Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 2 subscribers
  • Views 1179 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Using a single packet filter rule

rgilbert
Hi,

Sorry for the noob question but, what are the ramifications, security or otherwise, of just having a single packet filter rule of: 

Source: internal (network)
Service: any
Destination: any

Trying to create unique packet filter rules that cover each source (or group of sources) and their services (or group of services) is very time consuming when there are many different types of source/service combinations on the internal LAN.  Once you get all these unique packet filter rules defined and working isn't it basically equivalent to the above single packet filter rule?

What am I not understanding?

Thanks,
Ron


This thread was automatically locked due to age.
Parents
  • 0
    Yes and no.  There isn't any way of making yourself 100% secure, short of turning everything off and not using computers.  It's about risk reduction.  If you "whitelist" traffic down to only the ports that you absolutely need, then you don't have to worry about the other 65k+ (there are 65536 usable ports total) ones that then won't be usable.

    Like I said, it's very common to just go ahead and allow internal traffic unfettered access to anything.  Based on your business security policies and the industry that you're in, you'll need to determine whether or not it makes sense to be more strict.  I was just giving you the rationale behind using the packet filter with more stringent rules.
  • 0 in reply to Scott_Klassen
    Thanks for the replies.  Looks like I need to learn about egress filtering.
Reply Children
No Data