🚀 go-pugleaf

On 1 Dec 2003 18:31:45 GMT, Walter Roberson, <roberson@ibd.nrc-cnrc.gc.ca> wrote:

>  When going out, NAT implimentations often try to use the same source
>  port number, using a different port number only if the original is in
>  use. So if you have a PC that has NETBIOS turned on, and
>  Wiley E. Windows decides to do name resolution from the netbios-ns
>  (udp 137) source port, then the NAT implimentation might, as long
>  as the translation lasts, allow -anyone- to connect to that port.
>  And this being UDP, there is mechanism to signal when the name
>  resolution conversation is finished, so the translation would be kept
>  open until some timer expires.

   I have a Netgear RT314 router, and I have it block *ALL* incoming
traffic to privileged ports, i.e. the range 0..1023.  If a user is not
running servers, indeed is forbidden by the AUP, then there is no reason
whatsoever to accept incoming traffic in that range.

   I have a couple of linux machines, not using Samba, so 135..137 isn't
an issue for me.  But I do have sshd running on both my machines, so
when I do a backup on my main machine, I can copy it to the backup
machine.  Linux also runs printers via a daemon, and I have my machines
listening for "remote" syslog output on 192.168.1.255.  Then there's X,
which is capable of listening on some ports.  Blocking privileged ports
(and X Window listening ports) at the router protects my linux machines.
For defense-in-depth, iptables limits the listening range to
192.168.1.248/29 and I launch X with the "-nolisten tcp" option.

-- 
Walter Dnes; my email address is *ALMOST* like wzaltdnes@waltdnes.org
Delete the "z" to get my real address.  If that gets blocked, follow
the instructions at the end of the 550 message.