Understanding the network.pdf - Back to Home

Tftp Trivial File Transfer Protocol UDP 69
Telnet Telnet TCP 23
Time Time TCP 37
Uucp UNIX-to-UNIX Copy program TCP 540
X11 X Window system display TCP 6000-6004
Traditionally, it was believed that filtering below TCP/UDP port 1024 would provide
adequate protection from external intruders, so many sites have an inbound packet
filter that looks something like this:
access-list 101 permit tcp any host 192.168.0.5 eq www
access-list 101 permit tcp any 192.168.0.0 0.0.0.255 eq telnet
access-list 101 permit tcp any 192.168.0.0 0.0.0.255 eq domain
access-list 101 permit udp any 192.168.0.0 0.0.0.255 eq domain
access-list 101 permit tcp any host 192.186.0.23 eq smtp
access-list 101 permit tcp any 192.168.0.0 0.0.0.255 eq ftp
access-list 101 permit tcp any 192.168.0.0 0.0.0.255 eq ftp-data
access-list 101 permit tcp any 192.168.0.0 0.0.0.255 gt 1024 established
access-list 101 permit udp any 192.168.0.0 0.0.0.255 gt 1024
NOTE
Named access-lists permit operator/port-value pair matches to be specified for both
the source and destination address designation. Only extended named ACLs permit
these matches to be performed in conjunction with the destination address.
With today's Internet, however, this approach does not quite offer adequate
protection. This list does greatly restrict inbound access, but it does not provide any
defense against denial of service and SMURF attacks, and leaves the majority of
service access partially unrestricted, open to exploitation. Unfortunately, these
ports need to remain unrestricted because they are used randomly to initiate
sessions. Even if you only accept inbound traffic from known hosts, there is still the
possibility of a hacker using address masquerading to access your site. For these
reasons, firewalls are often utilized to provide a single defense point, which allows
you to tailor a security filter ACL around a specific host and address range instead of
the entire network. Let's take a closer look at these defensive procedures.