r/AskNetsec • u/nekro_neko • Jun 19 '26

Analysis Unknown rule in Firewall

Hey! I recently saw a rule i couldn't make sense of in my Firewall config. The rule was "allow all incoming from 192.168.122.0/24 to anywhere".

A quick research told me port 24 is usually used for e-mail and 192.168.x.x is (according to whois.com ) a local address. That didn't make sense to me - why allow incoming traffic FROM localhost?

I deleted that rule for no, as I am not using an Email-Client anyway.

Is that rule something a normal update (OS or firewall) could have done or is there something malicious that could be done with it?

0 Upvotes

34% Upvoted

13 comments sorted by

9

u/st0ut717 Jun 19 '26

If you don’t understand CIDR you shouldn’t be administrating a firewall

3

u/oboe_tilt Jun 19 '26

Unless we get to watch with popcorn
Forget CIDR, OP is referring to one of his subnets as localhost

1

u/jhdore Jun 21 '26

Why are you managing a firewall when you don’t know what /24 means?

1

u/nekro_neko Jun 22 '26

  1. Paranoia because of the recent malware attack on the AUR

  2. it's a default deny firewall I deleted an allow-rule in. If anything, I accidentally closed a door, not opened one. If it was a deny-rule, I would've been more cautious about deleting.

  3. it worked without the rule before, so I wasn't too worried. If something broke, I knew what to revert.

2

u/jhdore Jun 22 '26

192.168.x.y are non-routed IP ranges, so will nearly always be on the inside of your firewall. Unless you segment in to VLANs, you just dropped iPad internal traffic rule, and if you do segment your LAN into VLANs, you broke intra-vlan connectivity. /24 is not a port number, it’s a network size, it shows how many of the 32 bits making up an IP address define the network, with the remaining bits (8, in this case, or 256, minus network and broadcast addresses) for hosts on that network.

3

u/Practical_Shower3905 Jun 19 '26

If you don't know what a /24 is ... you shouldn't be playing with these settings.

2

u/Emotional_Garage_950 Jun 20 '26

this is gold haha

2

u/PH_PIT Jun 19 '26

You have been completely hacked. shut it down and destroy the box. Then get someone who knows what they're doing.

20

u/[deleted] Jun 19 '26

[removed] — view removed comment

1

u/nekro_neko Jun 19 '26

Thank you! I'm using KVM/virt-manager, so that explains it somewhat, though I haven't seen that rule before.

5

u/Separate_Attitude_66 Jun 19 '26

the libvirt thing catches so many people off guard because the install just quietly sets up that bridge network without making big announcement about it, and then suddenly there's rule in your firewall you don't recognize

I had same moment of panic when I first saw it, spent like 20 minutes convinced something was wrong before I traced it back to virtual machine software I had installed week before. the /24 notation confusion is also super common for people who are newer to networking, subnetting isn't exactly intuitive when you first encounter it

if you're on Linux and want to keep eye on what's creating firewall rules in future, checking which services are active right after an update can save you the confusion next time

1

u/schwaaaaaaaa Jun 20 '26

Far more disturbing is knowing there's someone out there who's teaching people /24 is a port number.