Re: [fw-wiz] Query: Why bother with an application proxy over stateful packet filtering?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thanks Andy.

You've given me food for thought.

First point:

While agree with you view of controlling telnet or in appropriate
protocols across a firewall as compared with using a more fine grained
web proxy, i can still by pass the proxy via "httptunnel" for example.

So both proxy and firewall can be equally subverted internally via out
bound traffic to a rogue service listening on a http port.

Second Point:
also iptables could use its "string matching" to filter in appropriate
sites that match content keywords or even based on a black-hole list.

I guess I am still struggling to see any real benefits as of right now
apart from the obvious web caching abilities but thats not what this
discussion is about.

I will dig deeper, starting with Patrick Hausen's reading list (previous
post reply) first and move from there.

regards,
Will.

PS: i drive a Mazda B2500 4X4. I too am interested in 4x4's also and I
plan on getting an old cheap jeep to enjoy some off-roading as a hobby.


Andy Cunningham wrote:
william fitzgerald nearly made me spill my Shiraz on 08/27/2007 03:05 PM
by writing:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Experts,

I am interested in knowing ore about network access control via various
kinds of firewalls.

I am wondering why would the be a need to web up a proxy such as a web
proxy (Squid) instead of just using a stateful packet filtering firewall
(iptables) only in a network?

The two usual reasons are protocol enforcement and content filtering.

A stateful packet inspection firewall will allow anything you like once
the initial TCP handshake has been approved, so there's nothing stopping
me setting up a telnet server on port 80 and connecting to that from
inside the office. If the only thing allowed to communicate to the
firewall is the proxy server, you know you're only ever doing http.

There are a number of plugins for proxy servers that mean you can filter
inappropriate sites and otherwise control access in ways a pure firewall
can't. Some of this functionality is available in some newer firewalls
systems if you want a single device.

Hope that helps.

Andy


- --
William M. Fitzgerald,
PhD Student,
Telecommunications Software & Systems Group,
ArcLabs Research and Innovation Centre,
Waterford Institute of Technology,
WIT West Campus,
Carriganore,
Waterford.
Office Ph: +353 51 302937
Mobile Ph: +353 87 9527083
Web: www.williamfitzgerald.org



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFG0u9fIcwlebz1MmwRAnwcAKDV1HGEStrEAoByig3iHKDx3xqLtACgycxc
XHQbBu8SUU0uGyNdODoCvQI=
=KRqS
-----END PGP SIGNATURE-----
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: [fw-wiz] dirty packet tricks?
    ... solve via promiscuously sucking up packets. ... restriction that your 'sideways' proxy box is it will have to be on a hub ... The firewall will have to suppress all ICMP errors to the internal network ...
    (Firewall-Wizards)
  • Re: [fw-wiz] Query: Why bother with an application proxy over stateful packet filtering?
    ... or in place of a firewall. ... proxy functionality, and many commercial web proxy products market ... In big business I often see an ingress+egress packet filter (a "filter ... web proxy, i can still by pass the proxy via "httptunnel" for example. ...
    (Firewall-Wizards)
  • [REVS] Placing Backdoors Through Firewalls
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... This article describes possible back-doors through different firewall ... This is the enhanced version of a packet filter. ... A proxy as a firewall host is simply any server which has no routing ...
    (Securiteam)
  • Re: [fw-wiz] httport 3snf
    ... >> wouldn't have gotten SSH out of my firewall. ... > Postfix SMTP server with a wildcard MX that handed the mail that wasn't ... > destined to me off to the downstream MS stuff, and an HTTP proxy server ... All it needs is a written policx "Internet access is ...
    (Firewall-Wizards)
  • Re: Kids bypassing firewall via web proxy sites
    ... We use a Sonicwall firewall, 3060, I subscribe to content fltering, ... I checked "Access to HTTP Proxy Servers" But I am still able to get to ... CyBlock, which does network proxy and filtering ...
    (comp.security.firewalls)