Segments may reach the shared resolver, directory and log collector outbound only, and the permit cannot be narrowed — what does an adversary who owns one of those hosts still reach?

## The misconception this question targets A competent engineer will often say: the shared services are safe to permit because segments only *initiate* to them and nothing initiates back. That is a real property of the rule base and it is worth having. It is also much weaker than it sounds. ## Why replies do not need an inbound rule A stateful filter records each permitted connection in a state table. When packets arrive that match an existing entry in the reverse direction, they are permitted **by the entry**, not by a rule. Nobody has to write an inbound permit; the outbound permit created the bidirectional path as a side effect. That is the entire point of stateful filtering, and it is why "no inbound rules" reads as stronger than it is. A stateless filter does not change the outcome, only the bookkeeping: you would have to write an explicit, usually wide, return rule instead. The reply path exists either way. So the honest statement is: an outbound permit to a service is a **two-way data path with that service**, initiated by one side. ## Duration matters as much as direction Some of the universal set is request/response and short-lived. Some is not: - A log-shipping agent typically holds a long-lived transport connection to the collector. - A directory session can persist across many operations. - Connection reuse means one permitted flow serves many logical exchanges. For the life of those connections there is a continuously open channel from a compromised service into a host inside a segment your policy was written to protect. ## The answers are the attack surface Even with no packet-level cleverness, a hostile universal service influences behaviour purely by responding: - **The resolver chooses the next destination.** Every subsequent connection the client makes goes where the answer said. The resolver never opens a connection into the segment; it does not need to. - **The directory returns the verdict.** Whether an authentication succeeds, which groups come back, and which referrals the client is told to follow are all supplied by the service. Applications act on those answers. - **The collector's acknowledgements and any configuration it hands back** are parsed by an agent that usually runs with high privilege on the host. And in all three cases the response is parsed by client-side code. Parsers are where memory-safety and injection defects live, and this parser is running inside the segment. ## What the network permit did and did not establish The rule established that packets may flow to a destination address on a port. It established nothing about **who is at that address** or whether the answer is genuine. A network permit is not authentication, and this is the sentence worth saying in an interview. Conflating the two is how a permit intended as "my hosts may reach my directory" degrades into "my hosts will trust whatever answers on that address". ## Do not forget the permits in the other direction In a self-operated estate, parts of the shared tier genuinely do initiate inbound: replication between directory instances, management or configuration pushed to agents, health polling. Those permits are written separately, are often older than the segmentation project, and are frequently forgotten in the "we only allow outbound" story. Enumerate them before you make the claim. ## What is actually left to do When the permit cannot be narrowed, the remaining controls are not network controls: 1. **Authenticate the service to the client.** Mutual or server-side authentication with a trust anchor you control proves the far end is the service you meant, which the permit never proved. It does not help if the service itself is the compromised thing — be honest about that limit. 2. **Narrow by protocol and by service, not just by address.** A segment that needs resolution does not need a directory bind. One universal destination set is convenient and is also the maximal grant. 3. **Split the four.** Different hosts, different credentials, different administration, so one compromise yields one capability. 4. **Watch the tier's own outbound.** Legitimately the universal tier originates very little. That makes its outbound one of the highest-signal, lowest-noise things in the estate, and it is the direction a compromise there has to use eventually. 5. **Reduce what the client does with an answer.** Pinned trust, validated responses and applications that re-check authorisation rather than trusting a returned group list all shrink the blast radius of a bad reply. ## The summary claim Direction limits who may start. It does not limit who may answer, how long the channel stays open, or what the client does with what it is told.