topic Re: Is it possible to DDoS/DoS a public IP which has only outbound traffic and ipsec tunnel. No DNAT configured and ping disabled. in General Topics

Is it possible to DDoS/DoS a public IP which has only outbound traffic and ipsec tunnel. No DNAT configured and ping disabled.

Kandarp_Desai — Tue, 22 Mar 2022 22:14:05 GMT

Re: Is it possible to DDoS/DoS a public IP which has only outbound traffic and ipsec tunnel. No DNAT configured and ping disabled.

addawes — Wed, 23 Mar 2022 00:36:33 GMT

Rather not play with fire and enable DoS protection and Zone protection on all outside interfaces/zones.

Re: Is it possible to DDoS/DoS a public IP which has only outbound traffic and ipsec tunnel. No DNAT configured and ping disabled.

LAYER_8 — Wed, 23 Mar 2022 21:29:36 GMT

In theory this is still possible. Most DDoS attacks Palo sees now are reflection-based amplification attacks... UDP, not ICMP. (Which sounds like these are allowed in your network).

Mirai botnet... reflected and amplified NTP on IoT devices with outbound rules. Is it harder with only outbound rules and hiding behind NAT? Yes. Impossible? No. Unless you know for certain all current inside devices are clean, and you know where they are 365 days a year, it's still possible. Slim, hence defense in depth, but possible.

Consider also DDoS lives on loads of NAS, routers, home security kits so in some cases reflection/amplification will still come down that IPSec tunnel depending on what terminates it.

+1 on the above for DoS/Zone protection profiles on zones.

Re: Is it possible to DDoS/DoS a public IP which has only outbound traffic and ipsec tunnel. No DNAT configured and ping disabled.

TomYoung — Wed, 23 Mar 2022 22:13:47 GMT

Hi @Kandarp_Desai ,

Traffic from the Internet to the public IP (same zone) is allowed by the default intrazone-default rule. You could create an intrazone drop rule to block the traffic, and no DoS should be possible. Remember to create an allow rule for your IPsec tunnel first.

Thanks,

Tom