Sonicwall tz100 (hacked?): default rule any any allow

Hi,

I have a device on my network that was compromised. Couldn t logon to it, no ssh nothing.
Now, I try to limit accesses on my sonicwall.

I see a rule from any to any allow. That is not a default rule right? This would mean also my sonicwall user and pass are known.

Please advise.
J.
janhoedtAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
Blue Street TechConnect With a Mentor Last KnightCommented:
Awe, OK in this case LAN > WAN is completely normal to have it as Allow Any Any All. Unless you are filtering outbound traffic for PCI or some other compliance/security reason, the default for LAN > WAN is Allow and should be otherwise nothing will go outbound (no email, can't browse web, etc.).

Make sense?
0
 
Blue Street TechLast KnightCommented:
Hi janhoedt,

It depends, by default Zones are set to Deny. Which Zones are they for?

The attacker would only know which users of the machine compromised and even then only if they have setup a sniffer or keylogger - just because they have been compro9mised doesn't necessarily point to any particular threat but rather that vulnerabilities have been exploited. Therefore, unless you are using SSO or have aligned the user's credentials with the ones in the SonicWALL. Even then someone would have to know not only their way around a SonicWALL but know that a user account has been setup there as well. Furthermore, unless they have admin access it they will not be able to change any settings within the SonicWALL but they will have access to whatever that user has access to inside the network. Change user credentials on the SonicWALL immediately for that user.

Let me know if you have any other questions!
0
 
janhoedtAuthor Commented:
Thanks.

The access rule is the following (system made access rule, I've set it on deny now):

 46      LAN      >      WAN      11      Any      Any      Any      Allow All      None                    Enabled        Edit this entry A service depends on this rule
0
Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

 
janhoedtAuthor Commented:
I'd like to explicitely allow or disallow so have put it on dissalow.
0
 
Blue Street TechLast KnightCommented:
Then you need to have the LAN > WAN Deny rule as the last rule in priority. Then explicitly allow each service above it in priority.

Any other questions?
0
 
Blue Street TechLast KnightCommented:
Glad I could help...thanks for the points!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.