Default configuration in WatchGuard Firewall

[altellez () IP6SEGURIDAD COM (Alfonso Lazaro)]

        I have found a misconfiguration in the default configuration of Watchguard Firewall.

        By default it appends a rule that it accepts pings from any to any.
        
        So if our firebox is defending our internal network ( 192.168.x.x ... )
and our WG Firewall is a proxie with an external ip in internet ( 100.100.100.100 hipotetic ip address ) the atacker 
can change his/her routes like so :

        # route add -net 192.168.0.0 netmask 255.255.255.0 gw 100.100.100.100
        
        # ping 192.168.1.1
        PING 192.168.1.1 (192.168.1.1): 56 data bytes
        64 bytes from 192.168.1.1: icmp_seq=0 ttl=251 time=514.0 ms
        
        ^C
        
        # ping 192.168.1.2
        PING 192.168.1.2 (192.168.1.2): 56 data bytes
        64 bytes from 192.168.1.2: icmp_seq=0 ttl=251 time=523.0 ms

        ^C
        
        and so on ...

        the atacker can now discovers internal network ip and atack them

        # ping -f 192.168.1.1

        Solution is easy ... do not let pings to internal network.
        

--
Saludos.

===========================================================

   Alfonso Lazaro Tellez        altellez () ip6seguridad com
   Analista de seguridad        
   IP6Seguridad                 http://www.ip6seguridad.com     
   Tfno: +34 91-3430245         C\Alberto Alcocer 5, 1 D        
   Fax:  +34 91-3430294         Madrid ( SPAIN )
===========================================================