FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo User

 
 
LinkBack Thread Tools
 
Old 08-20-2011, 05:38 PM
Grant
 
Default Do you block outbound ports?

I like the policy of blocking all ports in and out with a firewall and
only opening the ones you need. Bittorrent makes that difficult since
it connects out to unpredictable ports. Do you block outbound ports
with a firewall or only inbound?

- Grant
 
Old 08-20-2011, 07:02 PM
Alan McKinnon
 
Default Do you block outbound ports?

On Sat 20 August 2011 10:38:43 Grant did opine thusly:
> I like the policy of blocking all ports in and out with a firewall
> and only opening the ones you need. Bittorrent makes that
> difficult since it connects out to unpredictable ports. Do you
> block outbound ports with a firewall or only inbound?

For the most part only inbound. Blocking outbound is pretty much
pointless as a security measure.

You cannot control what people will want to connect to outbound. Every
time you think you have a complete list, someone will come along and
provide you with heaps of reasons as to why their request is legit
(and it usually is!)

What you can control completely is the services you offer and on what
ports, therefore inbound firewalls make sense.

That's not to say we don't use outbound firewalls at all, we do - as a
policy measure. Outbound port 25 is blocked so that people will use my
relays instead. I trust them to play nice, they trust me to keep the
service up. For us, this works well. But as a security measure the
entire model falls apart as soon as someone with a clue comes along. I
have this game I play with our firewall/security people where I get to
look smug. Tool of choice? ssh

The security benefits from outbound connections to my mind are:
warm-and-fuzzy security
cover-your-ass security
just-do-whatever-the-damn-auditor-says-so-he-can-stfu security
i-don't-know-what-i'm-doing security

but almost never real security. That's better done with permanent ACLs
on the routers.

--
alan dot mckinnon at gmail dot com
 
Old 08-20-2011, 07:11 PM
Nikos Chantziaras
 
Default Do you block outbound ports?

On 08/20/2011 08:38 PM, Grant wrote:

I like the policy of blocking all ports in and out with a firewall and
only opening the ones you need. Bittorrent makes that difficult since
it connects out to unpredictable ports. Do you block outbound ports
with a firewall or only inbound?


I block neither in nor outbound. I don't run any kind of firewall
because its whole point is interfering with network traffic :-P
 
Old 08-20-2011, 10:41 PM
Paul Hartman
 
Default Do you block outbound ports?

On Sat, Aug 20, 2011 at 12:38 PM, Grant <emailgrant@gmail.com> wrote:
> I like the policy of blocking all ports in and out with a firewall and
> only opening the ones you need. *Bittorrent makes that difficult since
> it connects out to unpredictable ports. *Do you block outbound ports
> with a firewall or only inbound?

I don't block anything outbound, but my ISP does (mostly MS-stuff that
I don't care about). I do, however, occasionally block all outgoing
just to see what the logs show, so I'm aware of what's happening. But
I don't actively monitor that outbound traffic.

I block everything inbound and only open what's specifically needed. I
use denyhosts and fail2ban to block bad guys from all ports.
 
Old 08-21-2011, 04:31 AM
Pandu Poluan
 
Default Do you block outbound ports?

I can feel for 'just-do-whatever-the-damn-auditor-says-so-he-can-stfu'

I don't really block incoming traffic; instead, I use the TARPIT
target (xtables-addons) to make the lifes of portscanners suck

Rgds,


On 2011-08-21, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
> On Sat 20 August 2011 10:38:43 Grant did opine thusly:
>> I like the policy of blocking all ports in and out with a firewall
>> and only opening the ones you need. Bittorrent makes that
>> difficult since it connects out to unpredictable ports. Do you
>> block outbound ports with a firewall or only inbound?
>
> For the most part only inbound. Blocking outbound is pretty much
> pointless as a security measure.
>
> You cannot control what people will want to connect to outbound. Every
> time you think you have a complete list, someone will come along and
> provide you with heaps of reasons as to why their request is legit
> (and it usually is!)
>
> What you can control completely is the services you offer and on what
> ports, therefore inbound firewalls make sense.
>
> That's not to say we don't use outbound firewalls at all, we do - as a
> policy measure. Outbound port 25 is blocked so that people will use my
> relays instead. I trust them to play nice, they trust me to keep the
> service up. For us, this works well. But as a security measure the
> entire model falls apart as soon as someone with a clue comes along. I
> have this game I play with our firewall/security people where I get to
> look smug. Tool of choice? ssh
>
> The security benefits from outbound connections to my mind are:
> warm-and-fuzzy security
> cover-your-ass security
> just-do-whatever-the-damn-auditor-says-so-he-can-stfu security
> i-don't-know-what-i'm-doing security
>
> but almost never real security. That's better done with permanent ACLs
> on the routers.
>
> --
> alan dot mckinnon at gmail dot com
>
>


--
--
Pandu E Poluan - IT Optimizer
My website: http://pandu.poluan.info/
 
Old 08-21-2011, 12:10 PM
James
 
Default Do you block outbound ports?

Grant <emailgrant <at> gmail.com> writes:

> Do you block outbound ports
> with a firewall or only inbound?

Logging outbound traffic, and then looking
at (analyzing) the outbound traffic may
be of interest to you. Two extremes
are wildly unpredictable: human imaginations
in a collective where outbound traffic policy
is constantly morphing; like a collection
of young computer scientist at your local
university. Like Alan alluded to, a basic
nightmare of intellectual argument as to
monitoring or blocking outbound traffic.

In the case where the services utilized
are more consistent in a pattern that is some
what consistent over time. For example a network
full of machines (literally machines for
physical process control) or servers offering limited
fixed services, then blocking outbound traffic
(that should not nor never exist) could make sense.
In a complex network, this may mean several different
firewalls with different policies on outbound
traffic.

The later network may be a candidate for
extensive monitoring, pattern detection and
profiling of outbound traffic; with subsequent
port blocking. If it's not used, block it, some
would say. Whether its is more work than of value,
can only be decided by the logs and the policy
requirements of that network's owner.


hth,
James
 

Thread Tools




All times are GMT. The time now is 08:48 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org