Xref: utzoo alt.security:2489 comp.protocols.tcp-ip:16029 comp.sources.wanted:16571 Path: utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!uunet!wuarchive!udel!mcneill From: mcneill@udel.edu (Keith McNeill) Newsgroups: alt.security,comp.protocols.tcp-ip,comp.sources.wanted Subject: SUMMARY: Need firewall telnet/ftp gateway Message-ID: <53003@nigel.ee.udel.edu> Date: 8 May 91 14:23:16 GMT Sender: usenet@ee.udel.edu Reply-To: mcneill@udel.edu () Followup-To: alt.security Organization: University of Delaware Lines: 83 Nntp-Posting-Host: louie.udel.edu Many people asked for a summary on the responses that I got on my proxy telnet/ftp query. First my original note: ] ] ]We are setting up an internet gateway at work. Currently, we're going ]to set it up as a firewall system. A problem with this setup is that ]anybody in the company who wants to telnet/ftp to the internet has to ]have an account on the firewall system, an administration nightmare. I've ]heard about some software that you put on the gateway that acts as a ]telnet/ftp intermediary. The software consists of a modified telnet/ftp ]for inside our network which connects to intermediary software that is put ]on the firewall gateway. The intermediary software then makes the telnet/ftp ]connections out on the internet. ] Now the "answer": If your firewall is a Sun & you have lots of Sun's in your organization then you are all set. Sun has a (or is about to release) a Consulting Special called Itelnet/Iftp which is a proxy telnet/ftp server. Call your local Sun office for information on "Consulting Specials". If you don't have Sun's I heard from somebody at Sun that the consulting group ***may*** be willing to port...for a price. Some people mentioned AT&T's paper on their Internet gateway. I still haven't been able to relocate my copy but if memory serves me I think that their setup is specific to AT&T & their Datakit network. Please correct me if I am wrong. Many, many people mentioned using a router (most people mentioned Cisco) to do packet filtering. A couple people had an interesting firewall/router debate going on for awhile, but I don't think that there is a correct answer. As with most computer/network configurations it all depends on the structure & people of your company/organization as to which is the better solution. If you decide to go the router "route" some people suggested that among the obvious ports to restrict that you restrict UDP packets to block Sun RPC's (including yellow pages & NFS) and TCP port 6000 to block X11. There is also some software that enables you to disallow connections from certain hosts/domains at certain ports. You can get it via anonymous ftp at cert.sei.cmu.edu in pub/network_tools. Many thanks to: Richard Cower mo@messy.bellcore.com Bill Lewandowski "Jerry M. Carlin" "Timothy G. Smith" smb@ulysses.att.com William Clare Stewart Michael O'Connor "Anthony A. Datri" "Randal L. Schwartz" "Kenneth R. van Wyk" Tp Brisco Brent Chapman fec@mhuxo.att.com David Pipes x4552 David Richardson Sean Kelly "Ted R. Doty" Chris Sherman David Neal rodk@germania.corp.sun.com Phil Meyer and all the other people who responded. I got close to 40 responses within 24 hours! Once again the Internet proves its worth!! Keith -- Keith McNeill | 1131 North Broom Street mcneill@udel.edu | Wilmington, Delaware, 19806 | (302) 427-0101