Control Strategy BlockGatewayRoute

URI: CSG-BlockGatewayRoute

Package: NetworkConnectivity

< prev | next >

Description: Apply a default firewall rule at gateway host Gateway to drop messages sent via the gateway from FromSubnet to ToSubnet, unless they are service requests or responses.

Blocked Threats (1)

Sg.DA.L3SSg2-b.8

Routing between FromSubnet and ToSubnet via Gateway is enabled by default: if this route between IP subnets is enabled for all communications, it could be exploited by an attacker.

Triggers Threats (2)

Sg.DA.L3SSg2AC-b.1

Routing between FromSubnet and ToSubnet re-disabled at Gateway: if an attacker has admin rights on host Gateway in a context where it is connected to FromSubnet and ToSubnet, then they can override a default policy to drop connection being routed between those subnets.

Sg.TA.L3SSg2-b.8.2

Service connection routing from FromSubnet to ToSubnet via Gateway is allowed by exception: if the route via Gateway from FromSubnet to ToSubnet is blocked by a default firewall policy, then port forwarding is normally used to allow connections where expected between legitimate clients and services.