Re: VPN behind not managed Firewall-1: can it be done?

Article View: comp.security.firewalls

Article #417

Back to comp.security.firewalls Previous Next

#417

From: Keith W. McCammon
Date: Wed, 06 Feb 2002 13:36

9 lines
1652 bytes

> Try running a port scan from outside of the FW against a node inside.  If
> you can (doubtful) than you can do anything you like.

Even if that is possible (which it likely is not), that has nothing to do
with establishing a tunnel from an internal host.  I could set up a rule (w-
Static Dest NAT) that says NOT-INTERNAL -> INTERNAL ANY ALLOW, which would
allow a portscan from an external host to an internal host.  However, that
internal host still can't initiate access to an external network unless I
explicitly add another rule to permit the action.

Technical Details

Message-ID: <a3rbi8$19h2ru$1@ID-59806.news.dfncis.de>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!newsfeeds.belnet.be!news.belnet.be!newsfeed00.sul.t-online.de!t-online.de!newsfeed.r-kom.de!fu-berlin.de!uni-berlin.de!151.200.109.76!not-for-mail

References: <e2W78.96$mb6.263@pollux.casema.net> <OHNGisprBHA.824@dogwood.us.checkpoint.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,ea410c98d66c1f0c
X-Google-Attributes: gidf922c,public
X-Google-Thread: fc559,12dcb949ae158b22
X-Google-Attributes: gidfc559,public
X-Google-ArrivalTime: 2002-02-06 05:46:40 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!newsfeeds.belnet.be!news.belnet.be!newsfeed00.sul.t-online.de!t-online.de!newsfeed.r-kom.de!fu-berlin.de!uni-berlin.de!151.200.109.76!not-for-mail
From: "Keith W. McCammon" <km@km.com>
Newsgroups: comp.security.firewalls,cp.products.firewall-1
Subject: Re: VPN behind not managed Firewall-1: can it be done?
Date: Wed, 6 Feb 2002 08:36:50 -0500
Lines: 11
Message-ID: <a3rbi8$19h2ru$1@ID-59806.news.dfncis.de>
References: <e2W78.96$mb6.263@pollux.casema.net> <OHNGisprBHA.824@dogwood.us.checkpoint.com>
NNTP-Posting-Host: 151.200.109.76
X-Trace: fu-berlin.de 1013002632 43551614 151.200.109.76 (16 [59806])
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200

Reply to Parent Message