For Teachers · Back to the Module · Print with your browser's Print command.

P3 Worksheet: Network Exposure and Firewalls

Student Worksheet (about 20 minutes, Practitioner level)

Name: ______________________ Class: __________ Date: __________

Read first: F1, F3

Learning Objectives

• [ ] Explain the difference between binding to 127.0.0.1 and to 0.0.0.0.
• [ ] Explain why exposed databases and caches cause mass breaches.
• [ ] Explain default-deny firewall policy.

Key Terms

Write each definition in your own words.

• Attack Surface: ______________________________________________
• Port: ______________________________________________
• Loopback: ______________________________________________
• Firewall: ______________________________________________
• Default Deny: ______________________________________________
• Cleartext: ______________________________________________

Lab Tasks

Use only the simulated lab or a machine your teacher has authorised.

1. Run: openvapt demo --only NET- --out p3 and open the NET-LSN-001 evidence.
2. Compare the vulnerable lab (MySQL and Redis on 0.0.0.0) with the hardened lab (127.0.0.1).
3. On your own server: ss -tulpn and classify each socket as local only or network reachable.

Self-Check Questions

1. A service bound to 127.0.0.1 is reachable from:

• [ ] a) The whole internet
• [ ] b) Only the same machine
• [ ] c) Only the local network
• [ ] d) Any machine the firewall allows

1. What does a default-deny firewall policy do?

• [ ] a) Blocks everything not explicitly allowed
• [ ] b) Allows everything not explicitly blocked
• [ ] c) Logs traffic only
• [ ] d) Blocks only known bad addresses

1. Why is Telnet considered insecure?

• [ ] a) It is slow
• [ ] b) It sends credentials unencrypted
• [ ] c) It only works on Windows
• [ ] d) It cannot be firewalled

1. A service is bound to 0.0.0.0 and no firewall is running. Who can reach it?

• [ ] a) Only the same machine
• [ ] b) Any network that can route to the server
• [ ] c) Only IPv6 clients
• [ ] d) Only clients that know a password

1. How does OpenVAPT find listening services?

• [ ] a) It port scans the network
• [ ] b) It reads the kernel's own socket tables
• [ ] c) It asks each service for its version
• [ ] d) It reads the firewall rules only

1. What must you do before enabling a default-deny firewall on a remote server?

• [ ] a) Allow SSH
• [ ] b) Stop the web server
• [ ] c) Disable IPv6
• [ ] d) Reboot the server

Reflection

Which finding from this module would matter most on a server you are responsible for, and why?

________________________________________________________________

Sources

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy: https://csrc.nist.gov/pubs/sp/800/41/r1/final
• OWASP Database Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Database_Security_Cheat_Sheet.html

Adapted from the OpenVAPT Academy (openvapt.com), built by AI Cybersecurity Engineers, used under the OpenVAPT Source-Available Licence 1.3. Free teaching use under TEACHING.md. Please cite OpenVAPT: see CITING.md or openvapt.com/cite.html. OpenVAPT is not affiliated with, and is not endorsed by, this institution or any third party named in this material. Pre-release versions may be wrong or unstable. Use at your own risk. If you adapt this material, say where you changed it.