spectrum48k

so they have a draytek vigor, and I've set the 4 managers up with fixed IP address

the draytek firewall rules I setup permit the 4 IP addresses through, and blocks port 80 for anything else.

So, assuming the employees get clever, which other ports should I block to prevent them from access the net using other methods ?

hodgy0_2

it depends on your actual goals - the internet is short for interconnected network

you have blocked port 80 access to the internet -- this in reality is only http traffic - what most people know as www (or the web)

what about FTP traffic on port 21? should they be allowed FTP access to the internet

they could set up a webserver on the internet on port 8080 and connect to it or even 3389 which would mean the could RDP to a remote machine and the surf the net

the instant messaging protocols?

most enterprise organisation block all out bound requests apart from 80 and 443 -- then block actual dodgy URL's/IP's -- so if you want to block internet traffic you may just have to block all outbound access aprt from the managers fixed IP's

you managers might need 443 access btw

mike1210

yep as Hodgy with my 2600G I used to have the first filter rule as block everything unless an exeption and then add exceptions after this, on the 2600 you had to specify TCP and UDP as seperate rules or it wouldn't work. Also it didn't support IP protocols (GRE for example) and only had simplified SPI, hopefully the newer 2800's are better for this, it did however support wildcard masking (ranges) so to keep the rules as few as possible make the managers IP next to each other so to speak (192.168.1.20-192.168.1.24)

so it was

Block all TCP
Block all UDP
allow port 53 UDP (unless you have internal DNS servers this would also
be needed)
Allow port 80 TCP (http) for 192.168.1.20-192.168.1.24
Allow port 443 TCP (https)
allow port 21 TCP (ftp)

the above may cause probs with FTP connections as passive (might be active can't remember which) FTP makes another connection to the same IP on a random tcp port on the range 1024-65535 so this would be blocked by the filter unless the 2800 has an FTP inspect feature on the firewall (the 2600 didn't)

pimmo2000

iTrader: (6)

why ? how about trusting them ? and using gross misconduct as a prize

mike1210

Pimmo, Spectrum may just be following a criteria that the managers have set out for him, no one to have net access bar the managers etc etc.

BlkKnight

Do they need access to the web at all?

Just remove their route (default gateway) to the web.

If your network is DHCP - remove the gateway & manually add it to those that need it.

spectrum48k

to answer that, the managers put the internet in and "trusted them" for about 3 months, when one of the machines was caught surfing a dodgy site in thailand and picked up a really nasty virus - that resisted all attempts to remove it, until the hard drive was removed and sorted externally, resulting in loss of production to the equipment that was connected to it.

spectrum48k

that'll do me!

question - anti-virus software on these factory workstations needs to update itself. How do you go about allowing that ? Do I need to check with anti-virus website and find the except method of communication and create a specific rule for it ?

hodgy0_2

you need to find the port the client av programe connects to the remote update server host on

and allow that out of the firewall

but in any case you are going to have to be slighly smart in configuring your internt access

basically you cannot do a global deny -- so no that won't do you

mike1210

Another thing as well......windows updates ....unless you have an internal WSUS server. I didn't think of Anti-Virus updates either

If you knew the anti-virus server IP you technically could add an exception on port for an IP address and the microsoft range but this could proove to be a major ****, a default deny in this case could proove to be too obstructive. The draytek routers I'm sure have a surfcontrol interface which you can subscribe too which allowes websites to be blocked but could allow out other traffic for a small fee. What draytek do they have?

DrayTek Web Content Management

spectrum48k

Its a Vigor 2600

Windows Updates - good point - I'll check out the ports and addresses