Re: Router Packet Filtering and Firewalls

From: Wayne Penny (WPenny@bank-banque-canada.ca)
Date: 01/30/03

  • Next message: David Gillett: "RE: Risk analysis tools?" 
    Date: Thu, 30 Jan 2003 12:38:20 -0500
From: "Wayne Penny" <WPenny@bank-banque-canada.ca>
To: <geoff.shatz@pchelps.com>, <security-basics@securityfocus.com>

    It's always a good idea to apply some 'depth' to your defenses at your network perimeter. Using a filtering router between your firewall and the ISP is a good idea to take some of the load off your firewall for more basic filtering at the router ACL level. But implement your own filtering router and don't rely on the ISP to filter for you (your network, your rules, your control).

    wp

    >>> Geoff Shatz <geoff.shatz@pchelps.com> 01/29/03 05:54PM >>>

    I am trying to confirm my thoughts regarding the use of router packet
    filtering in addition to having a firewall behind the router but first a
    little background...

    Years ago when we first connected our firm to the Internet we did not have
    a firewall but used packet filtering on the router to protect our
    perimeter.

    As time progressed and security became a much greater issue for everyone
    in IT we moved forward an installed a firewall between our router and the
    LAN. I was managing our router at that time and kept the initial packet
    filters in place as I figured two layers of security were better than one.

    A few years ago we were forced to switch ISP's and our new ISP managed the
    router they supplied to us. They supplied the router with no ACL's applied
    to either interface which as I understand it with Cisco IOS creates an
    implicit permit for both inbound and outbound.

    After contacting technical support I was told none of their customers use
    packet filtering at the router level and that's what a firewall was for.
    I had a small battle with them but they finally relented and configured
    the router the way I asked them to.

    We just had a second circuit installed and I had to go through the same
    routine with them and the end result was the same.

    Am I missing something here? Is it not better to have both packet
    filtering applied on the router and a firewall behind it? Is there
    something inherently wrong with this or is this just a case of our ISP not
    really giving a damn about security and on top of it being lazy? Any
    comments would be appreciated.

    -Geoff

    Relevant Pages

    • Re: 56k dial up on laptop 802.11G ?
      ... >> firewall, which consist of a proxy server that does indeed break ... The FW appliance uses an Application gateway/proxy FW ... >the packet filtering FW, from what I understand. ... >My view of the 54G router was based on the other Linksys ...
      (alt.internet.wireless)
    • Re: [fw-wiz] Botnets, IRC servers and firewalls?
      ... > Where are the numbers that show the impact of egress filtering on a router? ... out unless it's my internal nameserver talking to my external ... Router and firewall performance stats are a blackhole- it's easy to skew ...
      (Firewall-Wizards)
    • Re: Just venting (totally OT)
      ... the ame router to get access to the net! ... I'm paranoid about opening up my firewall "just in case..." ... not visiting dodgy Websites. ... The protection that it does supply is also provided by ...
      (uk.people.support.depression)
    • Re: Cable broadband, wired router and iLamp
      ... The Virgin modem makes your Mac appear on the outside world using the IP ... So a firewall is necessary. ... router will not do, since the WAN port is ADSL not Ethernet. ... NAT inspects every outgoing packet, and edits the packet so it appears to ...
      (uk.comp.sys.mac)
    • Re: Just venting (totally OT)
      ... how long it plays for because it's all been ripped on to hard disc ... the ame router to get access to the net! ... I'm paranoid about opening up my firewall "just in case..." ... The protection that it does supply is also provided by ...
      (uk.people.support.depression)