Miscellaneous Operating Systems/Hardware

Was looking around 'cuz my proxy is about twenty years old and Cisco acl's are a bitch and everybody says modern stateful firewalls are the bee's knees and that bright red Watchguard sure would look good sitting in the rack but ...

http://www.ranum.com/security/computer_ ... epinspect/

hmm. Watcha think ?

Deep package inspection is a blessing and a curse - it's great for protecting your internet-facing services; it can block "malicious" stuff that is using legitimate ports and services (remember the old trick of running sshd on port 80?), but it's quite often implemented with one step too far... like doing SSL MITM to check whether a TCP/443 session is in fact encrypted HTTP and not some VPN or any other stream. I've had to jump through some hoops to dodge that kind of nasties at various customers.

For a home setup, I seriously wouldn't bother. I've got iptables on my openwrt home router and it does everything I need and more - I guess I could even run a proxy on it (but I don't see a need for it). Any low power Linux or BSD machine with minimal configuration could do that job.

For a company setup... well, better safe than sorry. Maybe a nosy inspecting firewall *is* what you want then.

Alver wrote: I guess I could even run a proxy on it (but I don't see a need for it).

Privoxy on the router is on my TODO-list. To suppress YouTube ads on the TV

DPI is useful for spying. It doesn't have much use for a firewall scenario.

robespierre wrote: DPI is useful for spying. It doesn't have much use for a firewall scenario.

I disagree. There are plenty of proper uses for DPI - as a matter of fact, I've only seen it being used for "spying" a couple of times, and always as a side effect of a proper use: checking for masked rogue traffic or exploit fingerprints in communication channels. Killing cross-site scripting and SQL injection attempts before they even hit the actual server is pretty nice.

Alver wrote: Killing cross-site scripting and SQL injection attempts before they even hit the actual server is pretty nice.

The thing is, tho, that if the servers and browsers weren't doing tremendously stupid stuff, these 'exploits' wouldn't exist. It's very similar to girls wearing skirts up to their ass, no panties, no bra and tops that flash their nipples, then complaining that ugly guys stare at them. If you don't want bad stuff to happen, then don't scribble your address and phone number on the toilet stalls down at the bus station, yes ?

To me it seems like the trouble is not 'security' - real security is pretty easy. The trouble is that people want to let google into their underwear drawer but keep charley the prevert from down the street out.

Well ..... you can't have your cake and eat it too, maybe ?