0

I have set up my small network using Cisco ISR C1111-8p and a Cisco Wireless AP C1832i.

  • What can I use to block all the ports of the WAN?

  • Is there any security advantage blocking them rather than letting them as it? I want to block them more for security habits on my servers/AWS than real necessity.

With Linux I'd use iptables/firewalld; with AWS I'd use ingress Security Group to open specific ports.

  1. Since I'm using NAT, ports are already all closed because there is no port forwarding rule.

  2. ACLs are stateless

    • Using an extended ACL rule in ingress of my WAN port ge0/0/0, blocking all the ports coming from any host blocks also all the replies from internally initiated connections.

I've tested to ping a port that doesn't have port forwaring rule, a RST TCP packet is received. Isn't a security threat? I'd like to avoid replying.

  • 1
    You have multiple ways to handle this. You can use reflexive Access lists. This works great for LAN clients, but it has problems for traffic originating from the router (SSH,DNS,NTP...). Next up is ip inspect (CBAC). This works great for both LAN clients and router originating traffic. Next, there is Zone Based Firewall (ZBF). This has even better recognition for port shifting protocols (like FTP) and you can manage traffic differently, depending on what interface it goes out. But ZBF is very configuraion heavy. Let me know what you wanna go for and i can post an example configuration. – Mario Jost May 14 '19 at 11:13
  • I knew ZBF but thought I needed a firewall device. I let you choose the easiest solution. I just wanna block ports from outside and open some of them later. But is there any security advantage blocking all ports rather than letting them as it? – Alexis May 14 '19 at 11:48
  • A way the AWS' security groups work would be perfect! Dropping everything initiated from outside but specified IP/port pairs. – Alexis May 14 '19 at 11:57
  • Wouldn't CBAC be more for protocol filter rather than ports? – Alexis May 14 '19 at 12:05
  • 1
    Lots of Cisco Routers support ZBF nowadays. You can use CBAC to inpsect just certain protocols, but it can be used to include the most common and allow a "statefull" firewall feature. We used it for years whitout issues before we switched to ZBF because the ISR4000 Router don't support CBAC anymore. – Mario Jost May 14 '19 at 12:14
3

So i recommend using IP inspect. This is a fairly new'ish configuration (compared to reclexive ACLs) and is very lightweight compared to ZBF. So you create a ACL where you want to allow everything coming from the WAN without a connection beeing initiated from the LAN first. Example could be connection via SSH from outside.

ip access-list extended ALLOWFROMWAN
 remark permit SSH Access from main office
 permit tcp host 1.1.1.1 any eq 22
 remark deny everything else
 deny   ip any any

Then, we create CBAC rules to state, what traffic we want to inspect. usually these 3 protocols cover more than 99% of all traffic. we include router originating traffic to allow DNS lookups, NTP synch or simple ping tests.

ip inspect name WAN tcp router-traffic
ip inspect name WAN udp router-traffic
ip inspect name WAN icmp router-traffic

Then, we assign this to the WAN interface along the ACL. The inspect makes sure, that returning traffic can pass the ACL and is not blocked by the deny ip any any.

interface Dialer1
ip access-group ALLOWFROMWAN in
ip inspect WAN out

Now you can see the the people surfing with the command

show ip inspect sessions

A thing to keep in mind: ZBF uses more ressources than CBAC. We did some performance tests a while back with a Cisco 892FSP Router on a Gigabit WAN link and these were the results:

Config     Download        Upload
ZBF       180Mbit/s     173Mbit/s
CBAC      206Mbit/s     196Mbit/s

So I would go for ZBF only if you have beefy enough devices.

| improve this answer | |
  • Perfect, I'm gonna try! But doing so, is there any security benefit to block everything from outside if there is nothing listening on the ports? – Alexis May 15 '19 at 0:15
  • Well I guess that SSH or Telnet is always listening on all IPs on a device. Not sure if you can disable that somehow. I know you can put an ACL on a VTY line, though. But I guess it doesnt matter if you put it on the WAN port or the VTY line. – Mario Jost May 16 '19 at 7:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.