NSG Exposing Unintended Internal Ports to the Internet
![Daniel_PDX](https://us.v-cdn.net/6029482/uploads/defaultavatar/nN4PAQRO7TCNP.jpg)
![](https://www.zyxel.com/library/assets/zyxel-forum/freshman_member.png)
![First Anniversary](https://us.v-cdn.net/6029482/uploads/badges/SJKCAIG91R5S.png)
NSGs rely on NAT for inbound firewall rules. However NAT (Virtual Server) rules don't allow you select which protocal type you wan to use. For example: If I want to open TCP 443 only I can't do that with NSG. It opens UDP and TCP 443 (at least from what I can tell).
Please add the ability to select protocol type as part of the NAT rules. The absence of this feature is exposing internal surface area that doesn't need to be exposed to the internet.
Additionally, this will result in remediation flags for companies who have penetration tests run. The only problem... it can't be remeadiated in with currently NSG settings without disabling the whole rule.
Happy to clarify if needed.
Comments
-
Hi Daniel, Welcome to our Nebula Community!
I have good news, the ability to select protocol (TCP/UPD/Any) for Virtual server rules will be added in the coming release by the end of this month, so it's a matter of time only ?
Thanks for your valuable input! ?
0 -
Hi @Daniel_PDX
Just to update you, the new Nebula interface already supports the selection of TCP/UDP protocols in the Virtual server rules.
Feel free to check it out ?.
0
Categories
- All Categories
- 414 Beta Program
- 2.2K Nebula
- 130 Nebula Ideas
- 88 Nebula Status and Incidents
- 5.4K Security
- 166 USG FLEX H Series
- 255 Security Ideas
- 1.4K Switch
- 71 Switch Ideas
- 999 Wireless
- 36 Wireless Ideas
- 6.2K Consumer Product
- 233 Service & License
- 370 News and Release
- 77 Security Advisories
- 24 Education Center
- 5 [Campaign] Zyxel Network Detective
- 2.9K FAQ
- 34 Documents
- 34 Nebula Monthly Express
- 80 About Community
- 69 Security Highlight