search

WaterByWind / edgeos-bl-mgmt

Automated updating of EdgeOS firewall network-group to be used as source address blacklist
MIT License
196 stars 40 forks source link

What about applying these rules also for egress traffic? #20

Open gparmeggiani opened 3 years ago

gparmeggiani commented 3 years ago

I'm thinking of the specific case of a malware talking to its C&C server via UDP. These rules won't block the upload traffic. Given the growing number of ransomware with the goal of stealing private data, a upload-only UDP connection should be enough for them for their job.

WaterByWind commented 3 years ago

The rules can apply wherever you apply them - that is entirely up to you.

If you want to add a rule to the 'out' direction on an interface (such as your WAN) then you absolutely can do so. There is nothing preventing that.