Computer Talk Discussions here pertain to mods, troubleshooting, and PC/console gaming

How SECURE is your FIREWALL?

Thread Tools
 
Search this Thread
 
Old Jan 4, 2005 | 08:50 AM
  #1  
amusement's Avatar
Thread Starter
Registered User
 
Joined: Nov 2003
Posts: 1,537
Likes: 0
From: Portland, Oregon
Exclamation How SECURE is your FIREWALL?

Many of US have broadband internet. I read a few weeks ago it takes only 3 minutes for an unprotected computer system to be hacked.

This has motivated to make sure my internet firewalls are working.

I use "Shields Up" web site to test my firewall. The test is accomplished by probing your computer's network.

If you want to test your firewall goto Shields Up

Some of you already have 'hardened' your PC's against attacks. It might be worth a try to make sure port 113 doesn't show up during the test. My 'old' broadband router didn't have a block for port 113. My solution was to forward port 113 to a IP address that didn't exist in my network. As an example; forwarding port 113 to 192.168.1.254. I don't have any network devices that have 192.168.1.254. As a result the forwarding packet drops off the planet (aka bit bucket).
Reply
Old Jan 4, 2005 | 09:05 AM
  #2  
GRNTACO's Avatar
Registered User
 
Joined: Oct 2003
Posts: 1,439
Likes: 0
From: On a trail in WA.
Very cool stuff, thanks!

I have always used Broadband Reports for all my testing needs but it is nice to see others.
Reply
Old Jan 4, 2005 | 09:33 PM
  #3  
midiwall's Avatar
Registered User
 
Joined: Dec 2002
Posts: 9,048
Likes: 2
From: Seattleish, WA
I love Steve Gibson... I've been watching what he does since about 1984.

Knocking out 113 is a good idea, but like he says on the site, remember that you did it if you ever run into a POP server that doesn't want to talk to you.
Reply
Old Jan 5, 2005 | 06:03 PM
  #4  
GRNTACO's Avatar
Registered User
 
Joined: Oct 2003
Posts: 1,439
Likes: 0
From: On a trail in WA.
Why is port 80 open when I run the test?
Reply
Old Jan 6, 2005 | 05:23 AM
  #5  
CynicX's Avatar
Contributing Member
 
Joined: Jul 2004
Posts: 2,370
Likes: 0
Dont make people harden they're networks too much. I wouldnt have anything to do at work if I couldnt sponge off peoples routers....
Reply
Old Jan 6, 2005 | 06:04 AM
  #6  
MvCrash's Avatar
Contributing Member
 
Joined: Jul 2004
Posts: 342
Likes: 0
From: Northern NJ
Originally Posted by GRNTACO
Why is port 80 open when I run the test?
Greetings,
Your PC has a webserver running as a service, shut it off unless you are running a website on your PC.
Reply
Old Jan 6, 2005 | 07:00 AM
  #7  
amusement's Avatar
Thread Starter
Registered User
 
Joined: Nov 2003
Posts: 1,537
Likes: 0
From: Portland, Oregon
Like MVCrash said It's for a webserver (http). Please check your router port forwarding for port 80.
Reply
Old Jan 6, 2005 | 07:47 AM
  #8  
GRNTACO's Avatar
Registered User
 
Joined: Oct 2003
Posts: 1,439
Likes: 0
From: On a trail in WA.
Originally Posted by amusement
Like MVCrash said It's for a webserver (http). Please check your router port forwarding for port 80.
I don't have a webserver running. How do you trun it off? I was checking my router and didn't see a port 80.
Reply
Old Jan 6, 2005 | 09:25 AM
  #9  
midiwall's Avatar
Registered User
 
Joined: Dec 2002
Posts: 9,048
Likes: 2
From: Seattleish, WA
Originally Posted by GRNTACO
I don't have a webserver running. How do you trun it off? I was checking my router and didn't see a port 80.
Something is responding to request for service on the normal web port... Lemme have your IP address and I'll take a look.

If you can't ID the application that's got it open on your machine, then head back into the router and look into "port mapping" or "static routes" or "port forwarding". The router will offer up one or more of these things... You'll want to setup something so that requests for port 80 get sent off to an unused IP address like 192.168.1.254, or change port 80 requests to an unused number like 8377.

As it is now, there's something live somewhere that's responding to requests, and that's not safe.

Now, a side issue here could be that you enabled remote administration on the router itself. It may be coming up on port 80, and that's REALLY bad.


If you want me to play, send me the IP address of the _router_ in email. But actually, you should be able to see it with a browser. Just enter the IP address into the URL line (i.e., "http://xxx.xxx.xxx.xxx") and see what comes up.
Reply
Old Jan 6, 2005 | 10:56 AM
  #10  
GRNTACO's Avatar
Registered User
 
Joined: Oct 2003
Posts: 1,439
Likes: 0
From: On a trail in WA.
Originally Posted by midiwall
Something is responding to request for service on the normal web port... Lemme have your IP address and I'll take a look.

If you can't ID the application that's got it open on your machine, then head back into the router and look into "port mapping" or "static routes" or "port forwarding". The router will offer up one or more of these things... You'll want to setup something so that requests for port 80 get sent off to an unused IP address like 192.168.1.254, or change port 80 requests to an unused number like 8377.

As it is now, there's something live somewhere that's responding to requests, and that's not safe.

Now, a side issue here could be that you enabled remote administration on the router itself. It may be coming up on port 80, and that's REALLY bad.


If you want me to play, send me the IP address of the _router_ in email. But actually, you should be able to see it with a browser. Just enter the IP address into the URL line (i.e., "http://xxx.xxx.xxx.xxx") and see what comes up.
I will play with it a bit more and see what is going on.

I think it may be the XP Pro and the remote desktop thingy.
Reply
Old Jan 6, 2005 | 12:14 PM
  #11  
midiwall's Avatar
Registered User
 
Joined: Dec 2002
Posts: 9,048
Likes: 2
From: Seattleish, WA
Originally Posted by GRNTACO
I think it may be the XP Pro and the remote desktop thingy.
Nah... Remote Desktop is on a different port (3389) - you'll have to open a port on the router for it to work.
Reply
Old Jan 6, 2005 | 12:18 PM
  #12  
GRNTACO's Avatar
Registered User
 
Joined: Oct 2003
Posts: 1,439
Likes: 0
From: On a trail in WA.
I was playing with my router and there is nothing you speak of on there. This is pissing me off. I get the open port on both machines.
Reply
Old Jan 6, 2005 | 12:21 PM
  #13  
GRNTACO's Avatar
Registered User
 
Joined: Oct 2003
Posts: 1,439
Likes: 0
From: On a trail in WA.
I can't access my router form work.
Reply
Old Jan 6, 2005 | 01:15 PM
  #14  
SolidDigital's Avatar
Registered User
 
Joined: Oct 2003
Posts: 543
Likes: 0
From: va
port 515, Name:printer Purpose:spooler
what's that about? everything else is green and just that one is red.,
Reply
Old Jan 6, 2005 | 05:30 PM
  #15  
midiwall's Avatar
Registered User
 
Joined: Dec 2002
Posts: 9,048
Likes: 2
From: Seattleish, WA
Originally Posted by GRNTACO
I can't access my router form work.
If you've been using Remote Desktop, then log in there and hit up 192.168.1.1 (or whatever the router address is) from the point of view of the local machine. I do that from work sometimes.


Originally Posted by SolidDigital
port 515, Name:printer Purpose:spooler
Having this port open will allow someone on the outside to print on your local printer. Are you running a router? It sounds like you may be direct-connected to the net.


funny story... I was wandering through my router logs one time and found all these "port peeks" coming from an IP address. Using APNIC, I reversed the IP and found that it was coming from an address somewhere in Russia. I figured eye-for-an-eye is a good thing...

So I snooped on his IP for a while... and found an open share to a printer.

I connected to it... and started printing... VOLUMES of technical manuals I have laying around. Every-so-often I'd get an "Paper out" notice... So I'd wait a bit, the paper-out would clear... and I'd start printing again.

I kept that up for a couple of days... he finally got tired of the game and turned the printer off.
Reply
Old Jan 6, 2005 | 06:05 PM
  #16  
SolidDigital's Avatar
Registered User
 
Joined: Oct 2003
Posts: 543
Likes: 0
From: va
that's pretty good lol, guess he learned his lesson =p

I do have a wireless router, but have never been able to connect to the other computer. it's running on windows 98 and this one's on xp. It would come in handy to figure out how to print something from this computer on the printer downstairs though lol.
Reply
Old Jan 6, 2005 | 09:00 PM
  #17  
GRNTACO's Avatar
Registered User
 
Joined: Oct 2003
Posts: 1,439
Likes: 0
From: On a trail in WA.
Originally Posted by midiwall
If you've been using Remote Desktop, then log in there and hit up 192.168.1.1 (or whatever the router address is) from the point of view of the local machine. I do that from work sometimes.
I have never used that so........WTF.
Reply
Old Jan 7, 2005 | 02:58 PM
  #18  
85TurboRunner's Avatar
Registered User
 
Joined: Aug 2004
Posts: 2,077
Likes: 1
From: Vancouver, WA
according to all those tests my computer doesnt exist, and thats the way i like it.
Reply
Old Jan 8, 2005 | 11:18 AM
  #19  
Corey's Avatar
Co-Founder/Administrator
iTrader: (1)
 
Joined: May 2002
Posts: 32,242
Likes: 21
From: Auburn, Washington
I use that site from time to time.
Tested it earlier in the week with my Netgear RP614 NAT router, and I was stealth in everthing and showed no open ways to get in to my PC.

Now going to test it with the Linksys RT31p2 router I just hooked up.
Stand by...

Cool, all ports on the big test where it tests the first 1056 ports are all in stealth mode.
Reply
Old Jan 8, 2005 | 03:31 PM
  #20  
SolidDigital's Avatar
Registered User
 
Joined: Oct 2003
Posts: 543
Likes: 0
From: va
well I've looked through all my router settings and can't figure out how to fix the port 515 thing. Is it just going to be open because of the router?
Reply



All times are GMT -8. The time now is 04:13 AM.