How to mitigate the threat of the security incident
- Change the admin-type accounts' password
- If you allow traffic from Internet to your device with WebGUI and SSL VPN tunnel, you can follow these steps to protect your device.
1. Add IP address object(s) to trusted addresses or trusted countries. Configuration > Object > Address/GeoIP
2. Allow trusted IP addresses and Deny others traffic from Internet Configuration > Security Policy > Policy Control
Rule #1. You can allow trusted IP addresses and WebGUI/SSL service ports from WAN side for access.
Rule #2. Deny other IP addresses that you do not trust to access your WebGUI.
3. Change HTTPS connection port from the default 443 to another port (without conflicting with other services) and make sure that this port is added in policy control rule #1. Configuration > System > WWW. Change HTTPS connection port. e.g 17443
After changing HTTPS Service port, you must reconnect to your device using the new port. If you would like to use SSL VPN tunnel to access your device, make sure that the public IP address of your PC is added in your Trusted IP List. While connecting to your device, make sure to enter the correct port in SecuExtender.
- If there is no WebGUI/SSL VPN tunnel required, you can move the default rule (WAN_to_Device) as the first rule and keep the last rule as “deny”.
(Allowed services are for IPSec VPN/VRRP/GRE)
Make sure there is no HTTP/HTTPS WebGUI service port in service group.
Categories
- All Categories
- 415 Beta Program
- 2.3K Nebula
- 141 Nebula Ideas
- 94 Nebula Status and Incidents
- 5.6K Security
- 218 USG FLEX H Series
- 264 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 1K Wireless
- 39 Wireless Ideas
- 6.3K Consumer Product
- 244 Service & License
- 383 News and Release
- 81 Security Advisories
- 27 Education Center
- 8 [Campaign] Zyxel Network Detective
- 3.1K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 84 About Community
- 71 Security Highlight