NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Administration service access from DMZ interface (Telnet; HTTP; HTTPS)
Hello;
I am using the DMZ interface For my Web server.
I would like to know if there any possibility to disable the telnet , http and https port which are used to manage the SRX5308 firewall. Such services should be not accessible from the DMZ interface in case one host being compromised.
Note : I am not talking about disabling user authentication; but really disabling the opened port (23,80,443) from the DMZ interface.
System Name: SRX5308
Firmware Version: 4.3.1-22
Kind regards
David
I am using the DMZ interface For my Web server.
I would like to know if there any possibility to disable the telnet , http and https port which are used to manage the SRX5308 firewall. Such services should be not accessible from the DMZ interface in case one host being compromised.
Note : I am not talking about disabling user authentication; but really disabling the opened port (23,80,443) from the DMZ interface.
System Name: SRX5308
Firmware Version: 4.3.1-22
Kind regards
David
3 Replies
- Do you have remote management enabled? Have you restricted the management interface to a single network? Are you running different network ranges on the LAN & the DMZ? I would find it quite strange if it were not possible to block access from the DMZ network range to whichever ports you choose.
- Hello Fordem,
First of all thanks for your reply.
Do you have remote management enabled? ->NO
Have you restricted the management interface to a single network? -> See my comment below
Are you running different network ranges on the LAN & the DMZ? -> Yes , 192.168.1.1 and 192.168.10.1
Comment : The main problem is about having a compromised web server under the DMZ zone. If this one is compromised; the hacker could potentially try to access the Telnet port from the Firewall FROM the INSIDE DMZ network. This is what I would like to forbid. My question is : is there any way to disable/block such port 23 from the inside DMZ ? - If remote management is disabled I would like to think that the router's LAN interface would/should not be accessible from the DMZ - although I must admit I have not tested this personally. If this is not what you are seeing - I would consider it as perhaps a flaw or oversight in the firmware and suggest you open a ticket at my.netgear.com and have it escalated so that it can be corrected. I would also like to think that you can create a rule in the DMZ-LAN rules that would block any service/port you chose, but again I have not tested this.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
