OCI Network Security Rules Should Not Allow All Ports

More Info:

Network Security Groups should not have rules allowing all ports (1-65535) or all protocols. Such rules effectively disable network-level access control.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate “OCI Network Security Rules Should Not Allow All Ports” using the OCI Console, you need to find and fix any security list or NSG rule where the destination port is set to “all” (0–65535 or left blank).

Below are the practical steps.

---

1. Identify non‑compliant rules

A. From Cloud Guard (if you’re using it)

1. In the OCI Console, open the ☰ menu.
2. Go to Security → Cloud Guard.
3. Click Detections (or Problems).
4. Filter by:
   • Resource type: Security List or Network Security Group
   • Or search text: port, 0-65535, all ports, or similar.
5. Open each problem to see:
   • Compartment
   • VCN
   • Security List or NSG name
   • Offending rule (protocol/ports/source/destination)

B. Manually via Networking (if Cloud Guard not in use)

1. Go to ☰ → Networking → Virtual Cloud Networks.
2. For each relevant VCN, check both:
   • Security Lists
   • Network Security Groups

You’re looking for any rule where:

• Protocol = TCP, UDP, or All, and
• Destination port is a range like 0-65535, 1-65535, or left as “all”.

---

2. Fix Security List rules

1. Go to ☰ → Networking → Virtual Cloud Networks.
2. Click the VCN that contains the bad rule.
3. In the left pane, click Security Lists.
4. Click the Security List name.
5. Under:
   • Ingress Rules: to fix incoming rules.
   • Egress Rules: to fix outgoing rules.
6. Click Edit All Rules (or Add Ingress Rule / Add Egress Rule as needed).

For each non-compliant rule:

• Note what it is being used for (SSH, HTTP, DB, etc.).
• Decide the specific port(s) required (e.g., 22, 80, 443, 1521).

Then either:

• Option 1 – Replace the rule (recommended):

  1. Delete the “all ports” rule from the list.
  2. Add one or more new rules with:
     • Source (ingress) or Destination (egress) narrowed (CIDR or specific subnet).
     • IP Protocol = TCP/UDP (avoid All if not required).
     • Destination Port Range = the specific port or small port range (e.g., 22, 443, 1024-1040).

• Option 2 – Narrow the port range:

  • If you cannot yet fully restrict to single ports, change the Destination Port Range from 0-65535 to a minimal necessary range.

7. Click Save Changes.

Repeat for each security list with an all-ports rule.

---

3. Fix Network Security Group (NSG) rules

1. Go to ☰ → Networking → Virtual Cloud Networks.
2. Click the VCN.
3. Click Network Security Groups.
4. Click the NSG name.
5. Check:
   • Ingress Rules
   • Egress Rules

For every rule with all ports open:

1. Click the Actions menu (three dots) next to the rule and choose Remove.
2. Click Add Ingress Rule or Add Egress Rule to re-create a restricted rule:
   • Source Type/Destination Type: CIDR, NSG, or Service.
   • Source/Destination: Narrow as much as possible.
   • IP Protocol: Prefer TCP or UDP, not All.
   • Destination Port Range: Enter the exact port or narrow range (e.g., 22, 443, 1433, etc.).
3. Click Add Ingress Rule / Add Egress Rule to save.

Repeat for all NSGs with all-ports rules.

---

4. Validate using Monitoring / Cloud Guard

1. If Cloud Guard is enabled:

   • Go to ☰ → Security → Cloud Guard → Detections.
   • Confirm the earlier problems are now Resolved or in a non-failing state after the next evaluation cycle.

2. Optionally, use:

   • VCN Flow Logs or Network Monitoring features to verify legitimate traffic still works.
   • Connectivity tests (SSH, HTTP, application checks).

---

5. General hardening tips (brief)

• Never leave:
  • Ingress: 0.0.0.0/0 to All Protocols on All Ports.
  • Wide open egress rules to all destinations on all ports from sensitive subnets.
• Use:
  • Minimal required ports.
  • Private CIDRs or specific NSGs as source/destination instead of public 0.0.0.0/0 where possible.
  • Separate NSGs per application tier (web, app, DB) to keep rules tight.

If you share an example of an existing rule (source, protocol, current port range, and what it’s used for), I can give you an exact “before and after” rule set to apply in the console.

Using CLI

Below is a practical, CLI‑only way to identify and remediate “allow all ports” rules in OCI network security lists and NSGs.

---

1. Prerequisites

• OCI CLI installed and configured (oci setup config)
• Your compartment OCID handy: ocid1.compartment.oc1...

Set a helper variable:

COMPARTMENT_ID="<your_compartment_ocid>"

---

2. Identify Problem Rules

2.1. Security Lists

List all security lists in the compartment:

oci network security-list list \
  --compartment-id "$COMPARTMENT_ID" \
  --all

For each security list OCID, inspect rules:

SEC_LIST_ID="<security_list_ocid>"

oci network security-list get \
  --security-list-id "$SEC_LIST_ID" \
  --query 'data."ingress-security-rules"'

You’re looking for rules with:

• 0.0.0.0/0 or wide CIDR (e.g., 0.0.0.0/0, ::/0)
• protocol = "all" or tcpOptions / udpOptions with:
  • destination-port-range.min = 1 and max = 65535 (or missing = all ports)

Repeat with egress if required:

oci network security-list get \
  --security-list-id "$SEC_LIST_ID" \
  --query 'data."egress-security-rules"'

---

2.2. Network Security Groups (NSGs)

List NSGs:

oci network nsg list \
  --compartment-id "$COMPARTMENT_ID" \
  --all

For each NSG:

NSG_ID="<nsg_ocid>"

oci network nsg rules list \
  --network-security-group-id "$NSG_ID" \
  --all

Again, identify rules that:

• Allow from 0.0.0.0/0 or ::/0
• Have protocol = "all" or full port ranges (1–65535)

---

3. Remediate Security List Rules (CLI)

You cannot partially edit a single rule on security lists; you must update the list with a new JSON definition of rules.

3.1. Export Existing Security List

SEC_LIST_ID="<security_list_ocid>"

oci network security-list get \
  --security-list-id "$SEC_LIST_ID" \
  --query 'data' > sec-list.json

sec-list.json will look roughly like:

{
  "id": "ocid1.securitylist.oc1....",
  "display-name": "my-security-list",
  "ingress-security-rules": [
    {
      "source": "0.0.0.0/0",
      "protocol": "6",
      "tcp-options": {
        "destination-port-range": {
          "min": 1,
          "max": 65535
        }
      }
    }
  ],
  "egress-security-rules": [
    {
      "destination": "0.0.0.0/0",
      "protocol": "all"
    }
  ],
  ...
}

3.2. Edit the JSON Locally

• Remove any “allow all ports” rules, or
• Narrow to specific ports (e.g., 80 and 443) and/or CIDRs.

Example corrected ingress rule for HTTP/HTTPS only:

"ingress-security-rules": [
  {
    "source": "0.0.0.0/0",
    "protocol": "6",
    "tcp-options": {
      "destination-port-range": {
        "min": 80,
        "max": 80
      }
    }
  },
  {
    "source": "0.0.0.0/0",
    "protocol": "6",
    "tcp-options": {
      "destination-port-range": {
        "min": 443,
        "max": 443
      }
    }
  }
]

When done, keep only fields expected by the update API. Safest: build a minimal JSON like:

{
  "ingressSecurityRules": [
    {
      "source": "0.0.0.0/0",
      "protocol": "6",
      "tcpOptions": {
        "destinationPortRange": {
          "min": 80,
          "max": 80
        }
      }
    },
    {
      "source": "0.0.0.0/0",
      "protocol": "6",
      "tcpOptions": {
        "destinationPortRange": {
          "min": 443,
          "max": 443
        }
      }
    }
  ],
  "egressSecurityRules": [
    {
      "destination": "0.0.0.0/0",
      "protocol": "6",
      "tcpOptions": {
        "destinationPortRange": {
          "min": 443,
          "max": 443
        }
      }
    }
  ]
}

Save as sec-list-update.json.

3.3. Apply the Update

oci network security-list update \
  --security-list-id "$SEC_LIST_ID" \
  --from-json file://sec-list-update.json

Repeat for each affected security list.

---

4. Remediate NSG Rules (CLI)

With NSGs, you can add or delete individual rules.

4.1. Delete “Allow All Ports” Rule

First list rules with OCIDs:

oci network nsg rules list \
  --network-security-group-id "$NSG_ID" \
  --all

Find the offending rule, note its id:

RULE_ID="<nsg_rule_ocid>"

oci network nsg rules delete \
  --network-security-group-id "$NSG_ID" \
  --security-rule-id "$RULE_ID" \
  --force

4.2. Add Restrictive Rule(s)

Example: allow inbound TCP 22 from a specific admin subnet only:

oci network nsg rules add \
  --network-security-group-id "$NSG_ID" \
  --security-rules '[
    {
      "direction": "INGRESS",
      "protocol": "6",
      "source": "10.0.0.0/24",
      "isStateless": false,
      "tcpOptions": {
        "destinationPortRange": {
          "min": 22,
          "max": 22
        }
      }
    }
  ]'

Adjust source, ports, and direction as needed.

---

5. Tie to Monitoring / Cloud Guard

If this finding came from Cloud Guard:

• After fixing rules, you can re-evaluate problems or wait for the next assessment.
• Optionally, configure a Responder Recipe in Cloud Guard that:
  • Detects rules with 0.0.0.0/0 + all ports / all protocols.
  • Triggers a responder that removes or restricts those rules (if you want automation).

This configuration is usually done via Console, but can also be managed with oci cloud-guard CLI commands if needed.

---

If you paste one example of a current security list / NSG rule JSON, I can give you an exact before/after JSON and CLI line for that specific rule.

Using Python

Below is a practical way to detect and remediate “allow all ports” rules in OCI Network Security using Python and the OCI SDK.

We’ll:

1. Identify which objects to scan (Security Lists and/or Network Security Groups).
2. Detect rules that allow “all ports”.
3. Update them to a more restrictive configuration (or at least flag them).

---

0. Prerequisites

1. Install the OCI Python SDK:

pip install oci

2. Have your OCI config file in place (typically ~/.oci/config) with a profile, e.g. [DEFAULT].

3. Know:

   • The compartment OCID you want to scan.
   • Whether you want to check Security Lists, NSGs, or both.

---

1. Logic to Detect “Allow All Ports” Rules

In OCI, “allow all ports” is usually:

• tcp_options or udp_options:
  • Either destination_port_range missing (means any port), or
  • destination_port_range.min == 1 and max == 65535 (or 0–65535 in older configs).
• OR protocol == "all" / "all" in security lists.
• Source CIDR often "0.0.0.0/0", but even non-0.0.0.0/0 can be too broad depending on your policy.

You may need to refine your exact detection criteria based on your security policy (e.g., only flag 0.0.0.0/0).

---

2. Python Script: Scan and Remediate Security Lists

This example:

• Lists all Security Lists in a compartment.
• Finds ingress rules that:
  • Source is 0.0.0.0/0, and
  • Protocol is 6 (TCP) or 17 (UDP) or "all", and
  • Ports are unrestricted.
• Remediation example: removes those rules or replaces them with a specific allowed port (e.g., 22).

Adjust to your needs.

import oci

# CONFIG
PROFILE = "DEFAULT"  # OCI CLI profile
COMPARTMENT_ID = "<your_compartment_ocid>"
DRY_RUN = True  # Set False to apply changes
RESTRICT_TO_PORT = 22  # Example target port for remediation (SSH)

config = oci.config.from_file("~/.oci/config", PROFILE)
network_client = oci.core.VirtualNetworkClient(config)

def is_all_ports_ingress(rule):
    """
    Determine if an ingress rule effectively allows all ports.
    Adjust logic per your policy.
    """
    # Only inspect 'ALLOW' rules
    if rule.action != "ALLOW":
        return False

    # Focus on public ingress from anywhere
    if rule.source != "0.0.0.0/0":
        return False

    # Protocol "all"
    if rule.protocol == "all":
        return True

    # TCP = 6, UDP = 17
    if rule.protocol not in ["6", "17"]:
        return False

    # Get tcp_options or udp_options
    opts = rule.tcp_options if rule.protocol == "6" else rule.udp_options

    # No options means all ports
    if not opts:
        return True

    if not opts.destination_port_range:
        return True

    min_port = opts.destination_port_range.min
    max_port = opts.destination_port_range.max

    # Heuristic: min 1, max 65535 => essentially all ports
    if min_port <= 1 and max_port >= 65535:
        return True

    return False

def build_restricted_rule(rule, port):
    """
    Build a new rule restricted to a specific port.
    You can customize this to suit your needs.
    """
    # Clone the rule but constrain the port
    # For "all" protocol, we’ll restrict only TCP here, adjust as needed.
    if rule.protocol == "all" or rule.protocol == "6":
        proto = "6"
        tcp_options = oci.core.models.TcpOptions(
            destination_port_range=oci.core.models.PortRange(
                min=port,
                max=port
            )
        )
        udp_options = None
    elif rule.protocol == "17":
        proto = "17"
        tcp_options = None
        udp_options = oci.core.models.UdpOptions(
            destination_port_range=oci.core.models.PortRange(
                min=port,
                max=port
            )
        )
    else:
        # For other protocols, just return as is or skip
        return rule

    return oci.core.models.IngressSecurityRule(
        protocol=proto,
        source=rule.source,
        is_stateless=rule.is_stateless,
        source_type=rule.source_type,
        description=f"RESTRICTED: {rule.description or ''}".strip(),
        tcp_options=tcp_options,
        udp_options=udp_options
    )

def remediate_security_lists():
    print(f"Scanning Security Lists in compartment: {COMPARTMENT_ID}")
    sls = oci.pagination.list_call_get_all_results(
        network_client.list_security_lists,
        compartment_id=COMPARTMENT_ID
    ).data

    for sl in sls:
        print(f"\nSecurity List: {sl.display_name} ({sl.id})")

        original_ingress = sl.ingress_security_rules or []
        bad_rules = [r for r in original_ingress if is_all_ports_ingress(r)]

        if not bad_rules:
            print("  No 'allow all ports' ingress rules found.")
            continue

        print(f"  Found {len(bad_rules)} overly permissive ingress rule(s).")

        # Create new ingress rules list without bad rules
        new_ingress = []
        for r in original_ingress:
            if r in bad_rules:
                print(f"    Will modify/remove rule: {r}")
                # Example: restrict to a given port
                new_rule = build_restricted_rule(r, RESTRICT_TO_PORT)
                if new_rule:
                    new_ingress.append(new_rule)
                    print(f"      -> Replaced with restricted rule on port {RESTRICT_TO_PORT}")
                # Or you could simply skip adding it to remove it
                # (i.e., delete the rule entirely).
            else:
                new_ingress.append(r)

        if DRY_RUN:
            print("  DRY_RUN enabled: not applying changes.")
        else:
            print("  Updating security list...")
            update_details = oci.core.models.UpdateSecurityListDetails(
                ingress_security_rules=new_ingress,
                egress_security_rules=sl.egress_security_rules
            )
            network_client.update_security_list(
                security_list_id=sl.id,
                update_security_list_details=update_details
            )
            print("  Update complete.")

if __name__ == "__main__":
    remediate_security_lists()

---

3. Python Script: Scan and Remediate NSG Security Rules (Optional)

If you’re using NSGs, similar logic applies, but using NetworkSecurityGroupRulesClient.

Skeleton:

from oci.core import VirtualNetworkClient, NetworkSecurityGroupRulesClient
from oci.core.models import UpdateNetworkSecurityGroupSecurityRulesDetails

config = oci.config.from_file("~/.oci/config", PROFILE)
vcn_client = VirtualNetworkClient(config)
nsg_rules_client = NetworkSecurityGroupRulesClient(config)

def remediate_nsgs():
    nsgs = oci.pagination.list_call_get_all_results(
        vcn_client.list_network_security_groups,
        compartment_id=COMPARTMENT_ID
    ).data

    for nsg in nsgs:
        print(f"\nNSG: {nsg.display_name} ({nsg.id})")

        rules = oci.pagination.list_call_get_all_results(
            nsg_rules_client.list_network_security_group_security_rules,
            network_security_group_id=nsg.id
        ).data

        bad_rules = [r for r in rules if is_all_ports_ingress(r) and r.direction == "INGRESS"]
        if not bad_rules:
            print("  No 'allow all ports' ingress rules found.")
            continue

        print(f"  Found {len(bad_rules)} overly permissive ingress rule(s).")

        # Build patch: remove / replace the bad rules
        # NOTE: NSG rule updates use `UpdateNetworkSecurityGroupSecurityRulesDetails`
        # with `security_rules` list including all desired rules.
        new_rules = []
        for r in rules:
            if r in bad_rules:
                print(f"    Will modify/remove rule: {r.id}")
                new_rule = build_restricted_rule(r, RESTRICT_TO_PORT)
                if new_rule:
                    new_rules.append(new_rule)
            else:
                new_rules.append(r)

        if DRY_RUN:
            print("  DRY_RUN enabled: not applying changes.")
        else:
            print("  Updating NSG rules...")
            update_details = UpdateNetworkSecurityGroupSecurityRulesDetails(
                security_rules=new_rules
            )
            nsg_rules_client.update_network_security_group_security_rules(
                network_security_group_id=nsg.id,
                update_network_security_group_security_rules_details=update_details
            )
            print("  Update complete.")

(You’ll need to slightly adapt is_all_ports_ingress and build_restricted_rule for NSG rule models, but the concepts are identical.)

---

4. Operationalizing as “Monitoring”

To make this actual “monitoring” for OCI networking:

1. Run this script on a schedule:
   • Use a cron job on a bastion/management host or
   • Use OCI Functions + Events (triggered on CreateNetworkSecurityGroupSecurityRules, UpdateSecurityList, etc.).
2. Start with DRY_RUN = True to log-only.
3. Send findings to:
   • OCI Logging,
   • Email (via OCI Notifications),
   • SIEM, etc.
4. After validating, switch to DRY_RUN = False to auto-remediate.

---

If you specify:

• Exact allowed ports,
• Whether to delete or tighten rules, I can tailor the code to your precise security policy.

Using Terraform

# Network Security Group
resource "oci_core_network_security_group" "example_nsg" {
  compartment_id = VAR_COMPARTMENT_OCID   # replace with your compartment OCID
  vcn_id         = VAR_VCN_OCID           # replace with your VCN OCID
  display_name   = "example-nsg"
}

# INSECURE (do NOT use): allows all protocols / all ports
# resource "oci_core_network_security_group_security_rule" "allow_all_inbound" {
#   network_security_group_id = oci_core_network_security_group.example_nsg.id
#   direction                 = "INGRESS"
#   protocol                  = "all"                  # or "6" (TCP) with full port range 1-65535
#   source                    = "0.0.0.0/0"
# }

# SECURE: restrict to required protocol and ports instead of all ports / all protocols
resource "oci_core_network_security_group_security_rule" "allow_inbound_tcp_443" {
  network_security_group_id = oci_core_network_security_group.example_nsg.id

  direction = "INGRESS"
  protocol  = "6"                       # TCP

  source      = "ALLOWED_CIDR_BLOCK"    # replace with the specific CIDR (e.g., "203.0.113.0/24")
  source_type = "CIDR_BLOCK"

  tcp_options {
    destination_port_range {
      min = 443                         # replace with the required port
      max = 443
    }
  }

  stateless = false
}

# Example: restrict outbound as well, if you previously had an "allow all" egress rule
resource "oci_core_network_security_group_security_rule" "allow_egress_tcp_443" {
  network_security_group_id = oci_core_network_security_group.example_nsg.id

  direction = "EGRESS"
  protocol  = "6"                       # TCP

  destination      = "ALLOWED_CIDR_BLOCK"  # replace with specific CIDR or service CIDR
  destination_type = "CIDR_BLOCK"

  tcp_options {
    destination_port_range {
      min = 443
      max = 443
    }
  }

  stateless = false
}

Changing protocol = "all" or a full 1-65535 port range to specific protocol/ports updates the security rule in place and does not force replacement of the NSG itself, but the rule resources will be modified and traffic not matching the new ports will be blocked.

To verify, terraform plan should no longer show rules with protocol = "all" or TCP/UDP options spanning ports 1-65535, and instead show updates (or creates/destroys) that narrow each rule to the required ports and CIDRs.