I can feel for 'just-do-whatever-the-damn-auditor-says-so-he-can-stfu' :) I don't really block incoming traffic; instead, I use the TARPIT target (xtables-addons) to make the lifes of portscanners suck ;)
Rgds, On 2011-08-21, Alan McKinnon <alan.mckin...@gmail.com> wrote: > On Sat 20 August 2011 10:38:43 Grant did opine thusly: >> I like the policy of blocking all ports in and out with a firewall >> and only opening the ones you need. Bittorrent makes that >> difficult since it connects out to unpredictable ports. Do you >> block outbound ports with a firewall or only inbound? > > For the most part only inbound. Blocking outbound is pretty much > pointless as a security measure. > > You cannot control what people will want to connect to outbound. Every > time you think you have a complete list, someone will come along and > provide you with heaps of reasons as to why their request is legit > (and it usually is!) > > What you can control completely is the services you offer and on what > ports, therefore inbound firewalls make sense. > > That's not to say we don't use outbound firewalls at all, we do - as a > policy measure. Outbound port 25 is blocked so that people will use my > relays instead. I trust them to play nice, they trust me to keep the > service up. For us, this works well. But as a security measure the > entire model falls apart as soon as someone with a clue comes along. I > have this game I play with our firewall/security people where I get to > look smug. Tool of choice? ssh > > The security benefits from outbound connections to my mind are: > warm-and-fuzzy security > cover-your-ass security > just-do-whatever-the-damn-auditor-says-so-he-can-stfu security > i-don't-know-what-i'm-doing security > > but almost never real security. That's better done with permanent ACLs > on the routers. > > -- > alan dot mckinnon at gmail dot com > > -- -- Pandu E Poluan - IT Optimizer My website: http://pandu.poluan.info/
