Reconsidering my network posture

Phishfry

Phishfry

I see DNSMasq is leaking badly. I use it on my Firewall.
I only use DNSMasq internally for my network. Hopefully this should limit my exposure some. I have it buttoned down. But...

Limbo time.

dhclient is the one service that is internet facing for me that scares me. I see it was recently patched. It made me think about the method.
My ISP assigns me an IP via DHCP.
Since this tends to be a stable IP number I wonder if I would reduce my attack surface by using StaticIP address instead.
Manually changing it on power events that do change the IP from my ISP.

One less service facing the internet the better off I am? With AI kicking up some dust it may be a good time to eliminate a creature comfort.

Have you changed anything due to recent exposure?
 
Attackers won't be able to abuse your DHCP request. Unless they've completely infiltrated your ISP at every level. Not impossible (certainly not in this day and age), highly unlikely though. Bad actor working for your ISP is more likely, but I would hope there's some oversight that would prevent such a thing.
 
Phishfry said:
I see DNSMasq is leaking badly. I use it on my Firewall.
I only use DNSMasq internally for my network. Hopefully this should limit my exposure some. I have it buttoned down. But...

Limbo time.

dhclient is the one service that is internet facing for me that scares me. I see it was recently patched. It made me think about the method.
My ISP assigns me an IP via DHCP.
Since this tends to be a stable IP number I wonder if I would reduce my attack surface by using StaticIP address instead.
Manually changing it on power events that do change the IP from my ISP.

One less service facing the internet the better off I am? With AI kicking up some dust it may be a good time to eliminate a creature comfort.

Have you changed anything due to recent exposure?
Click to expand...

Not really, my ISP now gives me a static IP to go outside
The problem is when you are behind a CGNAT network...here many ISP do that because the are out of ipv4 address and not implement ipv6 yet
 
You must log in or register to reply here.
Back
Top