I writing a blog post about the rules for blocking the bogon IP's
(unused IP networks) using the firewall module of our Cobia, I was
considering including the equivalent iptables rules. Would this be of
interest to anyone?
Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
martin@stillsecure.com
707-495-7926
http://www.cobiablog.com
-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Steven M
Campbell
Sent: Tuesday, June 05, 2007 9:41 AM
To: Arnt Karlsen
Cc: netfilter@lists.netfilter.org
Subject: Re: ..prevention, was: syn DDoS attack solution
Arnt Karlsen wrote:
> On Tue, 05 Jun 2007 10:16:40 -0400, Steven wrote in message
> <46657048.4040600@SCampbell.net>:
>
>
>> And, most important for folks here, do egress filtering on your
>> firewall! Help prevent zombie machines on your own networks from
>> being a problem, you can't stop your end users from bringing
>> infections into your network but you can control their spread.
>>
>
> ..what tricks _are_ out there? Set up some kinda p0f deamon and cut
> 'n tarpit any and all Wintendo network traffic attempts?
> Or even feed them LROS thru ActiveX if they need firm hints?
>
>
Not really very tricky, limit outbound traffic to what is needed. Do
all of your workstations need UDP ports outbound? Smtp? For a lot of
sites the average workstations internet requirements are very small,
especially if proxys are used for SMTP,HTTP,FTP, etc. Just by blocking
most of the end users from direct internet access (or at least to a
small set of outbound protocol/ports) we render those machines pretty
useless to the bad guys.
It does, however, become very tricky if it's not done up front. It's
really really tough to figure out what the requirements are if anyone
could historically do anything they wanted. It's far better to
seriously restrict things up front and put in the exceptions as you find
them. Sites that have historically allowed all outbound traffic are a
two fold problem, it's hard to fix and they are exactly the sorts of
sites the bad guys like to use.
|