Top-Themen

AppleEntwicklungHardwareInternetLinuxMicrosoftMultimediaNetzwerkeOff TopicSicherheitSonstige SystemeVirtualisierungWeiterbildungZusammenarbeit

Aktuelle Themen

Administrator.de FeedbackApache ServerAppleAssemblerAudioAusbildungAuslandBackupBasicBatch & ShellBenchmarksBibliotheken & ToolkitsBlogsCloud-DiensteClusterCMSCPU, RAM, MainboardsCSSC und C++DatenbankenDatenschutzDebianDigitiales FernsehenDNSDrucker und ScannerDSL, VDSLE-BooksE-BusinessE-MailEntwicklungErkennung und -AbwehrExchange ServerFestplatten, SSD, RaidFirewallFlatratesGoogle AndroidGrafikGrafikkarten & MonitoreGroupwareHardwareHosting & HousingHTMLHumor (lol)Hyper-VIconsIDE & EditorenInformationsdiensteInstallationInstant MessagingInternetInternet DomäneniOSISDN & AnaloganschlüsseiTunesJavaJavaScriptKiXtartKVMLAN, WAN, WirelessLinuxLinux DesktopLinux NetzwerkLinux ToolsLinux UserverwaltungLizenzierungMac OS XMicrosoftMicrosoft OfficeMikroTik RouterOSMonitoringMultimediaMultimedia & ZubehörNetzwerkeNetzwerkgrundlagenNetzwerkmanagementNetzwerkprotokolleNotebook & ZubehörNovell NetwareOff TopicOpenOffice, LibreOfficeOutlook & MailPapierkorbPascal und DelphiPeripheriegerätePerlPHPPythonRechtliche FragenRedHat, CentOS, FedoraRouter & RoutingSambaSAN, NAS, DASSchriftartenSchulung & TrainingSEOServerServer-HardwareSicherheitSicherheits-ToolsSicherheitsgrundlagenSolarisSonstige SystemeSoziale NetzwerkeSpeicherkartenStudentenjobs & PraktikumSuche ProjektpartnerSuseSwitche und HubsTipps & TricksTK-Netze & GeräteUbuntuUMTS, EDGE & GPRSUtilitiesVB for ApplicationsVerschlüsselung & ZertifikateVideo & StreamingViren und TrojanerVirtualisierungVisual StudioVmwareVoice over IPWebbrowserWebentwicklungWeiterbildungWindows 7Windows 8Windows 10Windows InstallationWindows MobileWindows NetzwerkWindows ServerWindows SystemdateienWindows ToolsWindows UpdateWindows UserverwaltungWindows VistaWindows XPXenserverXMLZusammenarbeit

ingress and egress acls

Frage Sicherheit Firewall

Mitglied: johnnyfirpo

johnnyfirpo (Level 1) - Jetzt verbinden

15.05.2007 um 18:55 Uhr, 3832 Aufrufe

hallo - kann mir jemand bei der folgenden frage weitehelfen? ich komm nicht dahinter. vielen dank schon mal im voraus

Modify the firewall ingress and egress ACLs to allow ESP tunnel-mode connections from the outside. The IPsec server is 60.40.3.86. The inside server is 60.2.3.4. The external client is 1.2.3.4. Just give line numbers for where the added statement or statements would go. Put them as close to the top of the list as you can without sacrificing protections.

Figure 5-6: Access Control List (ACL) For Ingress Filtering at a Border Router

1. If source IP address = 10.*.*.*, DENY [private IP address range]

2. If source IP address = 172.16.*.* to 172.31.*.*, DENY [private IP address range]

3. If source IP address = 192.168.*.*, DENY [private IP address range]

4. If source IP address = 60.47.*.*, DENY [internal address range]

5. If source IP address = 1.2.3.4, DENY [black-holed address of attacker]

6. If TCP SYN=1 AND FIN=1, DENY [crafted attack packet]

7. If destination IP address = 60.47.3.9 AND TCP destination port = 80 OR 443, PASS
[connection to a public webserver]

8. If TCP SYN=1 AND ACK=0, DENY [attempt to open a connection from the outside]

9. If TCP destination port = 20, DENY [FTP data connection]

10. If TCP destination port = 21, DENY [FTP supervisory control connection]

11. If TCP destination port = 23, DENY [Telnet data connection]

12. If TCP destination port = 135 through 139, DENY [NetBIOS connection for clients]

13. If TCP destination port = 513, DENY [UNIX rlogin without password]

14. If TCP destination port = 514, DENY [UNIX rsh launch shell without login]

15. If TCP destination port = 22, DENY [SSH for secure login, but some versions are insecure]

16. If UDP destination port = 69, DENY [Trivial File Transfer Protocol; no login necessary]

17. If ICMP Type = 0, PASS [allow incoming echo reply messages]

18. DENY ALL

Figure 5-7: Access Control List (ACL) for Egress Filtering at a Border Router

1 If source IP address = 10.*.*.*, DENY [private IP address range]

2. If source IP address = 172.16.*.* to 172.31.*.*, DENY [private IP address range]

3. If source IP address = 192.168.*.*, DENY [private IP address range]

4. If source IP address NOT = 60.47.*.*, DENY [not in internal address range]

5. If ICMP Type = 8, PASS [allow outgoing echo messages]

6. If Protocol = ICMP, DENY [drop all other outgoing ICMP messages]

7. If TCP RST=1, DENY [do not allow outgoing resets; used in host scanning]

8. If source IP address = 60.47.3.9 and TCP source port = 80 OR 443, PERMIT [public webserver]

9. If TCP source port = 0 through 49151, DENY [well-known and registered ports]

10. If UDP source port = 0 through 49151, DENY [well-known and registered ports]

11. If TCP source port = 49152 through 65536, PASS [allow outgoing client connections]

12. If TCP source port = 49152 through 65536, PASS [allow outgoing client connections]

13. DENY ALL
Neuester Wissensbeitrag
Humor (lol)

Linkliste für Adventskalender

(3)

Information von nikoatit zum Thema Humor (lol) ...

Heiß diskutierte Inhalte
Windows Server
DHCP Server switchen (24)

Frage von M.Marz zum Thema Windows Server ...

SAN, NAS, DAS
gelöst HP-Proliant Microserver Betriebssystem (14)

Frage von Yannosch zum Thema SAN, NAS, DAS ...

Grafikkarten & Monitore
Win 10 Grafikkarte Crash von Software? (13)

Frage von Marabunta zum Thema Grafikkarten & Monitore ...

Erkennung und -Abwehr
Spam mit eigener Domain (12)

Frage von NoobOne zum Thema Erkennung und -Abwehr ...