EdgeRouter

With firewall rules finally on the box, I went back to the guest VLAN I’d set out to build. I isolated it cleanly from every other subnet, tested it, and shipped it. Then I realized guests could still walk right up to the router’s own admin page. The same blind spot from last time, pointed inward.

I sat down to do a routine bit of network segmentation and instead found my router had been sitting on a public IP with SSH and its admin GUI open to the internet, no firewall rules at all. A lesson in the difference between ‘working’ and ‘secure.’