SSL VPN vulnerability of June 24th, 2021

BobHere

ChipConnJohn said:

For my part, I haven’t been able to make sense of the vulnerability given what Zyxel is telling us. I have locked down WAN->Device allowing only IPs I specify to access. It hasn’t been too bad. I sent an email last week apologizing and directing users to a site that gives their wan ip and they email or text it to me and I add it to the device. 

Denying WAN to Zywall source = All should stop any of the attacks right? no need to really change any ports? it looks like all services are tied to the WAN object by default

For the current models that support FQDN - I'm having my users create DDNS (lots of free ones out there), and they can manually update that FQDN if their ISP changes.  Then on our end trust the FQDN.  Optionally, if you pay for those DDNS services, add all of those FQDN as trust and you can update those when users change IPs, this way, won't have to keep adding more rules to the security policy.