RE: Firewalling

From: Dave Vehrs (davev@spiremedia.com)
Date: 08/20/01 

From: "Dave Vehrs" <davev@spiremedia.com>
To: "'Rob 'Feztaa' Park'" <fezziker@home.com>
Subject: RE: Firewalling
Date: Mon, 20 Aug 2001 08:51:24 -0600
Message-ID: <007201c12987$9635b330$9701010a@spiremedia.com>

        First, when you send traffic to yourself in Linux, it always uses the loop
back interface. To test this, add a rule to your firewall that denies all
traffic coming to your external interface and ip from the external ip (i.e.
ipchains -A INPUT -i eth0 -s <external_ip> -d <external_ip> -j DENY). Then
do the scan, and it will still get through. (Tested with 2.2 kernel,
assumed to be the same for 2.4).
        Second, to correctly scan yourself, you will need to do it from an outside
source. Either find a web page that does reverse scans, do an ftp-bounce
scan or have a friend do it.
        Third, read the nmap documentation (start with
http://www.nmap.org/nmap/nmap_doc.html and
http://www.nmap.org/nmap/nmap_manpage.html). This will explain how to use
NMAP and what the results mean. For example the reason that the FIN scan
reports that all ports are open is because you have the DROP rule in place.
During a FIN scan, open ports ignore the packet, and closed port will
respond with the correct RST packet. So your drop rule creates a situation
where all ports do not respond and thus appear to be open.

RTFM!

Dave V.

Relevant Pages

  • Audited an ISA 2000 - part I
    ... Did an internal and an external port scan on a production ISA 2000 server ... and found the following ports opened, ... The external scan, i.e., scanning the server from the internet, which ... 135 (also appears on the external interface.) ...
    (microsoft.public.isaserver)
  • Ports open on a firewall
    ... the following ports were opened, ... The external scan, i.e., scanning the server from the internet, which ... 135 (also appears on the external interface.) ... 139 (NETBIOS Session Service) ...
    (comp.security.firewalls)
  • Re: Ports open on a firewall
    ... the following ports were opened, ... The external scan, i.e., scanning the server from the internet, which ... 135 (also appears on the external interface.) ... 139 (NETBIOS Session Service) ...
    (comp.security.firewalls)
  • Firewalling
    ... Subject: Firewalling ... Ok, I've been fooling around with stateful firewalls, and when I portscan ... I'm not sure if I'm generating false ... FIN packet scan tells me that ALL my ports are open. ...
    (Focus-Linux)
  • Re: How to block traffic in and out to all ports....
    ... firewalling howtos except you. ... > computer won't be using the ports. ... If you want to blockade outgoing ... packets, do so, but your machine will be generally inoperative. ...
    (linux.redhat.misc)