Re: IPSEC not blocking specific IP address per Ethereal

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 04/20/05 

Date: Wed, 20 Apr 2005 12:56:41 -0500

If you are using an operating system that has Windows Firewall. :) --
Steve

"Steve Clark [MSFT]" <bogus@microsoft.com> wrote in message
news:O3PlAgcRFHA.3788@tk2msftngp13.phx.gbl...
> Best practice is to use the Windows Firewall *with* IPsec to achieve
> stateful filtering.
>
> WF will control inbound behavior and IPsec filters will control
> outbound...
>
>
>
> "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
> news:%23P5sSpQRFHA.2604@TK2MSFTNGP10.phx.gbl...
>>I did try Ethereal after configuring an ipsec policy on a test computer.
>>Ethereal DID show the connection attempts as a syn packet. My computer did
>>not respond because of the ipsec policy. If your ipsec policy is
>>configured correctly Ethereal would show that your computer is not
>>responding to connection attempts from blocked traffic.
>>
>> Having said that, ipsec is not meant to be an internet facing firewall.
>> At best it is a non stateful packet filtering mechanism that also has
>> default exemptions. Since ipsec is not stateful, attackers can gain
>> information about your computer by using a scanner that use a source port
>> that your ipsec policy allows. Blocking access by IP addresses is
>> effective only as long as that attacker is using that IP address that is
>> blocked. If at all possible use some sort of firewall device in addition
>> to ipsec. There are low priced NAT/PAT router firewalls that would help
>> you quite a bit by doing a better job of filtering traffic and keeping
>> unwanted traffic off of your computers network interface.. --- Steve
>>
>>
>> "Alfredo" <alfredo@KILL_SPAM_megapath.net> wrote in message
>> news:4265364a.695734823@news.megapath.net...
>>> "T. Sean Weintz" <strap@hanh-ct.org> sez :
>>>
>>>>Alfredo wrote:
>>>>> it could be that ethereal is
>>>>> capturing the packets before IPSEC gets to block them
>>>>Yup. That is what's happening.
>>>
>>> Wait, that can't be it, because there's also the case of the flooding
>>> spammer trying to relay through me.
>>>
>>> I placed his IP on the same "block" list, and yet my SMTP inlog still
>>> shows his flood of email attempts *after* I put him on the IPSEC block
>>> list exactly like I did with the worm above. His packets are still
>>> getting through. This is an IPSEC issue.
>>>
>>> Can anyone see what I have done wrong in my IPSEC policy? I am getting
>>> overwhelmed with worms and spammers doing what amounts to a DOS attack
>>> on my server and I would like to stop them.
>>>
>>
>>
>
>

Relevant Pages

  • Re: Isolate systems
    ... some sort of port/protocol/Ip/mac"filtering" via switches, ipsec filtering, ... firewall yourself from outside the network, even if you use a self scan site ... If legitimate users are trying to attack your computers you may have to see ...
    (microsoft.public.win2000.security)
  • Re: Firewall?
    ... Sorry, I'm so used to Zone Alarm Pro, I'd forgotten the differences from the ... Filtering is far more extensible in ZAP. ... > I don't like Win2000 ipsec or zone alarm for filtering. ... IPsec filters almost as good as a firewall IMO. ...
    (microsoft.public.win2000.security)
  • Re: TCP/IP Filtering Question
    ... Steve's advice to use IPSec is excellent and far to few ... Ipsec filtering will not block multicast and broadcast traffic, ... > For what you are doing you might want to try ipsec filtering policy using> permit and block fitter actions instead on that router computer. ... If you do> not want the same ipsec policy applied to both adapters, then configure the> actual IP address of the network adapter you want to filter instead of "my ...
    (microsoft.public.win2000.networking)
  • Re: Port Ranges in IPSec
    ... You could do something like this with 3Com's Embedded Firewall. ... All of the filtering is done in hardware, which stops anyone from bypassing the firewall. ... it allows you to setup a filter that utilizes port ranges. ... > As far as I'm concerned, IPSec port filtering is useful for stopping casual ...
    (Focus-Microsoft)
  • Re: TCP/IP Filtering Question
    ... Herb Martin ... >>> For what you are doing you might want to try ipsec filtering policy ... >>> actual IP address of the network adapter you want to filter instead of ... Ipsec filtering will not block multicast and broadcast ...
    (microsoft.public.win2000.networking)