Xavier Cabrera wrote:
Hello:
Thanks for all your answers. Wel i think too the best aproach for this
is doing on iptables like Will say.. but if we really want a IPS with
snort maybe we can start to think on that solution. Maybe people of
sourcefire can plant this solution for future releases.
If snort in future can handle the connections with syn proxy or (seudo
syn proxy) validating the real one's before they can pass can start to
think in the best IPS of the World
Well, i have to continue with my two boxes.... Like Matt say... right
now i have a Linux-Snorted behind a BSD.... and that is not elegant....
A firewall behind another one?
Personally, I hardly care about "elegance" in networking. However, one thing I
do care about is security.
The stacked-firewall configuration has some downsides in terms of MTBF, but in
all cases would be more secure than a single box running both packages.
If both firewalls are on the same box, a remote-access exploit of either
firewall will ultimately breach the entire firewall.
In a stacked configuration, exploiting the outer-most firewall offers some
benefit to the attacker, but the network is still protected by the second
firewall. The stacked configuration also screens the second firewall, making it
more difficult to attack, although a successful exploit of the second firewall
box would be a complete breach.
However, now you've got 2 boxes, so hardware failure is more likely than with
one box (if either box has a hardware failure, you're communication will be cut
off).
Really, I don't think of the lack of elegance as a consideration at all. I would
however consider if the lower MTBF outweighs the possibly marginal security gains.
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
