2

I have a server that I want to restrict access to by allowing only one IP address to be able to connect to it through desktop and make http request through port 80.

Now in my firewall I only have World Wide Web Services (HTTPS Traffic-In), Remote Desktop - User Mode (TCP-In) and Remote Desktop - User Mode (UDP-In) rules enabled with scope of the IP that I want enabled.

Except there are a bunch of other Core Networking rules enabled in the firewall. Do these open rules pose a threat and should I apply the same IP restrictions to these rules too?

Can a hacker exploit these rules?

I'm assuming disabling these would interfere with updates, time management etc. but if they can be exploited I'm willing to compromise these.

2

More often than not, access should be restricted to the fullest extent possible. The decision as to how far to take steps needs to be based on an evaluation of willingness to accept risk, what the risks are and the value of what is being protected.

  • This does not really answer the question. What are the risks and what are the benefits? I would say, check for each of the core networking services if you need them. If not, then block the service, otherwise leave it unblocked. If you don't use ipv6, you can block all ipv6 related services. If you don't use DHCP, you can block DCHP. Some icmp services may proof to be necessary for a optimal network configuration. If you don't use a service, it may not be much of a risk either. For example, your server won't accept a rogue DHCP offer if it is not configured to use DHCP. – anneb Aug 25 '15 at 22:29
2

Some core networking may be necessary for proper network configuration. If you disable DHCP, you won't be able to get an ip from the DHCP server (but you prevent getting an ip from an unlikely but possible rogue DHCP server) If you disable ICMP fragmentation, your network may not be as fast as possible (but you prevent someone unlikely but possible to abuse this feature) If you want to use ipv6 you may need to allow some discovery services. If you want to use multicasting, you should allow multicasting related services If you disable ICMP services, you may not be able to discover optimal routes and diagnose problems You need teredo for ipv6 tunneling through ipv4 networks

1

I'm not sure how these networking rules can be exploit, unless they are given direct access to the server.

But if you are concern over the access rights, you could: 1. Setup a host-based security system 2. Setup event logs monitoring 3. Setup Alerts rules (e.g unauthorized attempt connection)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.