https://blogs.damiendye.uk/en/tags/firewall/ Recent content in Firewall on Damien Dye's Blog Hugo en-GB Thu, 24 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/dns-over-https-walks-past-your-controls/ Thu, 24 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/dns-over-https-walks-past-your-controls/ DoH sends your DNS lookup to a resolver of the client's choosing on port 443, which your own resolver never sees, so it cannot block a bad name or log it. Sold as privacy, but DoT gave you that in 2016. What DoH really adds is bypassing the network admin. The mechanism, the malware, who pushed it, the courts now suing the resolvers, and the fix. https://blogs.damiendye.uk/en/networking/protocol-helpers-turn-them-off/ Mon, 14 Sep 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/networking/protocol-helpers-turn-them-off/ A NAT helper reads the inside of your packets and opens inbound ports on what it finds there. Anyone can write that text — a web page has been enough since 2010. How helpers work, how crafted packets turn them into a port-opening service for strangers, what IPsec pass-through does, why they fail Cyber Essentials, and how to switch the lot off. https://blogs.damiendye.uk/en/networking/ping-the-diagnostic-tool-that-opens-a-whole-lot-more/ Tue, 01 Sep 2026 08:05:00 +0100 https://blogs.damiendye.uk/en/networking/ping-the-diagnostic-tool-that-opens-a-whole-lot-more/ Why ping — ICMP echo, not the rest of the protocol — is a liability: a channel every host must answer, so a network that 'only allows ping' has a full VPN out. The threat, who can open one, three tunnels (Hans, icmptunnel, a Python one with AES-128), and the rule that shuts it: nftables, pf, Cisco, Junos, MikroTik and Windows. https://blogs.damiendye.uk/en/networking/how-far-away-is-the-firewall/ Fri, 28 Aug 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/networking/how-far-away-is-the-firewall/ A connection that times out tells you nothing about where it died. TTL does. Here is how to count the hops to whatever is eating your port, on Linux, macOS, the BSDs, Solaris and Redox, with a script that needs no root on Linux.