--- title: "P3: Network Exposure and Firewalls" canonical: https://openvapt.com/academy/p3.html html: https://openvapt.com/academy/p3.html site: OpenVAPT, https://openvapt.com/ license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html modified: 2026-10-16 version: 0.1.0-alpha.6 --- # P3: Network Exposure and Firewalls What a server exposes to the network, and why databases and cleartext services should not be reachable. How a host firewall acts as a safety net. - Level: Practitioner - Time: about 20 minutes - Read first: F1, F3 ## You Will Be Able To - Explain the difference between binding to 127.0.0.1 and to 0.0.0.0. - Explain why exposed databases and caches cause mass breaches. - Explain default-deny firewall policy. ## Listening Services and Attack Surface Every listening port is part of the attack surface. A service bound to 127.0.0.1 or ::1 is reachable only from the machine itself. One bound to 0.0.0.0, :: or a public address is reachable from the network unless a firewall blocks it. OpenVAPT reads this from the kernel's own socket tables instead of port scanning. ## Databases, Caches and Cleartext Protocols Redis, MongoDB, Elasticsearch and Memcached exposed to the internet, often without authentication, have caused many large data breaches and ransom wipes. Telnet, FTP, rsh and plain POP3, IMAP or LDAP send passwords unencrypted. ## Host Firewalls A default-deny host firewall allows only the ports you intend, such as SSH and HTTPS, and drops everything else. It protects you when a service is installed or misconfigured by mistake. Always allow SSH before enabling a firewall on a remote server. ## In Summary Every listening port is attack surface. Bind services to loopback where you can. A default deny firewall closes the rest. Cleartext services belong behind TLS or off the network. ## Apply It - [NET-DB-001 Database or Cache Service Exposed to the Network](https://openvapt.com/checks/NET-DB-001.md) (high) - [NET-DB-002 Redis Authentication and Network Binding](https://openvapt.com/checks/NET-DB-002.md) (critical) - [NET-DB-003 MongoDB Authorization and Network Binding](https://openvapt.com/checks/NET-DB-003.md) (critical) - [NET-DB-004 PostgreSQL Trust and Broad Client Access](https://openvapt.com/checks/NET-DB-004.md) (critical) - [NET-DB-005 MySQL or MariaDB Unsafe Network Options](https://openvapt.com/checks/NET-DB-005.md) (high) - [NET-DB-006 Memcached UDP or Broad Listen Address](https://openvapt.com/checks/NET-DB-006.md) (high) - [NET-DB-007 Elasticsearch Security and Network Binding](https://openvapt.com/checks/NET-DB-007.md) (critical) - [NET-DB-008 Unsafe NFS Export Options](https://openvapt.com/checks/NET-DB-008.md) (high) - [NET-DB-009 Unsafe Samba Guest or SMB1 Configuration](https://openvapt.com/checks/NET-DB-009.md) (high) - [NET-DB-010 BIND Open Recursion](https://openvapt.com/checks/NET-DB-010.md) (high) - [NET-DB-011 BIND Zone Transfers Allowed to Any](https://openvapt.com/checks/NET-DB-011.md) (high) - [NET-DB-012 Postfix Open Relay Controls](https://openvapt.com/checks/NET-DB-012.md) (high) - [NET-DB-013 Mail Cleartext Authentication Allowed](https://openvapt.com/checks/NET-DB-013.md) (medium) - [NET-DB-014 MySQL Symbolic Links Allowed for Tables](https://openvapt.com/checks/NET-DB-014.md) (medium) - [NET-DB-015 MySQL secure_file_priv Not Restricted](https://openvapt.com/checks/NET-DB-015.md) (medium) - [NET-DB-016 MySQL Does Not Require Encrypted Client Connections](https://openvapt.com/checks/NET-DB-016.md) (medium) - [NET-DB-017 MySQL Error Log Not Configured](https://openvapt.com/checks/NET-DB-017.md) (low) - [NET-DB-018 MySQL Resolves Client Host Names](https://openvapt.com/checks/NET-DB-018.md) (low) - [NET-DB-019 PostgreSQL Uses md5 or password Authentication](https://openvapt.com/checks/NET-DB-019.md) (medium) - [NET-DB-020 PostgreSQL SSL Not Enabled](https://openvapt.com/checks/NET-DB-020.md) (medium) - [NET-DB-021 PostgreSQL Connection Logging Off](https://openvapt.com/checks/NET-DB-021.md) (low) - [NET-DB-022 PostgreSQL Password Encryption Not SCRAM](https://openvapt.com/checks/NET-DB-022.md) (medium) - [NET-DB-023 Redis Dangerous Commands Not Restricted](https://openvapt.com/checks/NET-DB-023.md) (medium) - [NET-FW-001 No Active Host Firewall](https://openvapt.com/checks/NET-FW-001.md) (medium) - [NET-FW-002 IPv6 Listeners Without IPv6 Firewall](https://openvapt.com/checks/NET-FW-002.md) (high) - [NET-FW-003 Firewall Allows Sensitive Services From Anywhere](https://openvapt.com/checks/NET-FW-003.md) (high) - [NET-FW-004 Firewall Rules Open Ports With No Service](https://openvapt.com/checks/NET-FW-004.md) (low) - [NET-FW-005 Container Ports Bypass the Host Firewall](https://openvapt.com/checks/NET-FW-005.md) (medium) - [NET-FW-006 Firewall Exposure Map of Listening Services](https://openvapt.com/checks/NET-FW-006.md) (info) - [NET-LSN-001 Inventory of Listening Network Services](https://openvapt.com/checks/NET-LSN-001.md) (info) - [NET-SVC-001 Cleartext Legacy Services Listening](https://openvapt.com/checks/NET-SVC-001.md) (high) - [NET-SVC-002 Control Plane or Remote Desktop Ports Network-Reachable](https://openvapt.com/checks/NET-SVC-002.md) (critical) - [NET-SVC-003 Network Time Service Amplification Risk](https://openvapt.com/checks/NET-SVC-003.md) (high) - [NET-SVC-004 Management Panel or Monitoring Ports Network-Reachable](https://openvapt.com/checks/NET-SVC-004.md) (medium) ## Lab 1. `Run: openvapt demo --only NET- --out p3 and open the NET-LSN-001 evidence.` 2. `Compare the vulnerable lab (MySQL and Redis on 0.0.0.0) with the hardened lab (127.0.0.1).` 3. `On your own server: ss -tulpn and classify each socket as local only or network reachable.` ## Check Yourself Answer keys are public for every channel (see Teaching With OpenVAPT). 1. A service bound to 127.0.0.1 is reachable from: - A. The whole internet - B. Only the same machine - C. Only the local network - D. Any machine the firewall allows - Answer: B. Loopback addresses never leave the machine, whatever the firewall says. 2. What does a default-deny firewall policy do? - A. Blocks everything not explicitly allowed - B. Allows everything not explicitly blocked - C. Logs traffic only - D. Blocks only known bad addresses - Answer: A. Default deny allows only the ports you intend and drops everything else. 3. Why is Telnet considered insecure? - A. It is slow - B. It sends credentials unencrypted - C. It only works on Windows - D. It cannot be firewalled - Answer: B. Anyone on the network path can read the password. 4. A service is bound to 0.0.0.0 and no firewall is running. Who can reach it? - A. Only the same machine - B. Any network that can route to the server - C. Only IPv6 clients - D. Only clients that know a password - Answer: B. 0.0.0.0 means every IPv4 address on the machine. Without a firewall, anyone who can route to the server can connect. 5. How does OpenVAPT find listening services? - A. It port scans the network - B. It reads the kernel's own socket tables - C. It asks each service for its version - D. It reads the firewall rules only - Answer: B. Reading the kernel's socket tables shows every listener without sending any traffic. 6. What must you do before enabling a default-deny firewall on a remote server? - A. Allow SSH - B. Stop the web server - C. Disable IPv6 - D. Reboot the server - Answer: A. If SSH is not allowed first, the new policy can lock you out of the server. ## Key Terms - Attack Surface: All the points where an attacker could try to interact with a system, such as listening ports, web pages and accounts. - Port: A number that identifies a network service on a machine, such as 22 for SSH or 443 for HTTPS. - Loopback: The network interface that only reaches the same machine: 127.0.0.0/8 for IPv4 and ::1 for IPv6. - Firewall: Software or hardware that allows or blocks network traffic according to rules. - Default Deny: A firewall or access policy that blocks everything except what is explicitly allowed. - Cleartext: Data sent or stored without encryption, readable by anyone who can see it. ## References - [NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy](https://csrc.nist.gov/pubs/sp/800/41/r1/final) - [OWASP Database Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html) Offline: `openvapt learn P3`. --- OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/academy/p3.html. Part of OpenVAPT Academy. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.