Re: [fw-wiz] About Port Forwarding, Apache and Firewall Rules

From: Barney Wolff (barney_at_databus.com)
Date: 08/30/04

  • Next message: Jim Seymour: "Re: [fw-wiz] About Port Forwarding, Apache and Firewall Rules" 
    To: firewall-wizards@honor.icsalabs.com
Date: Mon, 30 Aug 2004 11:58:16 -0400

    On Mon, Aug 30, 2004 at 07:52:50AM -0400, Jim Seymour wrote:
    >
    > I've seen it argued, by residential broadband customers, that "my ISP
    > doesn't really care." Maybe sometimes they don't. But I suspect any
    > ISP that's gone to the trouble to block inbound port 80 really means
    > it. And I really think firewall-wizards ought not be actively helping
    > somebody violate their ISP's TOS. What's next: "Can you help me set up
    > a secure 'bot net?"

    How did we get from {ISP blocks inbound connects to port 80} to
    {customer is not allowed to run any servers}? I don't see that as
    a logical conclusion. If the ISP wanted to block all servers it could
    perfectly well block inbound connects to all ports and make its customers
    use passive ftp, which they should be doing anyway. If the actual TOS
    says no servers, that's another story, but if the OP said that I missed it.
    The ISP may be blocking 80 to protect customers from running inadvertent
    servers - we know that IIS is sometimes activated by things that one
    would not expect, and in those cases is unlikely to be patched.

    In any case, Apache can be configured to listen on any port, so there is
    no particular reason to have to translate the port number when going
    through the NAT. 

    -- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Jim Seymour: "Re: [fw-wiz] About Port Forwarding, Apache and Firewall Rules"

    Relevant Pages

    • Re: Workarounds for blocked port 25 on outgoing e-mail
      ... I have multiple POP3 ... because of something on my side, but because of the ISP they use. ... > Port 587 is the mail submission port, and is supported by sendmail, ... POP3 servers through esosoft.com. ...
      (freebsd-isp)
    • Re: Setup Internal caching DNS Server
      ... > impossible to run your own resolver, so you can resolve names for ... > Many ISPs won't let you run servers, but that doesn't mean you can't run ... It's becoming more common to block port 25 outbound, but a sensible ISP ...
      (Fedora)
    • Re: My Internet server is not available to my friends
      ... Is your ISP blocking TCP Port 80 (IIS)? ... servers and your ISP is blocking that port for everyone if your not using a business class service. ...
      (microsoft.public.windowsxp.network_web)
    • Re: Networking Question
      ... It is possible that they block all traffic to customers ... servers, but they don't proactively prevent it. ... sharing their disks with the entire Internet. ... On a case-by-case basis they will block port 25 on customers who appear ...
      (comp.sys.mac.system)
    • Re: port to be restricted
      ... >I have a doubt regarding to the setting up security of an ISP. ... Some ISPs block outbound connections to port 25, ... customers from using open relays to send spam. ... to protect customers who don't restrict access to their ...
      (comp.security.unix)
    • Quantcast