1

I don't remember seeing this policy since it seems to me like an "all ports open" kind of thing. It is set default "tcp:0(any) - udp:0(any)" If I disable this, even web traffic wouldn't work although I specifically have the HTTP-proxy policy enabled... Is this normal? Abnormal? What is the best practice? I'm dealing with trying to find crpytolocker virus which led me to this...

2
  • 1
    What does the rest of the rule say? Any port, but from where and to where?
    – Grant
    Jun 8, 2014 at 3:51
  • Ok, it is any port, From 'Any-Trusted' To 'Any-External' I suppose this is outgoing only.
    – Seth
    Jun 8, 2014 at 4:50

1 Answer 1

0

This rule allows any outgoing traffic, and conversations started by an internal machine. It is fairly common to setup such a rule. I think most of the watchguard models have that rule by default.

With just rule enabled, computers on the Trusted side can open any connection they want. Computers on the External side can reply, but can't initiate a connection.

My guess is that although you have a HTTP proxy policy (which should be From 'Any-Trusted' to 'Any-External'), you don't have rules for DNS traffic - no DNS resolution, so no web traffic.

Best practice is to block everything, then allow the traffic you want. At a minimum for a typical office network, this would be HTTP and HTTPS traffic (optionally through a proxy), DNS (at least for your internal DNS server to connect to the outside world), and email traffic (SMTP, POP3, IMAP, etc...depends on what you use, and might only be allows for your internal email server to connect directly to the outside world).

However, maintaining this can be frustrating. People want to use Adobe whatever for video conferencing, and a contractor needs to access their website on a non-default port, etc. So some people opt to allow all outgoing connections, and worry about filtering what is coming in. Either way can be acceptable, depending on how secure you need to be, how much you trust the Trusted side of the network, and how much time and effort you can devote to maintaining the firewall rules.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .