Which firewalls are unnecessary?

Software SW tweaks
1

The Omnia’s firewall has the following rules enabled by default:

Screen Shot 2017-11-03 at 10.35.39.png982×906 113 KB

I’d like to know which I can disable or remove and still allow my network to function.

The situation

  • My ISP offers a static IPv6 address at an extra cost; currently, I have a dynamically-assigned IPv4 address.
  • I have fewer than 10 network-aware devices that could be on my home network
  • Typical outbound usages: http/s, s/ftp, torrenting (udp), smtp/pop3/imap, exchange server access; openvpn client
  • Inbound usage: none currently, maybe OpenVPN server in the future

Questions:

  • Allow-MLD - is there a reason for multi-casting on a home network?
  • Do I need IPv6 on my home network?
  • Which rule allows devices on the home network to get an IP address? The Allow-DHCP-Renew seems like it’s for devices outside of my network.
  • What do the esp and udp rules do?
2 Likes
2

I simply disabled the last two ones of your displayed rules with no further effect.
The IPv6-rules can be simply disabled when you disable the use of IPv6 in general. I remember to make the use of a single rule somewhere that completely kills IPv6 but right now I can’t tell you where exactly.
But it would be nice if someone experienced could explain the reason for each rule. :relaxed:

3

I wanted to discuss this topics here What is minimal/best secure firewall configuration but it seems almost no one is into it. I personally have deleted all rules except Allow DHCP renew. I also don’t use IPv6 and any inbound services. Consequently all home devices [PC, tablet, mobile, IPTV box] work fine.

4
  • Allow DHCP Renew allows the router to receive updates of its WAN IP address, therefore it is good to have it allowed
  • Allow PING is better to have disabled, hence the router will not respond to ping requests from the Internet, what makes it kinda hidden for hacker scanners
1 Like
5

But appropriate RFC standard recommends responding to ping for all network devices :frowning:

6

With ping I expect you’ll harm yourself more than any (potential) attackers.

1 Like
7

Can you little bit elaborate this? I am interested :slight_smile:

8

Attackers don’t need to ping your machine. IIRC it’s also typical nowadays that they directly connect to the service they try to attack (e.g. SSH) without any port scanning or pinging, but I’m no expert on this.

Of course, you may also switch your diagnostic approaches away from ping and then you don’t need to care, but I personally find it useful in typical cases.

9

Sry, but disabling PING doesn’t give you any additional security - what matters, is if you have open ports or not.
So the only reasons thing to harden security is closing ports.

10

Here we are talking about ping reply on WAN interface with public IP address, i.e. to the Internet. There is no need to block ping reply on WAN interface with private IP, LAN or corporate networks.
On WAN interface I haven’t seen any situation when ping reply would be needed or used as diagnostic tool, that it would be any useful. Therefore disabling makes no harm.

On the other hand, it may harm your router in some [rare?] cases:



11

Yes, it is first condition - to have all services disabled and all ports stealth [not only “closed”] on WAN interface.
I use https://www.grc.com/x/ne.dll?bh0bkyd2 for detecting open/closed/stealth ports.