Why you have hardware firewalls

Leythos wrote in news:0rO6e.1623$Rd.139 @tornado.ohiordc.rr.com:

reply below.

irrelevant. we are not talking about OS hardening or minimizing. we are talking about filtering by IP addy.

reply below.

targeting

your methodology may work - if you knew for sure 110% where you target customers/visitors are connecting from. but what information makes you so sure? and how do you know you aren't losing customers?

the way i see it, your site is either on the internet and public or it's on intranet and private. if it's private, then by all means place behind F/W and filter to your own corp. subnets.

but if it's public, it's public. where is your reasoning to adjust IP filter to target audience connections? the site is in english, so you will just assume that anyone who can't read english won't visit - so you will filter out non-english speaking countries?

also, relying on IP filtering is a little weak. as we all know, IP's can be spoofed. or even simpler, you can find a proxy from allowed IP and use it to get in. a guy who has targeted *your* site for an attack probably learnt *that* way before he learn how to be a scripter.

filtering SMTP proto so asian countries are excluded is common practice and makes sense. but filtering HTTP proto, i do not come across that too often.

just my 2 cents.

Uh, it is okay to limit inbound access to a "public" SMTP server but not a "public" HTTP server? Seems to me that what is good for the goose is good for the gander. They are both public services. Why allow restrictions on one "public" service and not the other?

You must be assuming that we don't know who our clients are? If I design/host a web site for a roofing company based in the USA, there is little chance they are going to get a request for a bid from Oz or from Asia, and no reason for them to expose their site to those countries as their business model doesn't cover doing work outside the USA (outside their state for that matter). The same is true for many businesses.

All web servers, or anything that provides public access (ftp, smtp, etc..) should be behind a quality firewall device.

You're wrong, public doesn't mean World, it means open to as far as you want it to reach. In many cases, there are no reasons for non-global companies or organizations to reach beyond their local country. Even if the company did get a request for third-world services they would not be able to service it as their infrastructure would not be setup for it. For those that want to service third-world countries, more power to them, and they would need to remain unblocked, but I see no reason to expose services that should not be available to others.

The way to look at it is simple - reduce your exposure as much as possible, which will also reduce your load/management needs, and also helps to reduce your exposure to threats.

Oh, it has nothing to do with the language of any peoples, it's got everything to do with where you want to expose your services too. If you know that you're never going to sell/service places in country XYZ, then you can block all the IP ranges in country XYZ - this eliminates a direct threat area/path.

And, in this discussion, you should already understand that it's a PART of the entire solution, not the sole method. Blocking connections to countries that you don't do business with is a valid means of eliminating threats. In case you missed it, this is only a small part of a security solution.

I see daily connection attempts to HTTP, FTP, SMTP, 4899, and several others, from many foreign sites. In the early days I would track the IP, block just the IP, and then move on. Now, as it's more evident, it's easier to block the country or net-block used by the prober, I don't block /8's, but I do block /16's and /24's all the time.

yeah - i guess a lot depends on the type of business and services you are selling.

it still seems weird to "penalize" entire chunks of the internet based on something/action/hack attempt that has not happened yet.

would it not make more sense to automate & integrate an IDS (snort) with your firewall and have it auto block any suspicious hits. you might wind up blocking a lot of false positives - but at least your are not blocking right across the board.

(p.s. for the purposes of this thread - lets assume you are selling services to anyone willing to pay. not selling services to just your local community. lets say you are selling web design services.)

I know that - you know that - perhaps every competent professional knows this - but these aren't professionals. The site is operated and maintained (yeah, right) by a 17 year old.

Bingo. You can actually run the typical windoze server with all the extraneous crap in it's default wide open state (not that I'd recommend windoze, much less running the defaults) behind a very restrictive firewall without as much risk - but the better combination is the stripped system running behind the firewall if you insist on a microsoft solution. Netcraft suggests there are better ways.

I just used a passive tool to ID the system - it looks like the idiot is running 98, but I can't tell which patch level.

I know that smarter individuals have set up systems where the first page wants your postal (ZIP) code, and uses that to try to identify the nearest retailer. Trying to use IP addresses to identify a location is difficult. The local cable/DSL is provided by Cox and QWorst, and there are about 50 local ISPs. But what about the "local" businesses? Looking up $WORK says New York, but a traceroute enters a blackhole in San Jose California, and we have subnets in Europe, Asia, and where I am in Arizona. One local site does indeed block $WORK as non-local, and the only way I can reach them is from a tunnel, or over the phone. So they loose our business.

Old guy

Not really, it only depends on WHO you sell services or provide information too. If I was running a blogging site for my own fun, I would still not provide it outside the USA or the country I was living in. It's up to the content/service owner as to where/who they want to make things available too. The internet is only as public as the user wants it to be.

You're still looking at it wrong, there is no penalty in blocking access to any services from company X, if company X has no intention of providing those services to you. Kind of like searching google for product XYZ and getting results from all over the world when you can only wanted to see results in country ABC.

Why would you assume that we don't already do this - we design secure networks for a living, it's our business target. At the same time, while blocking (for 20 minutes) any suspect traffic and also traffic that tries to connect with typical MS File sharing ports, it only makes sense to block areas that you DON'T NEED to provide access too.

I disagree, the thread touches several types of users/services, but, taking your web services company:

You're not going to convenience me that block-lists are bad. It would appear that you've not done design work or setup networks in/outside the US. Even our Indian development centers use a VPN with an exception to access our services.

snipped-for-privacy@painkiller.example.tld (Moe Trin) wrote in news: snipped-for-privacy@compton.phx.az.us:

correction. properly securing his servers is going to reduce his chnaces of getting "0wn3d".

Leythos wrote in news:C3e7e.8$Qu2.6 @tornado.ohiordc.rr.com:

I am not trying to convince you. I am trying to understand the reasoning. How can you make a decision like that without metrics and based soley on your own personal "expert" opinion.

It costs my employer money to keep a web site highly available on the internet. I don't think I can go up to them and tell them to prevet 1/2 of cyberspace from viewing it without giving them metrics/proof that support my claim. our servers are properly maintained and secured. there are no break ins. there are no metrics. so, where do you go from there?

Leythos wrote in news:1jj7e.2115$ snipped-for-privacy@tornado.ohiordc.rr.com:

Well, that explanation makes sense.

I think in my case - I lurk on InfoSec info sites & sources too much. I find that if one isn't careful, one can become a little too paranoind and cry wolf too often. I conciously make an effort to fight those urges.

;-)

You can buy an annual security subscription that gives you Gateway Antivirus, Intrusion Prevention Service, and (about to be released) AntiSpyware. It adds huge amounts of security functionality to your TZ170.

There is another feature for email that supports RBLs such as sorbs and spamhaus but I can't remember if thats an enhanced or standard feature.

I've read the above several times and I'm not quite sure how to interpret it. Are you saying that you know of a company, offering services in your local area, but since you use an ISP that routes your traffic through a non-local gateway, that you're blocked from using their site due to IP filtering?

The method I use for our IP filtering is not to block every country at the /8 level. I block the attackers in their subnets, usually only a /24, but I've started taking it one level higher to a /16 when I can see that the path follows up a couple levels in the same country. I saw the list that was posted with /8's and while I would love to do that high, I only want to block the points where we've been probed from.

I have all of our (and clients) firewalls setup to auto-block IP's (for 20 minutes) that probe on select ports, and that's in addition to the master block list.

I liken this to RBL's - it blocks known lists of abusers and also allows me to add additional abusers.

My experience is more than personal. We setup networks for many companies, most of them are public companies, some are small companies, others are larger (multi-national). The decision to block is not an easy one, but it's one that you can only make after you start looking at the attack types and sources. In our case, while almost every site/service our clients provide could serve the world with information without any problem, most of them target select areas/countries for their services. If we need a presence in Russia, we would setup a hosting agreement with a provider in that country in order to keep site performance up.

I base the decision on attack source/number and if we can block the source of the attack at the single IP or at the subnet level. If I can block at a subnet without impacting our services to clients, then I do so, if not, then I block just the single IP of the source.

In our case, I only have to justify this to myself, not to anyone else. It's a method we've used with all of our clients networks and have never had a single issue with it.

We have one group in India that does work for us, and several that do work for our clients, while they service the world (most of it) those remote centers also block many Asian countries and some Russian locations. It's all about your market and what you can block without impacting your business.

If you sell widgets to everyone in the world, or you want to, you can't block anyone at the subnet level, you have to block them at the IP level. One generic rule we use is FTP detection for auto-blocking, if a non-exception IP tries to connect via FTP, we block that IP for 20 minutes. We have many other methods in place, but those type of detection blocks help with probes/attacks from foreign hosts.

I've not blocked Oz from our networks, but if I were to block all of Oz, it would not impact our business - we don't plan on going to Oz for work :)

I don't think that anyone can become too paranoid with security, but I've seen people become overly paranoid concerning privacy. I always take the path that there is something accessing the network that I've not learned to detect yet, or that there is a exploit that I don't know about yet, and I try to plan for those issues. I also subscribe to only expose absolutely what's needed and nothing more, but you've probably already guessed that :)

OK - let's try that again. If you go to ARIN or IANA, and look where our network is _registered_ it gives the corporate address in New York. That's just a standard bookkeeping thing. If you then do a traceroute, the last identifiable hop is BBN in San Jose California. The next hop blocks inbound ping and some ICMP, so 'TRACERT' and 'traceroute' die there. But hosts behind that router are scattered all over. So, are we "local" here, there, or where?

That's the bottom line. They were informed why they aren't getting us as customers, but as there are a number of similar service providers locally who don't block that tightly, we're not being hurt. "Their network; their rules" - just happens to also mean "their decisions, their loss".

That gives 60938 of the 63265 (the others use CIDR masks that can't be expressed in this notation). However, blocking by registration is not very efficient, especially if your go/no-go is the USA. I think you understand the 'grep' command - note the effect of the 'v' option:

compton ~]$ cat IP.ADDR/stats/[ALR]* | grep -c US

You do have to take those numbers with a grain of salt - while there are a lot of networks here, I'm only reporting from the _regional_ databases. Below that in a number of countries, national registries have further delegated the IP space (43.0/8, 126.0/8, and 133.0/8 are assigned to Japan, but if you want to see to who, you have to contact the JANIC whois server). Likewise, backbone providers like ATT, BBN, ELI, Level3 and UU/MCI may sub-allocate space all over the world, and the only way you'll discover that is through their rwhois servers.

The auto-block can be used for a denial of service attack unless you know what you are doing. You should only block on TCP based on the completion of a three-way handshake. Otherwise, someone can forge the source address, and you automatically point the gun at your feet, and... hey, right out of the man page:

-D Causes a decoy scan to be performed which makes it appear to the remote host that the host(s) you specify as decoys are scanning the target network too. Thus their IDS might report 5-10 port scans from unique IP addresses, but they won't know which IP was scanning them and which were inno- cent decoys.

and that's far from the only readily available tool.

On the other hand, there is really only one service that needs UDP from outside, and because UDP is so easy to spoof, you really should be blocking _ALL_ other UDP access.

Blocklists are not unreasonable. If you are going to use someone else's list (and there are plenty of them), then you have to do the research to see that the list is targeting what you want. Did you see the article Wednesday in the alt.humor.best-of-usenet group

Subject: [news.admin.net-abuse.email] Re: Need help with 144.137.117.33

Old guy

See my earlier reply to Leythos upthread. Virtually _ANYTHING_ would reduce this idiots chance of the site being "0wn3d" - but blocking

Old guy

Well, blocking by IP addy can be circumvented with the huge number of open relays out there. I know this, becuase when Eurosport and the BBC both restricted their audio streams of the Olympics, last year, circumventing that was child's play. All I had to was look up on sites like StayInvisible, or Proxy4Free, and find an open relay in the area where Eurosport and the BBC allowed connections from, configure RealPlayer(Eurosport), or Windows Media(BBC) to use that relay, and then connect. It would look to BBC and Eurosport servers like I was in Europe, and they never knew the difference. Before the IOC would let them transmit any audio or video they had to do this, but the IOC is obviously clueless on how easily such filters can be circumvented. The rules only apply to audio and video, however. They do not apply to web-pages updated every minute or so that provided live results/commentary, or IRC chat rooms that do the same. This is why I would not recommend blocking by IP addy, because someone who can use Google, or any search engine, can find lists of open relays, and find a relay that will bypass your filtering by IP addy.

One other note. Eurosport was a lot easier to circumvent, becuase they only blocked users in the United States, unlike the BBC, which restricted their streams to certains ISPs in England. As long as I echoed off any open relay outside the United States, I was able to get the Eurosport audio streams. Contary to what some people might think,. you do NOT have to be a "script kiddie" to use an open relay. There are websites where they have done all the work for you in finding them. You just pick one off the list, configure your browser, media player, or whatever, and you are good to go.

You are very right. There are sites that have lists of these proxies, and that are updated almost constantly. As I have said down-thread, I used this method last year to get audio streams of the Olympics from Eurosport and the BBC. It was just a matter of looking up in the lists of open proxies, and finding one in the area that was allowed to receive the streams, and then configuring Real Player and Windows Media to use thes proxies.

X-No-Archive: Yes

Well, this was inbound blocking, as the IOC required, before Eurosport and the BBC were granted permission to put live audio on the Internet. The IOC quite obviously does not realize that such measures to block inbound access from certain IPs can be circumvented quite easily,. through open proxis, and it looked to Eurosport and BBC servers as if I were in the allowed zone. The same thing applies when you block inbound access to your Web sites from outside the USA. Somone could circumvent that with open proxies here in the same way that I used open proxies in Britain, France, Germany, and Italy to connect to Eurosport audio streams of the Olympics last year. That is my point. You can block inbound connections from certain IP addresses, but that can be circumvented, and you only have to know how to use Google, or any search engine, to find lists or proxies all over the world.