The firewalls are stateful firewalls that operate at level 4 of the ISO-OSI stack, that allow you to specify the rules that involve protocol type (TCP, UDP, ICMP, etc.). And source port or destination. In one of the previous articles in this blog we have seen how to implement a similar solution in Windows Server RRAS. The proposed solution had the following characteristics:
- effective against the server connections of P2P like eMule,
- less effective in countering peer connections in P2P (eg. Kad or Bittorrent)
- effective in all types of filter packages agreeing traffic only through the known ports;
- little effect in FTP in passive mode, since the data ports are chosen randomly among the PASV (1025-65535).
Given these strengths and weaknesses, the most visible to the end user was definitely a lack of access to FTP, and with programs dedicated to that browser.
The problem, using a stateful firewall (and RRAS) can not be solved, unless you give up the security of the network ...
may be considered as an alternative proxy like Squid, but it still lets the P2P. In the next article we will see a solution based on L7filter program, which operates seven of the OSI stack and, therefore, to intervene in protocols "applications" as HTTP, POP3, FTP, etc..
you soon!
0 comments:
Post a Comment