Re: SYN Proxy

[Matt Kettler <mkettler () evi-inc com>]

Xavier Cabrera wrote:
> Hello:
>
> Thanks for all your answers. Wel i think too the best aproach for this 
> is doing on iptables like Will say.. but if we really want a IPS with 
> snort maybe we can start to think on that solution. Maybe people of 
> sourcefire can plant this solution for future releases.
>
> If snort in future can handle the connections with syn proxy or (seudo 
> syn proxy) validating the real one's before they can pass can start to 
> think in the best IPS of the World
>
> Well, i have to continue with my two boxes.... Like Matt say... right 
> now i have a Linux-Snorted behind a BSD.... and that is not elegant.... 
> A firewall behind another one?

Personally, I hardly care about "elegance" in networking. However, one thing I 
do care about is security.

The stacked-firewall configuration has some downsides in terms of MTBF, but in 
all cases would be more secure than a single box running both packages.

If both firewalls are on the same box, a remote-access exploit of either 
firewall will ultimately breach the entire firewall.

In a stacked configuration, exploiting the outer-most firewall offers some 
benefit to the attacker, but the network is still protected by the second 
firewall. The stacked configuration also screens the second firewall, making it 
more difficult to attack, although a successful exploit of the second firewall 
box would be a complete breach.

However, now you've got 2 boxes, so hardware failure is more likely than with 
one box (if either box has a hardware failure, you're communication will be cut 
off).


Really, I don't think of the lack of elegance as a consideration at all. I would 
however consider if the lower MTBF outweighs the possibly marginal security gains.



-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users