That you have some ACLs that whack low-hanging fruit doesn't negate the fact that you can't block the untrusted Internet accessing an intentionally publicly accessible port. It's all just a distraction from the fact that *SOME* services *MUST* remain available to the general public and those services are subject to abuse. As long as there are things that must be available to the general public (likely forever), there needs to be an abuse reporting process that works. ----- Mike Hammett Intelligent Computing Solutions http://www.ics-il.com Midwest-IX http://www.midwest-ix.com ----- Original Message ----- From: "Stephen Satchell" <list@satchell.net> To: nanog@nanog.org Sent: Wednesday, April 29, 2020 12:35:20 PM Subject: Re: Abuse Desks On 4/29/20 9:57 AM, Mike Hammett wrote:
My routers have ACLs, but my servers for the most part do not.
I'm not trying to argue, but...what servers do you have that don't have sysadmin-definable firewalls and tun-able knobs? My edge routers are Linux boxes (CentOS 8 for the one I'm now building). Moreover, I can have NetworkManager fire off a script that modifies the firewall settings as interfaces go up and down.
It's kind of counter productive to put ACLs on SMTP, POP3, IMAP, and HTTP\S ports, now isn't it? SIP, FTP, and SSH may or may not make sense, depending on the type and volume of users. I was taught by my networking betters that you need to block certain types of public inbound packets, always, that match any of:
1. WAN packets with local/LAN source address 2. WAN packets with local/LAN broadcast/net src-dst address 3. WAN packets with known broadcast/net src-dst address 4. WAN packets with local/LAN small services 5. WAN packets with local/LAN unimplemented services 6. WAN packets with blackholed source address On EVERY device with a public IP address. WITHOUT FAIL. I have these blocks on every single public-facing mail server I build. I have these blocks on every single public-facing Web server I build. Indeed, I can't fathom why I would *not* have these in place for every single public-facing device. I don't necessarily log every occurance, but I do drop matching packets on the floor, unceremoniously. This is the foundation upon which I build custom additions, such as allowing 22/tcp only from specific IP addresses. I don't depend on the edge router to catch all the cases, because each server has specific services it provides. So, for example, my DNS servers not only implement all six basics, but also incorporates request rate limiting, to avoid participating in DDOS events. Ditto NTP servers. 80/tcp and 443/tcp? Dropped on the floor. Sorry to preach, but I'm in the process of building a NFTABLE-based firewall and this happens to be part of the specs for it.