0

I want to limit access from the Internet to my Web server but the clients will have a dynamic IP address so the best I can do is to whitelist all addresses belonging to that specific mobile carrier which still leaves the system open to too many users.

Functionality can be denied by use of a reverse proxy (I'm using HAProxy on pfSense) so that if the request doesn't match an ACL, it gets rejected. This still lets the attacker communicate with HAProxy end eventually exploit a vulnerability.

I know I can configure HAProxy to not provide a HTTP error code in case of failure, but is this enough?

From my understanding the proxy's TCP port would still be open to everyone. Portscan systems would not get an HTTP code back but at transport level they would see an open port, am I right?

What else can I do, considering that pfSense does not natively support deep packet inspection?

Can ntop, Snort or Suricata help?

My goal is to not show an open port to port scans from the Internet, is this achievable without IP filtering?

6
  • "My goal is to not show an open port to port scans from the Internet," - it is unclear why you have this goal in the first place, because an open port by itself does not mean that system can be hacked. But depending on the control you have about the clients you could use port knocking to make the port invisible until a client explicitly enables access. Jan 10 at 12:10
  • Why not use a technology such as a VPN to limit access if your web app is deemed to insecure to host on the public internet?
    – vidarlo
    Jan 10 at 12:31
  • @SteffenUllrich an open port is an attack vector. the server in question is an asset tracking server, I only need my phone my car and my bike to report. no one else needs to find that service
    – mfloris
    Jan 10 at 13:18
  • @vidarlo the clients are proprietary gps trackers, they can't use a VPN or a client certificate
    – mfloris
    Jan 10 at 13:19
  • But you have a device that can run HAProxy? Can you describe the details of your problem a bit more in detail, preferably including a topology?
    – vidarlo
    Jan 10 at 13:28

1 Answer 1

1

My goal is to not show an open port to port scans from the Internet, is this achievable without IP filtering?

Based on your question you want your service be visible for these clients but totally hidden for anybody else, i.e. port should not be open to anybody but the good clients.

... the clients are proprietary gps trackers, they can't use a VPN or a client certificate

Based on this comment there is no way to identify the client before they access the port, i.e. they don't have a fixed IP address and you cannot implement some kind of out of band authentication like port knocking to make the port visible only for the specific authenticated client.

This essentially means that there is no way for your system to distinguish between a good client and a bad one without the client actually connecting to your system - which requires the port being open.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .