Show Posts
1
General Discussion / In General ?
« on: September 11, 2021, 09:11:06 pm »
Hello everybody, I try to solve a couple of thoughts and questions around Opnsense;
1. Outgoing rules
I think about outgoing rules and wonder why it is default to allow all traffic...Mabye it was a marketing decision for a good start for new users ?
From my perspective a fw. should drop all outgoing traffic default = equally to incoming traffic and following up and just based on specific needs opening specific ports/ranges and protocols to specific hosts or networks; I would set my bots or malware to call back via port 53, 80, 443, 123, etc. right ?
2. Proxy
Is it still appropriate to use a proxy (2021) or a good idea and if why to use caching for http traffic in terms of performance or security ?
If I use unbound with eg. quad9 as a resolver against malware + blacklist against ad and malware why I also or need to use the blacklist on a proxy level as well ?
I like the idea of blocking traffic on a dns basis in general. Please do not get me wrong I just try to understand and to evaluate the benefit of using a proxy in terms of security and performance except the killa feature of using http inspection as well as ssl inspection = which is a full time job to maintain indeed and also depends on the scan engines are in use for a proper feeling of security ./
3. How to completely disable ipv6 in a proper way on Opnsense ?
4. Wireguard
Is there something coming up with 22.1 in terms of kernel module and or a wrapper for User management ?
1. Outgoing rules
I think about outgoing rules and wonder why it is default to allow all traffic...Mabye it was a marketing decision for a good start for new users ?
From my perspective a fw. should drop all outgoing traffic default = equally to incoming traffic and following up and just based on specific needs opening specific ports/ranges and protocols to specific hosts or networks; I would set my bots or malware to call back via port 53, 80, 443, 123, etc. right ?
2. Proxy
Is it still appropriate to use a proxy (2021) or a good idea and if why to use caching for http traffic in terms of performance or security ?
If I use unbound with eg. quad9 as a resolver against malware + blacklist against ad and malware why I also or need to use the blacklist on a proxy level as well ?
I like the idea of blocking traffic on a dns basis in general. Please do not get me wrong I just try to understand and to evaluate the benefit of using a proxy in terms of security and performance except the killa feature of using http inspection as well as ssl inspection = which is a full time job to maintain indeed and also depends on the scan engines are in use for a proper feeling of security ./
3. How to completely disable ipv6 in a proper way on Opnsense ?
4. Wireguard
Is there something coming up with 22.1 in terms of kernel module and or a wrapper for User management ?
