Ask HN: How to avoid accidentally opening a port to the world?

4 points by nullbytesmatter 3 years ago | 2 comments

I recently discovered Solr (Jetty to be specific) binds to "::" by default, which is the ipv6 equivalent to "0.0.0.0". It essentially opened the Solr instance to the world.

I luckily caught it before indexing any data, but it opened my eyes to how easy it is for something like this to slip by. How can we prevent such things from happening?

I have since installed ufw and block all incoming traffic except to ports 22, 80 and 443 as a "layer" of defense (my thinking is, I won't accidentally expose a port this way).

josephcsible 3 years ago |

This is exactly what firewalls are for. Your "layer" of defense is the defense. If you want another layer, then set up another firewall further along the network.

ggm 3 years ago | |

This. NAT is not a firewall, never was. incidental benefit, which can't be relied on, specifically when there's no NAT (most v6)