriate to simply have your default firewall rule be to drop incoming traffic, and to then open only those ports you need. If you're using a port whitelist (rather than blacklist), the problem the author identifies shouldn't really exist.

keeperofdakeys 12y ago
Imagine the case where you have an iptables rule for mysql, but don't currently have it running. This is the case that the author is referring to, whether or not it's a blacklist or whitelist. The trick is getting the iptables response on drop/reject, and the OS response to no listening program to be the same.
- ckuehl 12y ago
  The author is referring to the case where you use a blacklist to drop traffic to certain ports. Dropping traffic looks different than responding with a RST, which distinguishes that port (since all the others respond with an RST). But, if you instead have a default policy of "drop all incoming traffic", then it doesn't look weird that traffic to port 3306 is dropped, since traffic to all other ports is also dropped. More importantly, you also get the security benefit of using a whitelist rather than a blacklist.
zrm 12y ago
The trouble with everyone using whitelists is that the ecosystem responds to it. Widespread use of default deny causes new applications to be tunneled over HTTP[S] or ssh instead of using their own ports, which is in effect just default allow minus the ability to differentiate applications based on their ports.
- zokier 12y ago
  In what sort of world default DROP is not a widespread practice? Quickly googling, eg both Ubuntu and CentOS wikis advice for default drop, as do lot of other guides. https://help.ubuntu.com/community/IptablesHowTo#Blocking_Traffic https://help.ubuntu.com/community/IptablesHowTo#Blocking_Tra... http://wiki.centos.org/HowTos/Network/IPTables#head-724ed81dbcd2b82b5fd3f648142796f3ce60c730 http://wiki.centos.org/HowTos/Network/IPTables#head-724ed81d...
  - zrm 12y ago
    > In what sort of world default DROP is not a widespread practice? That's the problem. Instead of asking why you're running services you don't really want to be running, just kill anything you don't understand. It's like over-prescribing antibiotics. You grow a new crop of firewall-resistant services and then the firewall doesn't work when you really need it to.

by ckuehl 12y ago

keeperofdakeys 12y ago

Imagine the case where you have an iptables rule for mysql, but don't currently have it running. This is the case that the author is referring to, whether or not it's a blacklist or whitelist. The trick is getting the iptables response on drop/reject, and the OS response to no listening program to be the same.

ckuehl 12y ago
The author is referring to the case where you use a blacklist to drop traffic to certain ports. Dropping traffic looks different than responding with a RST, which distinguishes that port (since all the others respond with an RST). But, if you instead have a default policy of "drop all incoming traffic", then it doesn't look weird that traffic to port 3306 is dropped, since traffic to all other ports is also dropped. More importantly, you also get the security benefit of using a whitelist rather than a blacklist.

zrm 12y ago

The trouble with everyone using whitelists is that the ecosystem responds to it. Widespread use of default deny causes new applications to be tunneled over HTTP[S] or ssh instead of using their own ports, which is in effect just default allow minus the ability to differentiate applications based on their ports.

zokier 12y ago
In what sort of world default DROP is not a widespread practice? Quickly googling, eg both Ubuntu and CentOS wikis advice for default drop, as do lot of other guides. https://help.ubuntu.com/community/IptablesHowTo#Blocking_Traffic https://help.ubuntu.com/community/IptablesHowTo#Blocking_Tra... http://wiki.centos.org/HowTos/Network/IPTables#head-724ed81dbcd2b82b5fd3f648142796f3ce60c730 http://wiki.centos.org/HowTos/Network/IPTables#head-724ed81d...
- zrm 12y ago
  > In what sort of world default DROP is not a widespread practice? That's the problem. Instead of asking why you're running services you don't really want to be running, just kill anything you don't understand. It's like over-prescribing antibiotics. You grow a new crop of firewall-resistant services and then the firewall doesn't work when you really need it to.