Good GUI Port Numbers
-
Hello fellow Netgate community members,
I wanted to check do you think port 8080 is a bad idea for a GUI port over https?
Remember security by way of obscurity would want something outside of the normal port scanners, so a random, uncommon port in the private/dynamic range (49152 to 65535)
Also port 8080 and 8443 are well known and 8888 31337 are used by default application stacks.
-
Why limit yourself to a port number ? Scanning through 65535 ports is peanuts, as we've left 10 Mbit/sec half duplex ages ago. Your 8080 would be found in fraction of a second.
Here mine :
[2a01:cb19:64a1:7ce:92ec:77ff:fe29:392c]::443 and I blocked GUI IPv4 access.
Now let a scanner find that one ^^( Just for the record : that IPv6 isn't really hidden neither, as it's my pfSense LAN gateway/DNS )
Port 443 on the pfSense should be bound to nginx, the pfSense GUI web server. No other web server should be used on the GUI. Another process == another potential security issue.
Port 8080 shouldn't be 'http' , but https. Plain http is something of the past.edit : wait : Nexus is using 8080 ?
Imho, remember : have a fire wall, so way better :
Make GUI access possible accessible on a trusted LAN. You could limit the access to one IP.
From then on, be ware that System > Advanced > Admin Access / Login protection works for you : you could set it to 'one try', and then blocks the offending IP for a while.
And you could send a notification if an admin logged in (there is a one-liner somewhere here on the forum that shows how to do that).No "help me" PM's please. Use the forum, the community will thank you.
-
@Gertjan said in Good GUI Port Numbers:
You do understand that if I am on your network I will find that address very quickly with a few commands.
Same as the OP, if I am on the network I will scan all ports very quickly because I know the IP address is the gateway.The best solution is to limit what addresses, 4 or 6, that can talk to the the management port.
Much fun can be had with a Raspberry Pi disguised as a thermometer plugged into your network.
-
@AndyRH said in Good GUI Port Numbers:
You do understand that if I am on your network I will find that address very quickly with a few commands.
Sure.
Finding the gateway, or DNS, or DHCP server, is a one command step.
I should have been more clear : network info like ports or IPs can't (imho) be used to hide.
They can be used in firewall rules, and that brings the OP question one level lower : do you/me (the admin) trust your own admin device ? (and at the end, it will boil down to : do you (being the admin) trust yourself ? ^^) -
@Gertjan said in Good GUI Port Numbers:
I should have been more clear : network info like ports or IPs can't (imho) be used to hide.
We are in agreement. Those things only hide you from the ones that do not know enough to harm you.
-
@Gertjan but what about the hostname?
-
host names exists for humans so we, the humans, don't have to deal with IP addresses.
A router, firewall, etc can't work with host names.
That's where DNS comes in.
When we use a host name in a firewall rule, behind the curtains it will get 'translated' to an IP address first.Check you firewall rules your pfSense is using right now : open the /tmp/rules.debug file and have a look : you won't find a host name.
-
@Gertjan I can access my firewall like this custom_name.home.arpa:port number
It’s the name applied in advanced settings for the firewall. Yours doesn’t do that ? I do that because ipv4 or ipv6 can access it automagically depending on what the client requests.
-
@JonathanLee said in Good GUI Port Numbers:
It’s the name applied in advanced settings for the firewall. Yours doesn’t do that ?
I've my own rented domain name for my pfSense LAN networks.
I use this domain name, let's call it "my-own-company.net" mostly internally.
As this domain name does exist 'on the Internet', I rent it after all, I can easily about a (wild card) certificate. acme.sh using the most simple setup.
I also rent some data center based servers, and some of them do the domain name server (DNS) handling for all my domain names.
So, basically, no more DDNS hassle for me, as I became my own DDNS supplier. So i know where to find the admin if needed (its me).
My ISP gives me static WAN IPv4s, and semi static IPv6 prefixes, so live is fine, as if DNS goes down, I know my IPv4 ^^ (my IPv6 is a bit harder).
One pfSense to handle the ip/port NATting while IPv4 is still supported, and a simple firewall rule for IPv6, and done.
Privacy Policy · Cookie Policy