[145160] in North American Network Operators' Group
RE: Synology Disk DS211J
daemon@ATHENA.MIT.EDU (Robert Bonomi)
Thu Sep 29 20:46:32 2011
Date: Thu, 29 Sep 2011 19:46:09 -0500 (CDT)
From: Robert Bonomi <bonomi@mail.r-bonomi.com>
To: nanog@nanog.org
In-Reply-To: <8C26A4FDAE599041A13EB499117D3C286B58F425@ex-mb-1.corp.atlasnetworks.us>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
> From: Nathan Eisenberg <nathan@atlasnetworks.us>
> Subject: RE: Synology Disk DS211J
> Date: Thu, 29 Sep 2011 21:58:23 +0000
>
> > And this is why the prudent home admin runs a firewall device he or she
> > can trust, and has a "default deny" rule in place even for outgoing
> > connections.
> >
> > - Matt
> >
> >
>
> The prudent home admin has a default deny rule for outgoing HTTP to port
> 80? I doubt it.
>
No, the prudent nd knowledgable prudent home admin does not have default deny
rule just for outgoing HTTP to port 80.
He has a defult deny rule for _everything_. Every internal source address,
and every destination port. Then he pokes holes in that 'deny everything'
for specific machines to make the kinds of external connections that _they_
need to make.
Blocking outgoing port 80, _except_ from an internal proxy server, is not
necessrily a bad idea. If the legitimte web clients are all configured
to use the proxy server, then _direct_ external connection attempts are
an indication that something "not so legitimate" may be runningunning.
