---
title: "NET-FW-006 Firewall Exposure Map of Listening Services"
canonical: https://openvapt.com/checks/NET-FW-006.html
html: https://openvapt.com/checks/NET-FW-006.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-16
version: 0.1.0-alpha.6
---

# NET-FW-006 Firewall Exposure Map of Listening Services

Shows, for every network-reachable listening socket, what the host firewall does with traffic to it.

- Domain: Network
- Severity: Info
- Control category: Network Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N`
- CIS Controls v8: 4.4
- NIST CSF 2.0: PR.IR-01
- CWE: CWE-923
- NIST SP 800-53 Rev. 5: CM-7, CM-8, SC-7
- Benchmark topic: Network services inventory (topic only, no benchmark text)

## Why It Matters

Exposure is the combination of what listens and what the firewall lets through. Seeing both side by side is how assessors find services that are open by accident and confirm that the rest are blocked on purpose.

## How It Detects

Combines the listening sockets in /proc/net with the firewall's default policy and allow rules (ufw, nftables or iptables). Each socket is labelled allowed from anywhere, allowed from restricted sources, blocked by default deny, or reachable because no filtering firewall is active.

## How to Fix

For each socket labelled allowed from anywhere or reachable, decide whether it must be public. If not, bind it to 127.0.0.1 or restrict the firewall rule.

## How to Verify

```
Re-run this check after changes and compare the map.
```

## Learn the Theory

- [P3 Network Exposure and Firewalls](https://openvapt.com/academy/p3.md)
- [P12 Firewall Policy Versus What Is Listening](https://openvapt.com/academy/p12.md)

## References

- [NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy](https://csrc.nist.gov/pubs/sp/800/41/r1/final)
- [NIST SP 800-115, Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/firewall_exposure.go

Run it: `openvapt scan --only NET-FW-006`. Read it offline: `openvapt explain NET-FW-006`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/NET-FW-006.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.