NeuralWall Rules Kit
reviewed expose_public_https_web_service

Exposing a public HTTPS web service from the Internet to the DMZ

This scenario covers exposing an HTTPS web server hosted in the DMZ and reachable from the Internet. It includes inbound SSL decryption (ssl_inbound_inspection) to enable L7 inspection of encrypted traffic, along with the DNS dependency rules required for the service to function. This scenario is particularly sensitive: the exposed server is a direct target for public-facing application exploitation, payload injection, and use of the service as a C2 relay. Full security profiles (antivirus, IPS, c2_protection, url_filtering, file_control, sandboxing) are mandatory on the main allow rule.

Schema:
1.0.0
版本:
1.0.0
作者:
NeuralWall Rules Team (NeuralWall)

信任与认证

信任级别reviewed
正在加载信任信息…
community
reviewed
verified

Next tier: verified
预览 {} Machine JSON AI AI/RAG Markdown ~ Source YAML RAG [fr]

威胁模型

摘要
A web service directly exposed to the Internet represents the widest attack surface of a perimeter. The attacker attempts to exploit an application vulnerability (public CVE, injection, misconfiguration) to gain initial access on the DMZ, then move laterally toward the internal network. Without inbound SSL decryption, L7 inspection is blind: antivirus, IPS, and sandboxing see only an opaque stream. With ssl_inbound_inspection, the stream is re-encrypted toward the server after inspection — the server certificate must be imported into the firewall.
攻击者目标
Gain initial access on the DMZ server by exploiting the public HTTPS service, drop a payload or implant, then establish an outbound C2 channel or pivot into the internal network (privilege escalation, lateral movement).
关键控制
ssl_inbound_inspectionipsantivirussandboxingc2_protectionfile_controldns_security

MITRE ATT&CK

技术编号 名称 战术
T1190 Exploit Public-Facing Application initial-access
T1071.001 Application Layer Protocol: Web Protocols command-and-control
T1105 Ingress Tool Transfer command-and-control
T1059 Command and Scripting Interpreter execution

规则

# App ID 动作 方向 区域 风险 安全配置 解密
0 web_browsing allow inbound internet → dmz 4 antivirus, c2_protection, file_control, ips, sandboxing, url_filtering ssl_inbound_inspection
1 dns allow internal dmz → internal 2 dns_security none
2 any_application drop outbound dmz → internet 5 — —

规则详情

规则 0 — web_browsing (allow)

依据

This rule allows inbound HTTPS traffic from the Internet to the DMZ web server. The ssl_inbound_inspection decryption mode is enabled to allow L7 inspection: without it, antivirus, IPS, and sandboxing see an opaque stream and cannot detect exploits or payloads. Security profiles are all set to blocking mode (not just alert) because the attack surface is maximal on a public-facing service. Port 80 is included for HTTP→HTTPS redirection; a server-side redirect rule is recommended in addition.

应用

app_id:
web_browsing
category:
general_internet
risk:
4
depends_on:
dns, ssl

区域

internet → dmz

direction: inbound

安全配置

antivirus: action=block c2_protection: action=block, min_severity=low file_control: block_types=pe+elf+script+encrypted_archive, direction=inbound ips: action=block, min_severity=medium sandboxing: enabled=true, file_types=pe+pdf+office+jar+script url_filtering: block_categories=malware+phishing+c2+newly_registered_domain+proxy_avoidance+hacking+compromised, uncategorized_action=block

解密

mode=ssl_inbound_inspection

日志

log_start: false
log_end: true
forwarding → siem_high_priority

规则 1 — dns (allow)

依据

DNS resolution is required for the DMZ web service to function properly (OCSP/CRL resolution for certificate validation, upstream dependencies, updates). The flow is restricted to a trusted internal resolver (not directly to the Internet) to prevent DNS rebinding and limit the exfiltration surface. The dns_security profile with sinkhole blocks DNS tunneling that could be used as a covert C2 channel from a compromised server. Decryption not applicable: standard DNS over UDP is not encrypted.

应用

app_id:
dns
category:
networking
risk:
2

区域

dmz → internal

direction: internal

安全配置

dns_security: action=block, sinkhole=true

解密

mode=none

日志

log_end: true
forwarding → siem_default

规则 2 — any_application (drop)

依据

Deny-by-default rule: any traffic initiated from the DMZ toward the Internet that is not explicitly covered by an allow rule above is silently dropped. This rule is critical to contain a compromised DMZ server and prevent the establishment of an outbound C2 channel (T1071.001) or data exfiltration. The 'any_application' app_id with 'unknown' category is justified here: this is a catch-all blocking rule, not an allow rule.

应用

app_id:
any_application
category:
unknown
risk:
5

区域

dmz → internet

direction: outbound

日志

log_start: true
log_end: true
forwarding → siem_high_priority