Re: d-link DI-604

From: Duane Arnold (Notme_at_Notme.com)
Date: 11/29/04 

Date: Mon, 29 Nov 2004 14:29:40 GMT

Arthur Hagen wrote:

> Duane Arnold <notme@notme.com> wrote:
>>
>> Well, for one thing the machine is sitting behind a router although a
>> NAT router is not 100% un-hackable. Secondly, hackers scan blocks of
>> IP(s) looking for openings and a *closed* port is not on the list. So
>> what that a response of *closed* and not available is being retuned.
>> One running some Gibson test calling something stealth and the real
>> world are two different things. If the port is *closed* it is
>> *closed* and nothing is coming past it.
>
> The problem is that if a port is *closed*, it *will* send a signal back to
> a
> port scanner telling that there *is* a port there. That nothing is coming
> past it doesn't matter, because it discloses the *precense* of something
> on that IP address.
> If all ports and protocols are "stealth" (just dropping the packets), the
> black hats won't see the difference between that IP and one that's not in
> use, and will direct their attention elsewhere.
>

So what if there is a presence there? If one cannot come past the NAT router
or FW that's protecting the port so what? The port is protected.
 
> That said, the main good reason for making port 113 appear closed instead
> of dropping packets is to speed up outgoing email, which often is delayed
> from 5-30 seconds while the remote host waits for an ident reply.

I could see this making some kind of sense if the home user's job with the
machine was to send out a trillion emails.

>
> Even better is to add a rule to the NAT firewall that when encountering an
> outgoing 25/tcp from X to Y, will create a short-lived rule routing
> incoming
> 113/tcp from Y to X. That way, the port will NOT answer to any hackers,
> but ident will work for email (if running identd), and not delay the mail
> sending. Similar for other fixed port protocols triggering reverse auth
> -- remote 6667/tcp is another good candidate.
> Setting up rules like the above can be done on most NAT routers. How to
> do it differs for different NAT routers, so I can't say how it's done on a
> Linksys. I've seen it being called "Special Applications" and "Triggered
> Rules", but again, the nomenclature might differ.
>

All one has to do is port forward 113 to a dummy ip in the DMZ of the router
and 113 is so called stealth. But I stopped doing it with the Linksys and
don't do with the Watchguard either.

Duane :)

Relevant Pages

  • Re: Sleath ports with Sygate PF
    ... everything that does "stealth" your system has ... the router will still see ... Any port scanner will see it. ...
    (comp.security.firewalls)
  • Re: Using Remote Desktop From an SBS Domain
    ... when you tried to RDP while attached directly to a port on your router? ... So if 3389 needs forwarded on the client end too then that is what the ... Hopefully next week I can attempt a connection while my ISP watches the ...
    (microsoft.public.windows.server.sbs)
  • Re: Cost of setting up a network
    ... A router capable of acting as a VPN endpoint for more than one user simultaneously with four Ethernet ports or a switch to suit. ... The rationale for using a server here is basically that the router doesn't need to be able to decide which PC to route the connection to. ... If you are using a router which supports it, you can set up a port-forwarding inbound rule which also _translates_ the port supplied to the receiving port. ... You can use several of these connections to different machines simultaneously. ...
    (uk.comp.homebuilt)
  • How did they get behind my NAT?
    ... this point I panicked and shutdown the VNC service ASAP. ... My question is how the attacker got to my VNC port! ... the internet through the router. ... client connection using local port number 5900 (which was also being ...
    (alt.computer.security)
  • How to stealth port 113 (ident/auth) for users of [NAT] routers
    ... not stealth port 113 using their firewall software (Norton ... Turns out it wasn't a fault of their firewall. ... My NAT router was the culprit although it has some ... router to block traffic on port 113, ...
    (microsoft.public.security)