How SECURE is your FIREWALL?

amusement · 01-04-2005, 09:50 AM

Many of US have broadband internet. I read a few weeks ago it takes only 3 minutes for an unprotected computer system to be hacked.

This has motivated to make sure my internet firewalls are working.

I use "Shields Up" web site to test my firewall. The test is accomplished by probing your computer's network.

If you want to test your firewall goto Shields Up

Some of you already have 'hardened' your PC's against attacks. It might be worth a try to make sure port 113 doesn't show up during the test. My 'old' broadband router didn't have a block for port 113. My solution was to forward port 113 to a IP address that didn't exist in my network. As an example; forwarding port 113 to 192.168.1.254. I don't have any network devices that have 192.168.1.254. As a result the forwarding packet drops off the planet (aka bit bucket).

This ad is not displayed to registered members.
Register your free account today and become a member on Yotatech!

GRNTACO · 01-04-2005, 10:05 AM

Very cool stuff, thanks!

I have always used Broadband Reports for all my testing needs but it is nice to see others.

***midiwall*** · 01-04-2005, 10:33 PM

I love Steve Gibson... I've been watching what he does since about 1984.

Knocking out 113 is a good idea, but like he says on the site, remember that you did it if you ever run into a POP server that doesn't want to talk to you.

GRNTACO · 01-05-2005, 07:03 PM

Why is port 80 open when I run the test?

CynicX · 01-06-2005, 06:23 AM

Dont make people harden they're networks too much. I wouldnt have anything to do at work if I couldnt sponge off peoples routers....

MvCrash · 01-06-2005, 07:04 AM

Quote:

Originally Posted by GRNTACO

Why is port 80 open when I run the test?

Greetings,
Your PC has a webserver running as a service, shut it off unless you are running a website on your PC.

amusement · 01-06-2005, 08:00 AM

Like MVCrash said It's for a webserver (http). Please check your router port forwarding for port 80.

GRNTACO · 01-06-2005, 08:47 AM

Quote:

Originally Posted by amusement

Like MVCrash said It's for a webserver (http). Please check your router port forwarding for port 80.

I don't have a webserver running. How do you trun it off? I was checking my router and didn't see a port 80.

***midiwall*** · 01-06-2005, 10:25 AM

Quote:

Originally Posted by GRNTACO

I don't have a webserver running. How do you trun it off? I was checking my router and didn't see a port 80.

Something is responding to request for service on the normal web port... Lemme have your IP address and I'll take a look.

If you can't ID the application that's got it open on your machine, then head back into the router and look into "port mapping" or "static routes" or "port forwarding". The router will offer up one or more of these things... You'll want to setup something so that requests for port 80 get sent off to an unused IP address like 192.168.1.254, or change port 80 requests to an unused number like 8377.

As it is now, there's something live somewhere that's responding to requests, and that's not safe.

Now, a side issue here could be that you enabled remote administration on the router itself. It may be coming up on port 80, and that's REALLY bad.

If you want me to play, send me the IP address of the _router_ in email. But actually, you should be able to see it with a browser. Just enter the IP address into the URL line (i.e., "http://xxx.xxx.xxx.xxx") and see what comes up.

GRNTACO · 01-06-2005, 11:56 AM

Quote:

Originally Posted by midiwall

Something is responding to request for service on the normal web port... Lemme have your IP address and I'll take a look.

If you can't ID the application that's got it open on your machine, then head back into the router and look into "port mapping" or "static routes" or "port forwarding". The router will offer up one or more of these things... You'll want to setup something so that requests for port 80 get sent off to an unused IP address like 192.168.1.254, or change port 80 requests to an unused number like 8377.

As it is now, there's something live somewhere that's responding to requests, and that's not safe.

Now, a side issue here could be that you enabled remote administration on the router itself. It may be coming up on port 80, and that's REALLY bad.

If you want me to play, send me the IP address of the _router_ in email. But actually, you should be able to see it with a browser. Just enter the IP address into the URL line (i.e., "http://xxx.xxx.xxx.xxx") and see what comes up.

I will play with it a bit more and see what is going on.

I think it may be the XP Pro and the remote desktop thingy.

***midiwall*** · 01-06-2005, 01:14 PM

Quote:

Originally Posted by GRNTACO

I think it may be the XP Pro and the remote desktop thingy.

Nah... Remote Desktop is on a different port (3389) - you'll have to open a port on the router for it to work.

GRNTACO · 01-06-2005, 01:18 PM

I was playing with my router and there is nothing you speak of on there. This is pissing me off.

I get the open port on both machines.

GRNTACO · 01-06-2005, 01:21 PM

I can't access my router form work.

SolidDigital · 01-06-2005, 02:15 PM

port 515, Name:printer Purpose:spooler
what's that about? everything else is green and just that one is red.,

***midiwall*** · 01-06-2005, 06:30 PM

Quote:

Originally Posted by GRNTACO

I can't access my router form work.

If you've been using Remote Desktop, then log in there and hit up 192.168.1.1 (or whatever the router address is) from the point of view of the local machine. I do that from work sometimes.

Quote:

Originally Posted by SolidDigital

port 515, Name:printer Purpose:spooler

Having this port open will allow someone on the outside to print on your local printer. Are you running a router? It sounds like you may be direct-connected to the net.

funny story... I was wandering through my router logs one time and found all these "port peeks" coming from an IP address. Using APNIC, I reversed the IP and found that it was coming from an address somewhere in Russia. I figured eye-for-an-eye is a good thing...

So I snooped on his IP for a while... and found an open share to a printer.

I connected to it... and started printing... VOLUMES of technical manuals I have laying around. Every-so-often I'd get an "Paper out" notice... So I'd wait a bit, the paper-out would clear... and I'd start printing again.

I kept that up for a couple of days... he finally got tired of the game and turned the printer off.

SolidDigital · 01-06-2005, 07:05 PM

that's pretty good lol, guess he learned his lesson =p

I do have a wireless router, but have never been able to connect to the other computer. it's running on windows 98 and this one's on xp. It would come in handy to figure out how to print something from this computer on the printer downstairs though lol.

GRNTACO · 01-06-2005, 10:00 PM

Quote:

Originally Posted by midiwall

If you've been using Remote Desktop, then log in there and hit up 192.168.1.1 (or whatever the router address is) from the point of view of the local machine. I do that from work sometimes.

I have never used that so........WTF.

85TurboRunner · 01-07-2005, 03:58 PM

according to all those tests my computer doesnt exist, and thats the way i like it.

***Corey*** · 01-08-2005, 12:18 PM

I use that site from time to time.
Tested it earlier in the week with my Netgear RP614 NAT router, and I was stealth in everthing and showed no open ways to get in to my PC.

Now going to test it with the Linksys RT31p2 router I just hooked up.
Stand by...

Cool, all ports on the big test where it tests the first 1056 ports are all in stealth mode.

SolidDigital · 01-08-2005, 04:31 PM

well I've looked through all my router settings and can't figure out how to fix the port 515 thing. Is it just going to be open because of the router?

***midiwall*** · 01-08-2005, 04:59 PM

I spent about 90 minutes with Ben (GrnTaco) on the phone today while logged into his machine remotely... We got him pretty well figured out, but there's still an issue with (we're thinking) the Dell remote support application on his laptop holding port 80 open.

But... (and SolidDigital, this is why I bring this up) we got around it for the time being by setting up a redirection for port 80 traffic to an unused IP address on his network. You might want to do the same until you can figure out who's got remote spooling open.

Down that path though, there are a couple of things that you can check on the side:

I would first work to figure out which computer has the port open. You can do this by pulling one computer at a time off of the network, then running the Shield'sUp test on the other one. If I had to guess, I think you'll find that it's the Windows 98 machine.
I know you want to be able to do this, but turn OFF "Share my printers" in the network control panel. That should kill the remote spooler.
Turn OFF NetBIOS support. Doing this will cause issues with being able to "browse" your local network, but it'll be safer overall.
Create a static route in the router and point 515 traffic to an unused IP address.

Lemme know what you find out.

Oh, for the record, getting Win98 and XP to happily share devices is "fun" and "exciting". You'll want to be sure that the Win 98 box is SE, and that you have SP 2 on the XP box. Any chance that the 98 box is big enough to handle an upgrade to XP?

MvCrash · 01-31-2005, 06:23 PM

Greetings,
Since the webserver is a service, you can simply set the service to only start manually. It won 't make a difference if there is software running that wants to open the webserver. Redirecting the port to an unused IP address can cause trouble by utilizing resources on the PC.
IMHO, you must set the Service to Manual and remove any software that is calling for an open PORT 80 Service.

***midiwall*** · 02-01-2005, 07:33 AM

Quote:

Originally Posted by MvCrash

Redirecting the port to an unused IP address can cause trouble by utilizing resources on the PC.

Right... This was a temporary fix until Ben/we/someone can find the app that has the port open. It didn't jump out at me when I was wandering the box.

Quote:

IMHO, you must set the Service to Manual and remove any software that is calling for an open PORT 80 Service.

Right... and that will happen as soon as Ben/we/someone finds the app that is holding the port open.

SolidDigital · 02-01-2005, 03:43 PM

Quote:

I would first work to figure out which computer has the port open. You can do this by pulling one computer at a time off of the network, then running the Shield'sUp test on the other one. If I had to guess, I think you'll find that it's the Windows 98 machine.
I know you want to be able to do this, but turn OFF "Share my printers" in the network control panel. That should kill the remote spooler.
Turn OFF NetBIOS support. Doing this will cause issues with being able to "browse" your local network, but it'll be safer overall.
Create a static route in the router and point 515 traffic to an unused IP address
Lemme know what you find out.

Oh, for the record, getting Win98 and XP to happily share devices is "fun" and "exciting". You'll want to be sure that the Win 98 box is SE, and that you have SP 2 on the XP box. Any chance that the 98 box is big enough to handle an upgrade to XP?

the weird thing is I can't access network options on the windows 98 computer.. but I did turn off 'share my printers' on this one and 515 still shows up open.
Guess I'm pretty stupid when it comes to networking stuff, I can't even find anything that says netbios to turn off lol

only thing I've found on my router page is "virtual servers" where it has "description", "inbound port" which has a box, dash and another box, "type", "private ip address" and "private port"

the computer downstairs is only a 300mhz P2 with 64mb of ram and 4mb video card. kinda think xp would kill it haha

SolidDigital · 02-13-2005, 05:11 PM

I checked it the other night when the old computer was shut down, and 515 wasn't open. Now today the other computer's on and 515 is open again.

01-04-2005, 10:05 AM	#2 (permalink)
GRNTACO Registered User Join Date: Oct 2003 Location: On a trail in WA. Posts: 1,439	Very cool stuff, thanks! I have always used Broadband Reports for all my testing needs but it is nice to see others. __________________ Ben

01-04-2005, 10:33 PM	#3 (permalink)
*midiwall* Sponsoring Member Join Date: Dec 2002 Location: Seattleish, WA Posts: 9,078	I love Steve Gibson... I've been watching what he does since about 1984. Knocking out 113 is a good idea, but like he says on the site, remember that you did it if you ever run into a POP server that doesn't want to talk to you. __________________ ~ Mark '96 4Runner Limited S/C MI - 370cc injectors, Air! horns, Airaid MIT, ATS A-arms, 285/75/R16 BFG MTs, Bored TB, Brembo slotted, Cobra 75 WXST, Deckplate, Downey headers, Hayden cooler, IPT valve body, Level 10 torque convertor, Meanstreak exhaust, OME/OME rears, On-board PC (XM, Nav, WiFi, etc), Port 'n Polish, Remote Start, SAW fronts, Hilux console, SMT-5, Stubb's sliders, Supra MAF, TJM-17, 2.0" pulley, Viair 450c, Walbro 190, Weasy2k cams

01-05-2005, 07:03 PM	#4 (permalink)
GRNTACO Registered User Join Date: Oct 2003 Location: On a trail in WA. Posts: 1,439	Why is port 80 open when I run the test? __________________ Ben

01-06-2005, 06:23 AM	#5 (permalink)
CynicX Contributing Member Join Date: Jul 2004 Location: Maryland Posts: 2,371	Dont make people harden they're networks too much. I wouldnt have anything to do at work if I couldnt sponge off peoples routers.... __________________ 06 Subaru WRX

01-06-2005, 01:18 PM	#12 (permalink)
GRNTACO Registered User Join Date: Oct 2003 Location: On a trail in WA. Posts: 1,439	I was playing with my router and there is nothing you speak of on there. This is pissing me off. I get the open port on both machines. __________________ Ben

01-06-2005, 08:00 AM	#7 (permalink)
amusement Contributing Member Join Date: Nov 2003 Location: Portland, Oregon Posts: 1,509	Like MVCrash said It's for a webserver (http). Please check your router port forwarding for port 80.

01-06-2005, 01:21 PM	#13 (permalink)
GRNTACO Registered User Join Date: Oct 2003 Location: On a trail in WA. Posts: 1,439	I can't access my router form work. __________________ Ben

01-06-2005, 02:15 PM	#14 (permalink)
SolidDigital Registered User Join Date: Oct 2003 Location: va Posts: 540	port 515, Name:printer Purpose:spooler what's that about? everything else is green and just that one is red., __________________ 89 Deluxe Short Bed, 3.0 V6 5spd, 4x4, 31x10.5 BFG Radial Long Trails on 15x8 Pacer rims, K&N air filter, high flow cat, Dynomax 2.5" Super Turbo muffler, Sunpro tach... Fiamm 125db. low note horn Pioneer 50w x 4 cd player, Polk speakers

01-06-2005, 07:05 PM	#16 (permalink)
SolidDigital Registered User Join Date: Oct 2003 Location: va Posts: 540	that's pretty good lol, guess he learned his lesson =p I do have a wireless router, but have never been able to connect to the other computer. it's running on windows 98 and this one's on xp. It would come in handy to figure out how to print something from this computer on the printer downstairs though lol. __________________ 89 Deluxe Short Bed, 3.0 V6 5spd, 4x4, 31x10.5 BFG Radial Long Trails on 15x8 Pacer rims, K&N air filter, high flow cat, Dynomax 2.5" Super Turbo muffler, Sunpro tach... Fiamm 125db. low note horn Pioneer 50w x 4 cd player, Polk speakers

01-07-2005, 03:58 PM	#18 (permalink)
85TurboRunner Registered User Join Date: Aug 2004 Location: Vancouver WA Posts: 1,067	according to all those tests my computer doesnt exist, and thats the way i like it. __________________ 1985 4runner 22re 5spd.

01-08-2005, 12:18 PM	#19 (permalink)
*Corey* Co-Founder/Administrator Staff Join Date: May 2002 Location: Auburn, Washington Posts: 26,080	I use that site from time to time. Tested it earlier in the week with my Netgear RP614 NAT router, and I was stealth in everthing and showed no open ways to get in to my PC. Now going to test it with the Linksys RT31p2 router I just hooked up. Stand by... Cool, all ports on the big test where it tests the first 1056 ports are all in stealth mode. __________________ Corey 2007 FJ Cruiser Built for 4wheelin', expedition, camping, and overlanding use PNW FJ Cruisers ☺ Detailing 101 ☺ Join Topsites ☺ Muffler Comparisons ☺ Maggiolinas In The Wild FJ Cruiser Buildup ☺ New Roof Top Tent ☺ Video Of My Penthouse Part II ☺ Rehinge Your ARB/Engel Fridge Blog About Roof Top Tents ☺ FJC Magazines Online Review Of My Tent ☺ 2009 Specialized Rockhopper Pro

01-08-2005, 04:31 PM	#20 (permalink)
SolidDigital Registered User Join Date: Oct 2003 Location: va Posts: 540	well I've looked through all my router settings and can't figure out how to fix the port 515 thing. Is it just going to be open because of the router? __________________ 89 Deluxe Short Bed, 3.0 V6 5spd, 4x4, 31x10.5 BFG Radial Long Trails on 15x8 Pacer rims, K&N air filter, high flow cat, Dynomax 2.5" Super Turbo muffler, Sunpro tach... Fiamm 125db. low note horn Pioneer 50w x 4 cd player, Polk speakers

01-08-2005, 04:59 PM	#21 (permalink)
*midiwall* Sponsoring Member Join Date: Dec 2002 Location: Seattleish, WA Posts: 9,078	I spent about 90 minutes with Ben (GrnTaco) on the phone today while logged into his machine remotely... We got him pretty well figured out, but there's still an issue with (we're thinking) the Dell remote support application on his laptop holding port 80 open. But... (and SolidDigital, this is why I bring this up) we got around it for the time being by setting up a redirection for port 80 traffic to an unused IP address on his network. You might want to do the same until you can figure out who's got remote spooling open. Down that path though, there are a couple of things that you can check on the side: I would first work to figure out which computer has the port open. You can do this by pulling one computer at a time off of the network, then running the Shield'sUp test on the other one. If I had to guess, I think you'll find that it's the Windows 98 machine. I know you want to be able to do this, but turn OFF "Share my printers" in the network control panel. That should kill the remote spooler. Turn OFF NetBIOS support. Doing this will cause issues with being able to "browse" your local network, but it'll be safer overall. Create a static route in the router and point 515 traffic to an unused IP address. Lemme know what you find out. Oh, for the record, getting Win98 and XP to happily share devices is "fun" and "exciting". You'll want to be sure that the Win 98 box is SE, and that you have SP 2 on the XP box. Any chance that the 98 box is big enough to handle an upgrade to XP? __________________ ~ Mark '96 4Runner Limited S/C MI - 370cc injectors, Air! horns, Airaid MIT, ATS A-arms, 285/75/R16 BFG MTs, Bored TB, Brembo slotted, Cobra 75 WXST, Deckplate, Downey headers, Hayden cooler, IPT valve body, Level 10 torque convertor, Meanstreak exhaust, OME/OME rears, On-board PC (XM, Nav, WiFi, etc), Port 'n Polish, Remote Start, SAW fronts, Hilux console, SMT-5, Stubb's sliders, Supra MAF, TJM-17, 2.0" pulley, Viair 450c, Walbro 190, Weasy2k cams Last edited by midiwall; 01-09-2005 at 09:04 AM.

01-31-2005, 06:23 PM	#22 (permalink)
MvCrash Contributing Member Join Date: Jul 2004 Location: Northern NJ Posts: 342	Greetings, Since the webserver is a service, you can simply set the service to only start manually. It won 't make a difference if there is software running that wants to open the webserver. Redirecting the port to an unused IP address can cause trouble by utilizing resources on the PC. IMHO, you must set the Service to Manual and remove any software that is calling for an open PORT 80 Service. __________________ MvCrash 2005 Rav4L Stock for now 2003 Mustang Mach 1, 4.6 DOHC V8. Cold air intake,magnaflow cross over and cat back, Custom tune by Predator SOLD:2001 Tacoma XCab, Michelin LTX, AmeraGuard Spray in Liner, Access Roll-Up Tonneau Cover, Synthetic Oils

02-13-2005, 05:11 PM	#25 (permalink)
SolidDigital Registered User Join Date: Oct 2003 Location: va Posts: 540	I checked it the other night when the old computer was shut down, and 515 wasn't open. Now today the other computer's on and 515 is open again. __________________ 89 Deluxe Short Bed, 3.0 V6 5spd, 4x4, 31x10.5 BFG Radial Long Trails on 15x8 Pacer rims, K&N air filter, high flow cat, Dynomax 2.5" Super Turbo muffler, Sunpro tach... Fiamm 125db. low note horn Pioneer 50w x 4 cd player, Polk speakers

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
How to secure taller-than-stock height battery?	T4R 4ME	General Vehicle Related Topics (Non Year Related)	15	01-09-2007 03:39 AM
How does everyone secure gear?	Texas Jim	Newbie Tech Section	14	11-15-2006 09:59 PM
HOw do you secure your ride???	deathrunner	General Vehicle Related Topics (Non Year Related)	68	02-18-2006 03:09 AM
do you secure your roof basket?	kato	95.5-2004 Tacomas & 96-2002 4Runners	13	07-28-2005 11:55 PM
How SECURE is your BROWSER?	amusement	Computer Talk	24	01-09-2005 10:16 AM