Re: [44net] Subject: PTD

Gus, The secure approach to firewall rules is to set your default policy to drop, then write rules to allow the specific traffic you want (protocol/port(s), interface(s), source addr(s), dest addr(s)). For example, maybe you only allow telnet to be forwarded from your amprnet interface to your JNOS tunnel interface if it is from 44.x addresses. So you write a rule to allow that. But anything else, including telnet from anywhere else to anywhere else, would be dropped by the default policy. For the example that started this thread, if you don't use snmp, then don't write a rule. It will be dropped by the default drop policy. But maybe you want to allow snmp from a specific subnet on your own network (where your management hosts are). So you write an accept rule for that. Anything else, including snmp from other source addresses, would be dropped by the default policy. To check for abuse within the list of allowed traffic, you can use something like fail2ban. You set up match criteria (log message format, how many times, within what time period). If fail2ban finds matches, it writes a firewall rule to ban that host completely for a specified period of time. You can even have it send you email to tell you what was banned, why (which match rule plus a list the matched log entries), and include a whois output for the offending host. For example, now that JNOS can use a fixed log filename, you can set up fail2ban to scan the JNOS log for login failures and, if found, have fail2ban ban those addresses by automatically adding rules to your firewall config. The combination of default drop policy and fail2ban on the allowed traffic is very effective. Michael N6MEF