MediumExposed servicesBLWK-NET-004

No host firewall is filtering incoming connections

What this means

No firewall is blocking incoming connections, so every service that listens on the network can be reached from any network you join. A firewall is your safety net for the service you forgot was running.

How to fix it

Turn on a firewall that blocks incoming connections by default.

1. Ubuntu and Debian: sudo ufw default deny incoming, then sudo ufw enable.
2. If you log in to this machine remotely, allow SSH first: sudo ufw allow OpenSSH.
3. Fedora and RHEL: sudo systemctl enable --now firewalld.

Note: Docker opens its ports around ufw, so also bind containers to 127.0.0.1.

Check it yourself

Run a scan and look for BLWK-NET-004 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads host_firewall and reports this check when:

firewall_active == false and firewall_known == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 3.5
• MITRE ATT&CK T1133

Related checks

• A VNC/remote-desktop port is listening · BLWK-NET-001
• A port commonly used by ngrok's local API is listening · BLWK-NET-002
• A database or development service is open to the network · BLWK-NET-003