Subject: Blocking ports

From: Douglas Bowerman <[email-masked]>
Date: Wed, 14 Feb 2001 15:13:34 GMT

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello all,
After seeing the Frontline Hackers on PBS last night I did some checking.
The Sygate Tech Quickscan said something about ideally having Blocked 
ports not just closed.  

This may be of a Linux nature, but I'm new to this stuff.

I built the firewall and compiled the software two years ago.  It has 
been running since then and I have not really touched it.

This may have been covered in previous posts, which I have scoured all 
information without finding "HOW".

How do I block ports, and make our firewall secure?

We would need SMTP, POP, HTTP, HTTPS or course.

Thanks,
Doug

---

From: Jan Muenther <[email-masked]>
Date: Wed, 14 Feb 2001 16:26:36 +0000

> The Sygate Tech Quickscan said something about ideally having Blocked

Very interesting expression. Basically, a TCP port can either be
open or closed, I'd say. I think what this tech might have wanted
to say was it's better to send back a RST flagged packet instead
of just sinking unwanted traffic in the network stack's nirvana.
This has nothing to do with how an application layer gateway like
the TIS fwtk works. 

> This may be of a Linux nature, but I'm new to this stuff.

It's not. It has to do with IP rather than with Linux or Unix or
whatever OS. 
 
> been running since then and I have not really touched it.

Ooops. I hope you did at least install the vendor's security
fixes for your OS.

> How do I block ports, and make our firewall secure?

You don't have to do that. Application level gateways like the
fwtk function with the use of proxies, which appear as open
services to the outside, but do a critical inspection of what
traffic they receive. Only if this is compliant with the protocol
of the relevant application, traffic is further processed. So, as
you see, for an application proxy it's fairly normal to have
'its' port open. 

It is, however, a good idea to use a packet filter
_additionally_, depending upon your needs and resources. 
 
> We would need SMTP, POP, HTTP, HTTPS or course.

Well, smap, plug-gw and http-gw should be able to work finely for
you. 

Cheers, Jan
-- 
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
[email-masked]

---

From: Berend De Schouwer <[email-masked]>
Date: Wed, 14 Feb 2001 17:33:33 +0200

On Wed, 14 Feb 2001 17:13:34 Douglas Bowerman wrote:
| [To be removed from this list send the message "unsubscribe fwtk-users"
| in the
| BODY of a mail message to [email-masked].]
| 
| Hello all,
| After seeing the Frontline Hackers on PBS last night I did some checking.
| The Sygate Tech Quickscan said something about ideally having Blocked 
| ports not just closed.  
|
| This may be of a Linux nature, but I'm new to this stuff.
| 
| I built the firewall and compiled the software two years ago.  It has 
| been running since then and I have not really touched it.

Blocking ports (IP filtering) and running an application proxy/firewall
(TIS FWTK) are complimentary.  One enhances the other.

| This may have been covered in previous posts, which I have scoured all 
| information without finding "HOW".

Search for IP filtering.
  
| How do I block ports, and make our firewall secure?

Since Linux is the only OS you mention:
Linux 2.0.x uses ipfwadm
Linux 2.2.x uses ipchains (there is a ipfwadm2ipchains script)
Linux 2.4.x uses iptables

Search for man pages or howtos on these commands.

Off-topic: when did ip-based filtering get into the kernel?
I seem to recall (some) support in 1.2.x; but I haven't recompiled
a 1.2.x kernel in 6 months.
  
| We would need SMTP, POP, HTTP, HTTPS or course.
| 
| Thanks,
| Doug
| 
Kind regards,				  
Berend                                  

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Berend De Schouwer, +27-11-712-1435, UCS