Random reminder that if you are exposing IKE to the Internet for static site-to-site tunnels, maybe allowlist only your peer endpoints and don't allow full Internet access to them.

[cr0w@infosec.exchange]

Random reminder that if you are exposing IKE to the Internet for static site-to-site tunnels, maybe allowlist only your peer endpoints and don't allow full Internet access to them. Just a thought. If you aren't sure if you are exposed, today seems like a good day to find out.

Just a moment...

(www.shodan.io)

[sempf@infosec.exchange]

@cR0w Hmm.

[fuzzyfuzzyfungus@cyberplace.social]

@cR0w Is this a good practice reminder apropos of nothing super particular; or has one of the Enterprise Gateway Widget vendors covered themselves in glory again?

[cr0w@infosec.exchange]

@fuzzyfuzzyfungus As of today it's a general good practice reminder. But we never know what tomorrow may bring.

[kajer@infosec.exchange]

@cR0w @fuzzyfuzzyfungus

Thanks to DYNDNS, my home based S2S WireGuard tunnels only allow the specific FQDN I need.

ISP DHCP based IP change is roughly a 1hr downtime window. My ZFS replications can handle that fine.

[nyanbinary@infosec.exchange]

@cR0w who is Ike & why are we trying to keep them off the internet?

[jackryder@infosec.exchange]

@nyanbinary @cR0w Mike asked for his return... he did not tell us why.