Firewall sets the route access table to prevent hacker intrusion

The following articles mainly describe how the firewall sets a route access table to prevent hacker intrusion. There are two firewall Methods: port scanning and path tracing, today, we mainly want to learn about how to prevent hacker intrusion. The following describes the main content of the article.

Methods To prevent hacker intrusion 1. Most firewalls carry their own identifiers

For example, the FIREWALL-1 of CHECKPOINT listens on TCP ports 256, 257, 258 by default;

MICROSOFT's proxy server listens on TCP ports 1080 and 1745.

Because most IDS products are configured by default to only detect a wide range of empty port scans, so truly smart attackers will never use this method of careless carpet scanning. Instead, a scanning tool such as NMAP is used for selective scanning, avoiding IDS protection that is not configured in detail, as shown below:

Command: nmap-n-vv-p0-p256, 60.254, 1745, 192.168.50.1-

!!! Note that most firewalls do not respond to icmp ping requests. Therefore, the-P0 parameter in the upstream command

It exposes the attack tendency to prevent sending ICMP packets.

How to prevent it?

Configure the CISCO router ACL table to block the corresponding listening port

For example:

Access-list 101 deny any eq 256 log! Block FireWall-1 scans access-list 101 deny any eq 257 log! Block FireWall-1 scans access-list 101 deny any eq 258 log! Block FireWall-1 scans access-list 101 deny any eq 1080 log! Block socks scans access-list 101 deny any eq 1745 log! Block winsock scans

Method 2. Path Tracking

UNIX traceroute and NT tracert.exe are used to track the last hop before arriving at the host. It is highly likely to be a firewall.

If the router between the local host and the target server responds to the TTL expired group, it is easy to find the firewall. However, many routers and firewalls are set to do not return icmp ttl expired groups, and the detection package usually does not display any path information several hops before arriving at the target.

How to prevent it?

Because the entire trace path may go through the network provided by many ISPs, these ROUTERE configurations are out of your control, therefore, you should try your best to control the icmp ttl response configuration of your border router.

For example, access-list 101 deny icmp any 1 0! Ttl-exceeded

When you configure a VBR to receive a group with a TTL of 0 or 1