I recently talked with my ISP about many things, basically related to my (little) company security, this guy is a networking guru to me, but he did a strange thing that worries me. Basically I have a web development machine located in my LAN, that has no port forwarding (is not reachable from internet), but he could access a web server on it from outside of router's WAN interface somehow and wouldn't tell me how he did it. He just says it's normal for him, being my provider, to be able to port scan and access my computer's services (wtf?!?). He also said that there should be some rule I should add to my routing table that should prevent it, but he "doesn't remember" it's contents. Obviously guy likes to pry into others' matters, and while we're kind of buddies, I REALLY don't like it.
I have an old linux router-in-a-box there, based on iptables 1.2-something, and here are it's scripts (I cut out any port forwarding and deny rules for brevity). These were standard ones.
Chain INPUT (policy ACCEPT) num target prot opt source destination 1 DROP tcp -- anywhere anywhere tcp Chain FORWARD (policy DROP) num target prot opt source destination 1 TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU //here follows a bunch of port forwarding rules and DENY rules I set, //and line 60 looks kind of out of place, given line 61 60 ACCEPT all -- anywhere anywhere 61 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED Chain OUTPUT (policy ACCEPT) num target prot opt source destination
So the question is threefold:
- how an ISP could have accessed port 80 on my machine without me forwarding it on the router?
- how can I prevent him or anyone else in that network from doing that
- please explain why there's line 60 and after it there's line 61, because from what I understand, if anything is allowed at line 60 then packets would already be allowed to pass without even reaching line 61
This is my setup, I think it's pretty standard:
ISP network -> their WiFi bridge -> Our router -> Our Network (with my DEV machine)
ISP should only be able to portscan our router. All they gave me was a plug to their WiFi bridge that's on our roof and an IP, router was bought separately.