Re: d-link DI-604

From: Arthur Hagen (art_at_broomstick.com)
Date: 11/29/04 

Date: Mon, 29 Nov 2004 08:57:32 -0500

Duane Arnold <notme@notme.com> wrote:
>
> Well, for one thing the machine is sitting behind a router although a
> NAT router is not 100% un-hackable. Secondly, hackers scan blocks of
> IP(s) looking for openings and a *closed* port is not on the list. So
> what that a response of *closed* and not available is being retuned.
> One running some Gibson test calling something stealth and the real
> world are two different things. If the port is *closed* it is
> *closed* and nothing is coming past it.

The problem is that if a port is *closed*, it *will* send a signal back to a
port scanner telling that there *is* a port there. That nothing is coming
past it doesn't matter, because it discloses the *precense* of something on
that IP address.
If all ports and protocols are "stealth" (just dropping the packets), the
black hats won't see the difference between that IP and one that's not in
use, and will direct their attention elsewhere.

That said, the main good reason for making port 113 appear closed instead of
dropping packets is to speed up outgoing email, which often is delayed from
5-30 seconds while the remote host waits for an ident reply.

Even better is to add a rule to the NAT firewall that when encountering an
outgoing 25/tcp from X to Y, will create a short-lived rule routing incoming
113/tcp from Y to X. That way, the port will NOT answer to any hackers, but
ident will work for email (if running identd), and not delay the mail
sending. Similar for other fixed port protocols triggering reverse auth --
remote 6667/tcp is another good candidate.
Setting up rules like the above can be done on most NAT routers. How to do
it differs for different NAT routers, so I can't say how it's done on a
Linksys. I've seen it being called "Special Applications" and "Triggered
Rules", but again, the nomenclature might differ. 

-- 
*Art

Relevant Pages

  • Re: d-link DI-604
    ... >> packets), the black hats won't see the difference between that IP ... > router or FW that's protecting the port so what? ... let you connect at all without an ident reply. ... >> Setting up rules like the above can be done on most NAT routers. ...
    (comp.security.firewalls)
  • Re: DNS problems
    ... > UDP source port set to 53, ... Most NAT routers ... > only allow port forwarding of the desintation TCP port. ... i host my DNS and use a cisco NAT router and it works ...
    (microsoft.public.windows.server.general)
  • Port Translation based on Source Address
    ... I've heard that some firewalls / nat routers are capable of carrying ... I want to configure a nat/pat to forward port 22 from the public ...
    (comp.security.firewalls)
  • Re: DNS problems
    ... > UDP source port set to 53, ... Most NAT routers ... > only allow port forwarding of the desintation TCP port. ... i host my DNS and use a cisco NAT router and it works ...
    (microsoft.public.windows.server.general)
  • Re: How do I disable a port>
    ... > Port 1033 open. ... Possible trojans. ... malicious hackers install. ...
    (microsoft.public.windowsxp.security_admin)
Loading