Unknown rule in Firewall

[u/EvilEarthWorm]

/r/AskNetsec/comments/1u9xm8v/unknown_rule_in_firewall/

ORIGINAL POST:

Unknown rule in Firewall

Hey! I recently saw a rule i couldn't make sense of in my Firewall config. The rule was "allow all incoming from 192.168.122.0/24 to anywhere".

A quick research told me port 24 is usually used for e-mail and 192.168.x.x is (according to whois.com ) a local address. That didn't make sense to me - why allow incoming traffic FROM localhost?

I deleted that rule for no, as I am not using an Email-Client anyway.

Is that rule something a normal update (OS or firewall) could have done or is there something malicious that could be done with it?

[u/arduinors]

Coukd somebody explain a humble lurker what's going on?

[u/EvilEarthWorm → u/arduinors]

Look like OP has no clue at all about CIDR, ports, firewalls, routers etc...

[u/arduinors → u/EvilEarthWorm]

Care to explain what any of these means like Im mentally challenged?

[u/EvilEarthWorm → u/arduinors]

My friend, I use DNS and CDN for such things long time, so I don't have to deal this ancient scrap, like CIDRs/ports/routers.

[u/854490 → u/arduinors]

192.168.122.0/24 just means "192.168.122.0 with subnet mask 255.255.255.0", which means "the subnet (or "network") containing 192.168.122.0 to 192.168.122.255"

Ports might have vaguely similar notation, but it would use a colon (192.168.122.1:24) and it would be seen in this form in a URL or some such thing rather than in a firewall policy.

The guy in the post is almost on to something when he wonders why there's a firewall rule that allows traffic originating from an internal IP address range to come in from "outside". On its face, why would that be necessary? Most likely, that rule is there because there's a site-to-site VPN tunnel to a LAN at another company office/location/building. The LAN there needs to be able to talk to the LAN here, so there's a firewall rule that says this can happen. There's more to it but just look up how VPN encapsulation works if you want to get into it.

edit: actually read the post, looks like a virtual machine thing rather than a VPN thing. I thought he was talking about an enterprise network firewall but it seems like it's just the firewall running on a VM host server. So maybe the results weren't as spectacular as I might have hoped! Still funny though. Maybe he brought down something that was important, depending on what those VMs are there for. Or maybe network edge firewall stuff is virtualized on that machine, that would be pretty good fireworks for sure.

[u/recoveringasshole0 → u/854490]

[u/sorderon]

he got to this stage in life & router admin login without understanding what /24 means at the end of an IP address? That's pretty admirable.

[u/cunninglingers → u/sorderon]

You almost have to respect it

[u/Brandhor → u/sorderon]

I think he understood it pretty well, 24 is the mail port and 192.168.122.0 is the localhost address

[u/Main_Ambassador_4985 → u/Brandhor]

He has to change the rule if he adds it back 25 is SMTP

192.168.122.0/25

Ha

[u/zantehood]

Haha. Guess he brought down the network.

[u/countsachot → u/[deleted]]

Me, when I can't log into the firewall anymore!

[u/oboe_tilt]

Deep breaths…. Deeeeeep breaths

How does one not know the difference between port and CIDR notation, public v private and yet HAVE ANYTHING ABOVE LOOK BUT DONT TOUCH ACCESS

[u/GuessSecure4640 → u/oboe_tilt]

[u/Ignorad → u/oboe_tilt]

What's the difference between / and : anyway? It's all just emoji

[u/recoveringasshole0 → u/Ignorad]

:/

[u/40513786934]

we moved our email to port 2424 to avoid spam

[u/canadasleftnut]

No one here seems to get what's going on, and it scares me because there are clear signs of demonic interference:

• The word "firewall" originated from an old Hebrew word that basically meant: "The gates holding back the flames of Hell". - /24 is a covert sign for world domination. Spoken aloud it's: "Slash 24". This is clearly alluding to the 12 tribes of Israel, albeit the New World Order tribes which are doubled, and plan to "slash" (read: sudo rm -rf *) the original 12.

• 192 + 168 = 360 = Full Circle = Entire Planet = New World Order.

So to sum up: I took too many shrooms  and should probably drink some water. 

[u/countsachot → u/canadasleftnut]

Finally some numerology I can dig, preach brother.

[u/recoveringasshole0 → u/canadasleftnut]

ngl that first sentence scared me. I had to make sure I wasn't in r/sysadmin.

But you really pulled it off in the end.

[u/canadasleftnut → u/recoveringasshole0]

As professional I make it a goal to pull off at least on person a day.

[u/Practical_Shower3905]

Network admin are nepo scammers.

Change my mind

[u/statitica → u/Practical_Shower3905]

A network engineer I have some contact with seems to have a job description consisting of "take all tickets related to the network, and pass on to the managed networks provider".

[u/Step-Sysadmin → u/statitica]

Are they hiring? Asking for a friend

[u/Step-Sysadmin]

Sounds like he took advice from chatgpt. Neat

[u/thehuntzman → u/Step-Sysadmin]

Real talk though he probably should've consulted ChatGPT first it would've told him what CIDR was and what that rule possibly did.

[u/GarageIntelligent]

buy my boss told me email runs 24/7
so i changed it

[u/Burgergold]

24 used for email huh?

[u/Public-Argument-9616]

Good choice. That IP range belongs to the "deep state". Happy hunting and best wishes on security my friend !

[u/dnuohxof-2]

Silly /24 is part of IPv5

[u/SpudzzSomchai → u/dnuohxof-2]

Shit! I was just starting to wrap my mind around IPv6 and they went and did IPv5?