Re: [gentoo-user] Do you block outbound ports?

[Pandu Poluan <pandu@poluan.info>]

I can feel for 'just-do-whatever-the-damn-auditor-says-so-he-can-stfu' :)

I don't really block incoming traffic; instead, I use the TARPIT
target (xtables-addons) to make the lifes of portscanners suck ;)

Rgds,


On 2011-08-21, Alan McKinnon <alan.mckinnon@gmail.com> wrote:
> On Sat 20 August 2011 10:38:43 Grant did opine thusly:
>> I like the policy of blocking all ports in and out with a firewall
>> and only opening the ones you need.  Bittorrent makes that
>> difficult since it connects out to unpredictable ports.  Do you
>> block outbound ports with a firewall or only inbound?
>
> For the most part only inbound. Blocking outbound is pretty much
> pointless as a security measure.
>
> You cannot control what people will want to connect to outbound. Every
> time you think you have a complete list, someone will come along and
> provide you with heaps of reasons as to why their request is legit
> (and it usually is!)
>
> What you can control completely is the services you offer and on what
> ports, therefore inbound firewalls make sense.
>
> That's not to say we don't use outbound firewalls at all, we do - as a
> policy measure. Outbound port 25 is blocked so that people will use my
> relays instead. I trust them to play nice, they trust me to keep the
> service up. For us, this works well. But as a security measure the
> entire model falls apart as soon as someone with a clue comes along. I
> have this game I play with our firewall/security people where I get to
> look smug. Tool of choice? ssh
>
> The security benefits from outbound connections to my mind are:
> warm-and-fuzzy security
> cover-your-ass security
> just-do-whatever-the-damn-auditor-says-so-he-can-stfu security
> i-don't-know-what-i'm-doing security
>
> but almost never real security. That's better done with permanent ACLs
> on the routers.
>
> --
> alan dot mckinnon at gmail dot com
>
>


-- 
--
Pandu E Poluan - IT Optimizer
My website: http://pandu.poluan.info/