fix_snmp opens a v2c "public" agent to every source on every interface #13

New Issue

2026-10-14T08:58:50Z

christianmanivong commented

2026-10-14 08:58:50 +00:00

_action_fix_snmp (opnsense.py ~2312-2456) enables snmpd with community public and adds a floating pass rule: "interface": "" (all interfaces), "source_net": "any", "destination_net": "(self)", port 161, descr "[netork] Allow SNMP" (~2386-2412). snmpd listens on self.hostname, the management address; on a firewall managed over WAN that is the WAN address. Anyone who reaches it can read the firewall's SNMP tree with the default community.

Fix: restrict the rule's source to the address(es) the caller names and the interface that carries the management address. With the fix template (NAPALM/napalm-device-types#33) the community and allowed sources come from the caller anyway.

Prio P2: security, a firewall's SNMP readable from anywhere it is managed from.

`_action_fix_snmp` (`opnsense.py` ~2312-2456) enables snmpd with community `public` and adds a floating pass rule: `"interface": ""` (all interfaces), `"source_net": "any"`, `"destination_net": "(self)"`, port 161, `descr "[netork] Allow SNMP"` (~2386-2412). snmpd listens on `self.hostname`, the management address; on a firewall managed over WAN that is the WAN address. Anyone who reaches it can read the firewall's SNMP tree with the default community. Fix: restrict the rule's source to the address(es) the caller names and the interface that carries the management address. With the fix template (NAPALM/napalm-device-types#33) the community and allowed sources come from the caller anyway. Prio P2: security, a firewall's SNMP readable from anywhere it is managed from.

christianmanivong referenced this issue from a commit

2026-10-17 06:26:16 +00:00

fix!: the SNMP agent takes the caller's values and opens only to its sources (0.2.0)

christianmanivong referenced a pull request that will close this issue

2026-10-17 06:26:16 +00:00

fix!: the SNMP agent takes the caller's values and opens only to its sources (0.2.0) #21

christianmanivong closed this issue

2026-10-17 06:48:18 +00:00

christianmanivong referenced this issue from a commit

2026-10-17 07:09:46 +00:00

chore(vendor): every driver takes the fix templates; drop run_device_action (#1109)

Sign in to join this conversation.