johnnyfirpo
Goto Top

ingress and egress acls

hallo - kann mir jemand bei der folgenden frage weitehelfen? ich komm nicht dahinter. vielen dank schon mal im voraus

Modify the firewall ingress and egress ACLs to allow ESP tunnel-mode connections from the outside. The IPsec server is 60.40.3.86. The inside server is 60.2.3.4. The external client is 1.2.3.4. Just give line numbers for where the added statement or statements would go. Put them as close to the top of the list as you can without sacrificing protections.

Figure 5-6: Access Control List (ACL) For Ingress Filtering at a Border Router

1. If source IP address = 10.*.*.*, DENY [private IP address range]

2. If source IP address = 172.16.*.* to 172.31.*.*, DENY [private IP address range]

3. If source IP address = 192.168.*.*, DENY [private IP address range]

4. If source IP address = 60.47.*.*, DENY [internal address range]

5. If source IP address = 1.2.3.4, DENY [black-holed address of attacker]

6. If TCP SYN=1 AND FIN=1, DENY [crafted attack packet]

7. If destination IP address = 60.47.3.9 AND TCP destination port = 80 OR 443, PASS
[connection to a public webserver]

8. If TCP SYN=1 AND ACK=0, DENY [attempt to open a connection from the outside]

9. If TCP destination port = 20, DENY [FTP data connection]

10. If TCP destination port = 21, DENY [FTP supervisory control connection]

11. If TCP destination port = 23, DENY [Telnet data connection]

12. If TCP destination port = 135 through 139, DENY [NetBIOS connection for clients]

13. If TCP destination port = 513, DENY [UNIX rlogin without password]

14. If TCP destination port = 514, DENY [UNIX rsh launch shell without login]

15. If TCP destination port = 22, DENY [SSH for secure login, but some versions are insecure]

16. If UDP destination port = 69, DENY [Trivial File Transfer Protocol; no login necessary]

17. If ICMP Type = 0, PASS [allow incoming echo reply messages]

18. DENY ALL

Figure 5-7: Access Control List (ACL) for Egress Filtering at a Border Router

1 If source IP address = 10.*.*.*, DENY [private IP address range]

2. If source IP address = 172.16.*.* to 172.31.*.*, DENY [private IP address range]

3. If source IP address = 192.168.*.*, DENY [private IP address range]

4. If source IP address NOT = 60.47.*.*, DENY [not in internal address range]

5. If ICMP Type = 8, PASS [allow outgoing echo messages]

6. If Protocol = ICMP, DENY [drop all other outgoing ICMP messages]

7. If TCP RST=1, DENY [do not allow outgoing resets; used in host scanning]

8. If source IP address = 60.47.3.9 and TCP source port = 80 OR 443, PERMIT [public webserver]

9. If TCP source port = 0 through 49151, DENY [well-known and registered ports]

10. If UDP source port = 0 through 49151, DENY [well-known and registered ports]

11. If TCP source port = 49152 through 65536, PASS [allow outgoing client connections]

12. If TCP source port = 49152 through 65536, PASS [allow outgoing client connections]

13. DENY ALL

Content-Key: 59082

Url: https://administrator.de/contentid/59082

Ausgedruckt am: 28.03.2024 um 22:03 Uhr