USG LITE 60AX ignoring explicit deny firewall rule when a nat rule is active

Options
SistemistaDaRidere
SistemistaDaRidere Posts: 16 image  Freshman Member
First Comment Friend Collector Fifth Anniversary
in Security

Please tell me i'm wrong.

Just noticed that if i set up a nat rule, and leave "allow remote ip" to "any", it just open up that port for any source address despite "explicit deny" rule in packet filter firewall. Also, "allow remote ip" field in the NAT rule can't be anything but a single host. You can't even put a subnet in it. I feel very uncomfortable knowing that my rdp has been wide open for days.

I really hope this is a bug and not a legit behaviour.

Accepted Solution

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,486 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    Answer ✓

    Hi @SistemistaDaRidere ,

    This is expected behavior not only on the USG LITE 60AX, but also on other Nebula mode firewalls.

    When a NAT rule is configured, the device will automatically create a firewall rule to allow the specified port and source IP. This rule takes higher priority than any explicit deny rule.

    Regarding the Allow Remote IP field, we are currently evaluating support for input as a subnet or an IP range.

    Zyxel_Judy

All Replies

  • PeterUK
    PeterUK Posts: 4,493 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    The NAT rule is what traffic that rule would apply for but the firewall rule locks it down more.

    so if you have a firewall limiting remote/source then a port scan will be blocked  

  • SistemistaDaRidere
    SistemistaDaRidere Posts: 16 image  Freshman Member
    First Comment Friend Collector Fifth Anniversary
    https://community.zyxel.com/en/discussion/comment/84808#Comment_84808

    i agree with you, that's how it should behave but It does NOT.

    You have this "implicit deny rule" at the end of the chain that should do it.

    image.png

    I had to rewrite it (the deny rule) at the end of my custom rules to make it work. You can try it yoursef, set up a nat rule for everyone without opening the same service in firewall and see if it get exposed or not.

  • PeterUK
    PeterUK Posts: 4,493 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited April 29

    don't have a USG LITE so can't test

    I'm not sure how the the USG LITE does it firewall differently to USG models

    The USG LITE models seem to not be that good I think when Zyxel did the cut down of VPN models like VPN300 was a better way.

  • Zyxel_Judy
    Zyxel_Judy Posts: 2,486 image  Zyxel Employee
    Zyxel Certified Network Engineer Level 2 - Nebula Zyxel Certified Network Engineer Level 2 - Switch Zyxel Certified Network Engineer Level 2 - Security Zyxel Certified Network Engineer Level 1 - Nebula
    Answer ✓

    Hi @SistemistaDaRidere ,

    This is expected behavior not only on the USG LITE 60AX, but also on other Nebula mode firewalls.

    When a NAT rule is configured, the device will automatically create a firewall rule to allow the specified port and source IP. This rule takes higher priority than any explicit deny rule.

    Regarding the Allow Remote IP field, we are currently evaluating support for input as a subnet or an IP range.

    Zyxel_Judy

  • SistemistaDaRidere
    SistemistaDaRidere Posts: 16 image  Freshman Member
    First Comment Friend Collector Fifth Anniversary
    https://community.zyxel.com/en/discussion/comment/84867#Comment_84867

    @Zyxel_Judy

    thank you for your reply

    Just to let you know, the automatically created firewall rule is not visible in the list, also, if i rewrite a deny rule to lockout surce ip other than the expected ones, it takes priority over the nat rule.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）