Network Exposure and Firewalls

Listening Services and Attack Surface

Every listening port is part of the attack surface. A service bound to 127.0.0.1 or ::1 is reachable only from the machine itself. One bound to 0.0.0.0, :: or a public address is reachable from the network unless a firewall blocks it. OpenVAPT reads this from the kernel's own socket tables instead of port scanning.

Databases, Caches and Cleartext Protocols

Redis, MongoDB, Elasticsearch and Memcached exposed to the internet, often without authentication, have caused many large data breaches and ransom wipes. Telnet, FTP, rsh and plain POP3, IMAP or LDAP send passwords unencrypted.

Host Firewalls

A default-deny host firewall allows only the ports you intend, such as SSH and HTTPS, and drops everything else. It protects you when a service is installed or misconfigured by mistake. Always allow SSH before enabling a firewall on a remote server.

In Summary

Every listening port is attack surface. Bind services to loopback where you can. A default deny firewall closes the rest. Cleartext services belong behind TLS or off the network.

Apply It

These OpenVAPT checks put this module into practice. Open one to see its detection logic and source code.

Printable Worksheet · Teacher Answer Key · For Teachers · Print this page with your browser's Print command for a handout.

Also available as plain Markdown for notes, scripts and AI tools. Same facts, same source, no styling.

Lab

1. Run: openvapt demo --only NET- --out p3 and open the NET-LSN-001 evidence.
2. Compare the vulnerable lab (MySQL and Redis on 0.0.0.0) with the hardened lab (127.0.0.1).
3. On your own server: ss -tulpn and classify each socket as local only or network reachable.

Check Yourself

Answers are checked in your browser and never stored or sent.

References

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
• OWASP Database Security Cheat Sheet

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under Teaching With OpenVAPT. Pre-release material may be wrong or unstable; use at your own risk.

OpenVAPT. (2026). P3: Network Exposure and Firewalls (Version 0.1.0-alpha.6). OpenVAPT Academy. Retrieved October 16, 2026, from https://openvapt.com/academy/p3.html

@misc{openvapt_p3,
  author       = {{OpenVAPT}},
  title        = {{P3: Network Exposure and Firewalls}},
  year         = {2026},
  howpublished = {\url{https://openvapt.com/academy/p3.html}},
  note         = {OpenVAPT Academy, version 0.1.0-alpha.6. Accessed 16 October 2026}
}