Re: Port Filtering - Got it & Follow-up

From: David (davidwnh@adelphia.net)
Date: 03/14/03 

From: "David" <davidwnh@adelphia.net>
Date: Fri, 14 Mar 2003 10:21:08 GMT

Sounds good Jim. The key is that basic NAT built into a c/d router will stop
a vast majority of attacks simply because someone needs an established
session for there to be a public to private address mapping. A lot of that
goes out the window when you open a service to the internet or put a
computer into the c/d router's DMZ because you are allowing unsolicited
sessions to be set up. Many of these NAT router's weakness is that they do
no port filtering within established sessions, so individual sessions can be
used to work one's way to other ports, hence services, which you would
normally assume to be blocked. Much of this can be avoided if the router
implements SPI. Since your router does have port filters however, what you
need to do is make sure you are setting them up so that they enhance what
security is already there without punching other holes in it. By using port
forwarding as opposed to a DMZ you are only initially opening up the service
ports that you want to for unsolicited connections and the rest of your
connections to that server are still under the inherent protection that NAT
provides. You can add additional packet filters to keep someone from using
their initial session to get at other service ports, but if you start using
filters to open port access you can severely hinder what the router is
already providing if you are in the router's DMZ particularly if these
filters are not there to restrict what IP addresses are allowed in. If your
router has SPI it will prevent someone from going after another service
within the context of an ongoing session because SYN packets are blocked
within the context of an established connection.
So if you port forward to the web server as opposed to using the DMZ your
rules used to open access for your own client applications won't leave such
gaping holes, the rule to block high ports is a bit less necessary, and if
the c/d router has SPI it is almost totally unnecessary in the first place.
You need to keep in mind that the DMZ of a NAT router is very different from
the DMZ of a multi-homed firewall. On a cable/dsl router you generally want
to use port forwarding for services using a static ports and leave the DMZ
for applications which use dynamically allocated secondary ports(or
honeypots).

I don't blame you for being vague about what you are using but I needed to
know if you had a NAT device and/or SPI and/or are using a router's DMZ as
opposed to port forwarding because the way you want to set up port filters
relies heavily on these factors. In any case I think you see why some people
set up webservers as standalone servers and don't use them for anything else
that isn't totally necessary.

> Thanks for the input. Yes, it is a DSL router with packet filtering, sorry
> for being vague. I don't know if it is stateful or if I can filter on
> session status, but it supports NAT so I will look into it. Incoming UDP
is
> shut down to the whole machine, and after considering the alternatives I
> have decided to not allow any other open ports (besides 80) since browsing
> is not a necessity and security is more important. Maybe when I get a
little
> more time I will look into port forwarding or some kind of state filtering
> as you suggest.
>
> Thanks again,
>
> james
>

Relevant Pages

  • RE: cant access others computer anymore
    ... Lots of Access Point has Router function and may have build-in NAT support. ... only HTTP package from port 80) ... | When implementing a wireless solution you usually buy an ADSL ...
    (microsoft.public.windowsxp.general)
  • Re: How did they get past my NAT?
    ... network), I get no response, because there is no "Default host" set up ... behind my NAT, and no port forwarding for that port - if an explicit ... as I understand?), and not forwarded on the router, so there should be ...
    (comp.security.firewalls)
  • Re: NAT is not a mechanism for securing a network.. but.. HELP!
    ... >> Well the firmware for the 11S4 router has no FW like software like ... >> SPI so it wasn't and is not doing packet inspection. ... >> article Watchguard put out awhile back about how NAT routers can be ... > device opens a port by putting it in the NAT table, ...
    (comp.security.firewalls)
  • Re: LinkSys BEFSX41 Questions
    ... One of the big problems with how NAT is implemented on many of these routers ... holes because the router isn't dropping syn packets on ports used with NAT ... The problem is with the port assignment. ... So you can port forward the entire range of high ports for UDP, ...
    (comp.security.firewalls)
  • Re: Using Remote Desktop From an SBS Domain
    ... when you tried to RDP while attached directly to a port on your router? ... So if 3389 needs forwarded on the client end too then that is what the ... Hopefully next week I can attempt a connection while my ISP watches the ...
    (microsoft.public.windows.server.sbs)