Re: Would these firewall rules work for me?

From: bensmyth (noreply_at_test.com)
Date: 03/31/05 

Date: Thu, 31 Mar 2005 17:10:46 +0100

> Your going about things the wrong way!!
>
> Deny everything, unless you explicitly require it.
>
> eg.
> src, s_port, dest, d_port, permission, comment
> *, *, *, 80, allow, //Allow HTTP
> *, *, *, >=1024, allow, //Allow responses to unprivileged ports
> *, *, *, *, deny, //default deny
>
> You will of course have to add rules for everything else...
> FTP, SMTP, DNS are all musts hence
> *, *, *, 20, allow, //FTP
> *, *, *, 21, allow, //FTP
> *, *, *, 25, allow, //SMTP
> *, *, *, 53, allow, //DNS

To be more secure would the following be more secure:

src, s_port, dest, d_port, permission, comment
*, *, *, 80, allow, //HTTP outgoing
*, 80, *, >=1024, allow, //HTTP incoming

*, *, *, 25, allow, //SMTP outgoing
*, 25, *, >=1024, allow, //SMTP incoming
*, *, *, *, deny, //default deny

Relevant Pages

  • Re: Access Token with conflicting SIDs
    ... Is the reg entries you are working with configured in such a way that you can set up the Deny Everyone ACE at a higher level than the grant to admins? ... I've also read chapters 4 and 5 of Writing Secure Code to try to expand my knowledge/understanding. ... restores the original DACL. ... to have only the Administrators SID. ...
    (microsoft.public.platformsdk.security)
  • Re: How to enforce "Explicit Allow" on a folder?
    ... > I need to secure a few folders! ... > to user A. The best way to do it is to Deny all users ... > make the Allow option take precidents over Deny? ...
    (microsoft.public.windows.server.active_directory)
  • terminal server security
    ... I am trying to secure two w2k terminal servers. ... I want to enable right click on the task bar but deny ...
    (microsoft.public.win2000.security)
  • How to enforce "Explicit Allow" on a folder?
    ... I need to secure a few folders! ... to user A. The best way to do it is to Deny all users ... make the Allow option take precidents over Deny? ...
    (microsoft.public.windows.server.active_directory)
  • Re: You dont have permission to read
    ... then you are opening the secured database using a secure workgroup. ... generally the Admin user does not have permission to do ... > permission to read - object name". ...
    (microsoft.public.access.security)