11–16 of 16 posts
Earlier quoted context omitted.
> Any inbound scan or malicious traffic would get dropped going outbound There are lots of types of maliciousness that would not be affected by this.
True. I was thinking exfil and communication. Of course fuzzing/DoS is doable.
I would think that a network that even has a physical path capable of bypassing a firewall would be considered broken by design... Or at least insecure.
That said, a proper firewall implementation would only allow traffic back to a source port that is in the routing table as having an established connection. But that’s a stateful firewall (vs. stateless) and comes with its own set of complexities.
>Later, when I realized that inbound traffic was bypassing the firewall, I notified UC Berkeley’s Information Security Office of the potential security vulnerability, but their response was somewhat lacking in urgency. So we’ll see. If I were on their infosec team I wouldn't ignore it, but also, infosec and network often different silos. If network was already notified, infosec can't do much but complain. And, it see…
I would think that a network that even has a physical path capable of bypassing a firewall would be considered broken by design... Or at least insecure.
You can configure a router to not use a path, even though that path physically exists.
Glad you found out. Good job ! Also usually firewalls are not decreasing packets IP TTL which make them invisble to traceroute. You are lucky this one does not.
I would think that a network that even has a physical path capable of bypassing a firewall would be considered broken by design... Or at least insecure.
Networks change all the time. You don’t want to rerun cable everyday. You can configure a router to not use a path, even though that path physically exists.