Internet access risks

[franfm]

Hello community,

A question that surrounds me and I wanted to comment with you:

If transport access (WAN) connected to my MX65 is a basic internet access (residential/non-business: xDSL, FTTH)

What are the real security risks?

For example: an hacker get remotely access local router (basic ftth) could I jump to MX:loca manage access, rest of end-points?

BR.-Fran

[ww · Accepted solution]

https://documentation.meraki.com/MX-Z/Firewall_and_Traffic_Shaping/Firewall_Settings

Note: In NAT mode, all inbound connections are denied except for ICMP traffic to the appliance, by default. If you want to allow additional inbound traffic, you will need to create a new port forwarding rule or NAT policy and explicitly allow connections based on protocols, ports, or remote IP addresses (see below).

Outbound connections are allowed by default. Customers may need to add a default deny rule for compliance and increased security.

[GiacomoS]

Hey @franfm,

In addition to @ww link, you can also disable the local status page from the Dashboard by going into Network-Wide > General > Device Configuration. 

This helps prevent users accidentally (or intentionally!) trying to access the local status page.

Giacomo

[franfm]

Thanks guys.

OK, with which the only real risk to our endpoint/LAN in case of compromised the access router (ISP) would be a DoS attack on our MX?

Are you agree?

BR.Fran

[ww]

---

@franfm wrote:

Thanks guys.

OK, with which the only real risk to our endpoint/LAN in case of compromised the access router (ISP) would be a DoS attack on our MX?

Are you agree?

BR.Fran

---

i would rather care to educate users and secure and patch your endpoints as they are opening the connections to the public network and getting data into your lan.