Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS)

From: "Luis Fernando Barrera" <[email-masked]>
Date: Thu, 19 Oct 2000 09:31:48 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

So...what's the difference,
 security-wise, between using a proxy and using port
 forwarding?

Luis

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Keith Young
Sent: Thursday, October 19, 2000 6:41 AM
To: Keith V. Olson
Cc: Rick Murphy; [email-masked]
Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

"Keith V. Olson" wrote:
> 
> One more question.  About that faq item (2.4.13), there is a
> statement... "Your best bet for this is to use a plug-gw;
> however, that will not protect the web server from penetration
> attempts."  I had thought the purpose of proxy-ing an inbound
> connection was to 'plug' a hole in the firewall and prevent a
> root access type attack against the internal server running
> the webserver?  If not then what's the difference,
> security-wise, between using a proxy and using port
> forwarding?

What I was trying to say in the FAQ is that if someone finds a hole in
your web server and it is on your inside network, then they will have
access to your network. The plug proxy cannot protect against bugs in
web servers or CGI scripts.

You may want to consider putting the web server in a DMZ (third network
interface of your firewall box). This will have the firewall protect the
server from the Internet, and will also force attackers to break through
the firewall in order to get to the inside network.

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]