My example XML from within the NIC configurations I setup on the host within QEMU/KVM (the bold line is what to add, with 16 being an example number of cores to utilize for that network interface):
*This article presumes you have IPv6 setup on your BGW-320, prefix delegation setup for your internal network using an internal firewall, or very simply a device setup on the AT&T provided network to open a port to.*
After recently receiving AT&T’s newer modem/router/firewall, the BGW-320 (at least newer than what I’ve had for many years) I struggled with how to open up IPv6 firewall rules to my internal servers and ports. I asked Gemeni and Grok and the same answer came back from users that it wasn’t really possible using this model router.
But after dinking around with the rules, turns out it is possible. First of all, I knew this much, but for others’ info, you don’t set it up in the normal NAT/Gaming area of the firewall tab in the admin console, which only applies to IPv4 NAT port forwarding. Because IPv6 doesn’t need to use NAT, you use the Packet Filter tab instead. Within here, I wound up getting rid of all the default rules that were setup to clear out the junk and just have my rules.
I initially created the rules with only the IP version, protocol, dest port and dest IPv6 address. That didn’t work. And forums (as well as AI) seemed to indicate it wouldn’t work and so I was resigned to just not have it setup anymore.
But then I started dinking more a little at a time and discovered you had to also add ingress and egress rules as well because I could see users were attempting to hit the ports but the AT&T router was still blocking them.
Before deleting the default rules, I noticed some they had ingress and egress rules set. So for the heck of it I threw those in there as well (Ingress WAN, Egress LAN) and low and behold, traffic started passing through.
Using my honeypot server, I’ve been able to capture some examples of Log4J attempts against it. What this is showing is that the ModSecurity rules in place, at least in this subset of anecdotal examples, are able to block the various attempts, up to this point.
A major vulnerability has been discovered in Java web apps basic logging function called Log4J/Log4Shell. The best remedy for this is to update Log4j itself, or update the web app platform running Log4j with a newer version provided by the vendor. But that may take a while in many instances to fully implement.
A major vulnerability has been discovered in Java web apps basic logging function called Log4J/Log4Shell. The best remedy for this is to update Log4j itself, or update the web app platform running Log4j with a newer version provided by the vendor. But that may take a while in many instances to fully implement.
I have a spare EdgeRouter 4 that was bricked but still appears operational, probably just having some sort of a boot error that I can’t see. I’ve been hunting for a more serious level factory reset guide and came across this (something I have yet to try): manual TFTP Recovery. Hope it helps if you’re stuck.
I had a particular need with Shoutcast (since the application is 1) able to do HTTP and HTTPS on the same port, and 2) since I wanted to reverse proxy those requests for security filtering with ModSecurity) to have HTTP requests that hit the HTTPS port to upgrade those requests to HTTPS on the same port instead of just erroring out (bad protocol error). Some of this had to do with browser and other client-end mechanisms forcing an HTTPS upgrade of late, but finding it wasn’t working correctly all the time. I struggled to find a good solution but came to an answer finally on stackoverflow. I’m documenting it here for future reference and for those that may need that kind of functionality since it’s a very specific request. I normally just do a 301 redirect for situations like this, but it doesn’t seem to work when streaming media for whatever reason using particular media clients. This has done the trick.
In my last post, I explained how to go about utilizing IPv6 prefix delegation using a Ubiquiti EdgeRouter 4, connected to an AT&T internet router that has IPv6 enabled on both the WAN and the LAN side. Now we’re going to walk through the basic firewall rules you need in place to protect your IPv6 network. And when I say basic, I mean the bare minimum to make sure the entire internet can’t get to your IPv6 devices, because if you’ve finished with the last post, your devices are likely open right now. 😐
From the outset, it’s important to note that this is intended only for those who already have completed part one on the AT&T router, which is 1) enabling IPv6 on the LAN side and 2) enabling prefix delegation for the LAN. In addition, I’m using a Ubiquiti EdgeRouter 4 for my second firewall and this guide reflects that. However, if you’re using another IPv6 capable router, you may be able to glean settings from this and match them to your configuration.
