Are there any firewall systems that satisfy the pcicomply questionnaire? (which should be based on B-IP in my case). I have segmented the Clover on its own VLAN where it is the only device in its IP range. I am running into brick walls in trying to implement a Firewall policy that satisfies the terribly vague statements presented by the pcicomply questionnaire's Internet Firewall section:
- A firewall (or similar protection) is in place. [YES]
- Only authorized communication between the POS equipment and the Internet is permitted.
- All non-business communication between the POS equipment and the Internet is denied.
- The firewall uses 'stateful inspection' (Most firewalls do this automatically.)
- Anti-spoofing measures are implemented.
- No / None of the above
Comments:
- YES
- What is that supposed to mean??? If I set up the firewall to ALLOW everything, I have "authorized" that communication... If I try to determine what traffic should be authorized I might look to the Clover FAQ, but what firewall provides the ability to effectively restrict traffic to specific DOMAINS rather than using IPTABLES - see:This devask topic. So that suggests that a HOST call should be made to provide IPs suitable for IPTABLES, but relies on DNS.
- See #2 above
- YES
- What are "Anti-spoofing measures"? - Does this refer to MAC spoofing? Does it refer to internal IP range spoofing? Does it refer to any type of spoofing? If I block bogon IPs, but can't tell if a non-bogon IP is being spoofed, have I implemented "Anti-spoofing measures"?
I expected the security of the internet connection between this Clover device and Clover's servers to be implemented between those points. I did not expect that I would need to implement security based on difficult to find information that is not presented in a way that makes sense in a firewall context: the Clover FAQ plus This devask topic.
If security is the goal, why can't Clover provide firewall rules that can be used in common firewall systems like pfsense, sophos, etc. or even better, IPTABLES rules that can be adapted to work in nearly any firewall?
I'm not even remotely close to being a security expert, but everything I read about using domain names for firewall rules points to it being a very poor choice, but I cannot find any concrete information on what IPs the Clover needs to access.
It seems that it could be very simple to isolate a Clover and truly lock down its segment to allow "Only authorized communication" by DENYing all but the required IPs and PORTs, but I cannot find the information to implement this anywhere on Clover's help system.
Does such information exist and if not, why not?
