The default deny should take care of this, as you will only allow port 53 to a group of DNS servers. Whatever DNS solution you decide to use, hosts should use that and not be permitted to use another random internet DNS server. Should every host be using your internal DNS? Probably yes.Endpoints that are joined to an Active Directory domain have their own needed ports if they transverse the firewall.Don’t forget Active Directory ports when needed!.Definitely only allow that box to communicate directly to the internet and not the rest of your network!.Restricting to port 443 ensures that if something on the external service changes to a less secure protocol, that you’ll be able to plan accordingly and be aware of the change.Grouping the external finance services will allow that group to be used elsewhere if other desktops or groups may need specific access.Opening up only needed ports to only needed external websites and IP addresses makes it more difficult for these endpoints to be attacked. Financial systems and wire transfer endpoints are high value targets.Int-finance-desktops – outbound to 443 only to financial websites in the ext-finance-services group.When you want to ensure certain devices don’t have internet access, even if they are accidentally added to other groups. This group of IP addresses can be added to another group in a rule such as ‘Explicit-Deny’.They are accessed via port 1433 (MS-SQL) from the specific application that writes to it’s database.
Compile a list of the source IP, destination IP, and destination port and start to group them into categories for easier firewall rule creation. If you are replacing a firewall, you can create a span port or look at the old firewall logs to determine this. Monitor current traffic for which IP addresses and ports are used - and validate that they are needed not everything requires internet access. However, there are still ways to do these things securely! 1.
Is that technically tied to the business? Nope, but it’s something that you’ll definitely still need to open if you want to keep your job. Granted, there are times when the CEO might want to allow his staff to play WoW on the corporate network. This reduces your risk, gives you more control over your traffic, and limits your communication between networks. In general, you should follow the best practice of least privilege when configuring a firewall, which just means to block literally everything that you aren’t using for a dedicated and approved business function. Best Practices For Configuring Firewall Rules The order of the steps depends on whether you’re replacing hardware or spinning up a new environment from scratch. But which ports should you block? It’s a question that every sysadmin has asked themselves at one time or another.ĭepending on the environment, where firewalls are placed in the flow of data, and probably on your staffing and timeline, there are a good foundation of steps that you should complete when securing down new or existing firewall rules. A firewall won’t secure your environment like it should if you don’t properly configure its ports and policies.
0 kommentar(er)
