Control Strategy DisablePortForwarding

URI: CSG-DisablePortForwarding-Runtime

Package: NetworkConnectivity

< prev | next >

Description: If device Gateway blocks unsolicited connections into private subnet ToSubnet, port forwarding is used to allow access to services by legitimate clients. This strategy may represent a run-time adaptation in response to a threat, or a permanent restriction introduced by design or in accordance with an operational policy or user preference. It also triggers threats representing side effects that would be caused by such a restriction.

Blocked Threats (2)

Sg.TA.L3SSg2+b.8.2

Port forwarding from FromSubnet to ToSubnet via Gateway is enabled: if the route from public subnet FromSubnet to private subnet ToSubnet via a NAT gateway host Gateway is in service, then port forwarding is normally used to allow connections where expected between legitimate clients and services.

Sg.TA.L3SSg2-b.8.2

Service connection routing from FromSubnet to ToSubnet via Gateway is allowed by exception: if the route via Gateway from FromSubnet to ToSubnet is blocked by a default firewall policy, then port forwarding is normally used to allow connections where expected between legitimate clients and services.

Triggers Threats (2)

Sg.A.L3SSg2.6.1

Connections between FromSubnet and ToSubnet via Gateway are disabled: if port forwarding is disabled by closing firewall tunnels at Gateway the route via Gateway between FromSubnet and ToSubnet will be unavailable to legitimate users.

Sg.TA.L3SSg2AC.1

Port forwarding between FromSubnet and ToSubnet re-enabled at Gateway: if an attacker has admin rights on gateway device Gateway, they can enable port forwaarding between FromSubnet and ToSubnet.