0

Developer here, not a sysadmin. After reading over my firewall logs and seeing (assuming bot inititied) DROP entries, I'd like to script something to auto-update my firewall settings to deny their originating IPs.

Is this a sensible strategy? Should I simply let the firewall continue to deny these hits by itself and hope they don't return or progress into something more?

Or perhaps I should simply be asking for documentation or tutorials on router configurations?

5
  • If your firewall is denying the traffic, what would you hope to accomplish by changing the firewall? A deny is a deny; the firewall is doing its job, and you want to change that?
    – Ron Maupin
    Oct 7 '15 at 17:12
  • @RonMaupin I suppose I had the idea that specifically denying particular ip's would deny them even the possibility of initiating a port scan. Even if the firewall drops them on that one occasion, could they not try a second or third attempt on different ports? Oct 7 '15 at 17:27
  • You could do that, but, if this firewall is connected to the Internet, you will end up with far too many specific deny statements. Typically, the firewall will deny any traffic initiated from outside unless you have specifically added exceptions. I don't see much to gain from all the work.
    – Ron Maupin
    Oct 7 '15 at 17:30
  • Ah ic. Thanks, that's good to know. Can you recommend some reading material about understanding exactly how firewalls work? If it's able to deny all outside-initiated-traffic, how to something like metasploit compromise a network? Doesn't it find a port you've opened with a valid application and attempt to pass data along those lines, making it appear as if it was requested traffic? Again, thank you for the help. Oct 7 '15 at 17:37
  • I posted an answer.
    – Ron Maupin
    Oct 7 '15 at 17:48
0

If your firewall is denying the traffic, what would you hope to accomplish by changing the firewall? A deny is a deny; the firewall is doing its job, and you want to change that?

You could do that, but, if this firewall is connected to the Internet, you will end up with far too many specific deny statements. Typically, the firewall will deny any traffic initiated from outside unless you have specifically added exceptions. I don't see much to gain from all the work.

Holes are automatically created for outside traffic when a traffic flow is originated from the inside. The hole is created for a specific flow from the a specific address and port to a specific address and port. Even with those restrictions, the hole only lasts so long before being closed. You could open a specific hole with a firewall exception to allow any outside traffic to a specific address/port in your network to allow things like a web server to be accessed from outside.

This is a very broad subject that cannot properly be discussed in this forum, and product or resource recommendations are specifically off-topic for this forum.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.