Hacker News Reader

Comment by scovetta | Hacker News Reader

Another option: route traffic through an external (authenticated) proxy.

Yeah, this is point 3 under the mitigation section. The only gotcha with this one is that you want to be sure there aren't any vulnerable local services on the proxy server itself. But this should be manageable.

It also may be possible to bind the connect port on the proxy and then use an iptables rule to prevent any connections from that source port from connecting to localhost.

The local port for outgoing TCP connections is chosen randomly in the normal case - and you can't have two TCP connections between the same pair of ports and hosts, so it would be hard to write a good proxy server that let you pick the local outgoing port.

You could use ipt_owner with iptables to block by source user matching the proxy server, however. Or just configure your proxy to block by outgoing IP if it supports this.

I think the poster meant IP not port.

Most proxy servers can be configured bind to a specific IP. So if your proxy server has an external IP and an internal IP, configure the proxy server to bind to the external IP. And then use IPTables to block any connections from the external IP to the internal network.

We run all our webhook invocations through our own product (a proxy that allows you to inspect any API call) which gives us this protection and gives us full logging to boot.

Reply on news.ycombinator.com