Are these rules OK?

I installed a stateful packet filter for my Windows XP machine, and I also downloaded a sample rule set that has the following rules:

- allow all incoming ICMP packets

- allow all incoming ARP packets

- allow all incoming UDP packets

- allow all incoming TCP packets except those with only the SYN flag set

- allow all UDP packets from my router's port 67/68 to my port 67/68 (for DHCP)

- allow all incoming TCP packets to my port 113 that have only the SYN flag set (for IDENT)

My machine is just a workstation (I'm not running any server processes on it), so do you guys think those rules are pretty safe? Do you think I should make the ICMP rule more restrictive (I've seen some people say that you shouldn't allow certain types of ICMP packets)? Also, what uses UDP besides DHCP? And is the IDENT rule even necessary?

Reply to
void.no.spam.com
Loading thread data ...

If you got a router setting there, then what is all this about?

If you got a router in front of this machine and the router is not exposing any services to the Internet, then what is this about?

A router that's broadcasting traffic for its log sending it to a computer that has logging software;listening on the UDP port is one reason. UDP port 445 if being using on a NT based machine that doing networking.

Are you doing any of it, it would seem not don't you think?

formatting link
What O/S you got, pro or home?

Duane :)

Reply to
Duane Arnold

Well it is a laptop computer, so it is possible that there will be times when it isn't behind the router. Also, sometimes people come over to my house with their laptops and want to use my wireless network, and I want to make sure I'm protected from any malware that might be on their machines.

See above.

formatting link
Well I do send email, so I might be using it according to that link.

Pro.

Reply to
void.no.spam.com

Just turn on the XP FW you don't have to be setting all these unnecessary rules with this packet filter. That XP FW will protect you. But that's up to you.

formatting link

That would be if you had an email *server* sitting on that machine.

Well, you can use IPsec too. It's on the Pro O/S.

formatting link
I use BlackIce on my XP pro laptop. I use IPsec to supplement BlackIce, which can't stop outbound like XP's FW cannot stop outbound.

With IPsec and the AnalogX rules I made some adjustments like block the Windows Networking ports on inbound and couple of other thing.

I also unbound the Client for MS Network and MS File and Print Sharing off the wireless NIC and my DUN connection, while in the hotel room, because I don't need to be in any networking situation on dial-up or using the hotel's wireless BB.

I also do somethings in the link below to harden the O/S to attack.

formatting link
You do what's best for you.

I hope some of the information will help you.

I got to hit the sack.

Good night

Duane :)

Reply to
Duane Arnold

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.