Re: [PLUG] Blocked outgoing ports

[Tobias DiPasquale <toby@cbcg.net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Dec 10, 2004, at 11:59 AM, Doug Crompton wrote:
> OK we talked about incoming ports, which you basically shutdown except 
> for
> those used but what about outgoing? In a mixed Linux, MS, and other 
> device
> world what is the recommendation? I currently have 135-139 and 445 
> blocked
> but that is only because I see traffic hits coming in on those ports 
> (but
> blocked in) and they are obviously MS stuff. I guess this is a hard
> generalized question because we all have different stuff we use to the
> outside world. There are however, I am sure, some bad ones that you can
> eliminate.

Generally, for security reasons (and being a good netizen), you want to 
drop all outgoing traffic that's not explicitly allowed. Open outgoing 
ports that you need for critical services and that's it. In Linux, you 
can set the OUTPUT chain's policy to DROP and then make the first rule 
an ACCEPT on -m state --state RELATED,ESTABLISHED. You should mirror 
that in the INPUT and FORWARD chains. Underneath those first ACCEPT 
rules you would accept whatever other traffic you wanted to come in, be 
forwarded or go out (in INPUT, FORWARD and OUTPUT, resp.).

I will say that most people do just leave the OUTPUT chain's policy to 
ACCEPT and never touch it, but this leaves them open to blasting out 
attacks against other networks when internal machines get zombied.

- --
Tobias DiPasquale
7A79 308C 0354 EA9C 7807  ED83 03C9 9E01 148E 7D01
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (Darwin)

iD8DBQFBudc5A8meARSOfQERApeqAJ0cCCqLsBaa5VsKsuTWIuuIY9zG6gCbBEW9
6pSLWv5X/+JqSzzJXFlCNFk=
=PaQk
-----END PGP SIGNATURE-----

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug