Firewall, VPN, Intrusion Detection, and Router Tips

If you have a document or link to a resource which should be added to this site, . Initially the site will be links to Internet resources but I hope to add my own tips in time.

Hits: Failed to execute CGI : Win32 Error Code = 3

Netscape Users Press (CTRL-B)

--- A --- Firewall, IDS, VPN, Router

• My firewall tips :
  • Whats New
    
  • Partial Octet Subnetting
    
  • Ssh Secure Shell Resources
    
  • Cisco PIX Firewall Resources
    
  • Check Point Firewall-1 Firewall Tips and Resources
    
  • BGP Border Gateway Protocol Tips and Resources
    
  • IDS Intrustion Detection System Tips and Resources
    
  • IPSec Tips and Resources
    
  • Cisco Tips and Resources
    
  • Network Address Translation NAT tips and resources
    
  • Windows Freeware and Commercial Personal Firewalls for SOHO Small Office and Home
    
  • TCPIP Port Numbers, Active Ports, and Exploits
    
  • Logging / Syslog / Log Analysis Resources
    
  • Windows 2000 Exchange Server in the DMZ
    
  • Expect : tool for automating interactive applications such as telnet, ftp, passwd, fsck, rlogin, tip
    
  • SNMP Resources
    
• ACE-Server :
  • ACE-Server Mailing List
    
• Auditing :
  • Auditing Firewalls: A Practical Guide
    
• Firewall appliances - integrated functions
  • Netscreen scalable security solutions, including firewalls, VPN, intrusion detection and virtual private network security systems and solutions
    I work with netscreens - very strong product, very supportive and knowledgable support staff
  • SecureSoft USA Internet security and computer network security, including firewalls, VPN, intrusion detection and virtual private network security systems and solutions
    

--- B --- Firewall, IDS, VPN, Router

• Best Firewall : Choosing The Best Firewall SANS
  
• BGP :
  • BGP Border Gateway Protocol Tips and Resources
    
• BigIP :
  • BigIP Mailing List
    
• BizGuardian : VPN Firewall
  integrated PPTP Server, Remote Access Administration, and IPSec Branch to Branch secure VPN. Small to medium office
• BorderGuard : empowering your firewall to instantaneously terminate attacks and unwanted traffic.
  Supports Check Point FireWall-1™ OPSEC Certified, Cisco PIX™, Linux IP Tables, NetScreen™
  
• BorderWare Firewall Server
  
• BSD : Step-by-Step Guide to Building an OpenBSD PPPoE Gateway, with Firewall
  

--- C --- Firewall, IDS, VPN, Router

• Check Point:
  • Check Point Firewall-1 Tips and Resources
    
• Choosing The Best Firewall SANS
  
• Cisco:
  • Cisco Tips and Resources
    
• Client/Server Firewalls
  firewall is replicated away from the perimeter and placed as close as possible to the actual application clients and servers

--- D --- Firewall, IDS, VPN, Router

• Designs:
  • Designing a DMZ SANS
    
  • Design principles for secure enterprise networks Cisco
    
• Diffe-Hellman :
  • RFC2631 : Diffie-Hellman Key Agreement Method
    
  • Diffie-Hellman Explained
    
• DNS :
  • DNScape : name and address search tool
    It can be used by system administrators to verify the configuration of DNS tables
    
  • DNSwalk DNS debugger(May 2001)
    
  • RFC1912: Common DNS Operational and Configuration Errors (May 2001)
    
  • Securing an Internet Name Server (Jan 2002)
    
  • Split Horizon DNS security concept
    Uses two servers: External DNS server will support your host externally accessable hosts only and is either on the outside or DMZ side of the firewall. The Internal DNS server contains records for internal and external hosts. Firewall and internal hosts use internal DNS and is on the internal network.

--- E --- Firewall, IDS, VPN, Router

• Email:
  • Reading Email Headers
    • Reading Email Headers Tutorial #1
      
    • Reading Email Headers Tutorial #2
      
    • RFC822: Standard for ARPA Internet Text Messages
      
  • Help! I've been Spammed! What do I do?
    This FAQ attempts to give general suggestions on what you can do about spam

• Event management : NetForensics
  
• Evolution of firewalls
  
• Expect : tool for automating interactive applications such as telnet, ftp, passwd, fsck, rlogin, tip
  
• Windows 2000 Exchange Server in the DMZ
  

• F5:
  • Big-IP Internet Traffic Management
    
  • Big-IP FIPS Compliant Security
    
  • Misc BigIP info - Brian Houk
    
  • Recovering the password for F5s / 3DNS
    
  Filterrules : determine the rules of a firewall in a very reliable way It is made up of two parts: a "master", in charge of forging several IP packets, and a "slave", which listens on the other side of the firewall, and which tells to the master which packets passed through. At the end of the test, the firewall rules are displayed in the ipfw format.
  
• Filtering:
  • Internet filtering and reporting: SurfControl vs. Websense (Gartner)
    
  • Elron Software's Internet Manager product family
    
  • N2H2 Sentian Internet Filtering software
    
  • SurfControl
    
  • WebSense
    
  • Symantec I-Gear Internet Content Filtering
    
• Firewalls:
  • Firewall appliances - integrated functions
    • SecureSoft USA Internet security and computer network security, including firewalls, VPN, intrusion detection and virtual private network security systems and solutions
      

  • Best Firewall : Choosing The Best Firewall SANS
    
  • Evolution of firewalls
    
  • Firewall Comparison: Checkpoint Firewall-1 and Cisco PIX
    
  • Firewall Comparison SANs: Comparison Shopping for Scalable Firewall Products
    
  • Firewall FAQ
    
  • Internet Firewalls: Frequently Asked Questions
    
  • Firewall Forensics FAQ
    
  • Firewall Hardening Guide
    
  • Firewall Lists : commercial, sharewall, resellers
    
  • Howto : Firewall and Proxy Server linux oriented
    
  • How to make a firewall sandwich
    
  • router is the firewall, part 1
    
  • Rulebase : Building Your Firewall Rulebase
    
  • Sans : firewall articles
    
    • Denial of Service Attacks and the Emergence of “Intrusion Prevention Systems”
    • Securing Solaris Servers Using Host-based Firewalls
    • Securing Extranet Connections
    • IPFilter: A Unix Host-Based Firewall
    • Using ISA Server Logs to Interpret Network Traffic
    • The Installation and Configuration of a Cisco PIX Firewall with 3 Interfaces and a Stateful Failover Link
    • Configuring a NetScreen Firewall: Best practice guideline for the basic setup of a NetScreen firewall using the command line configuration options
    • Getting the Most out of your Firewall Logs
    • The Firewall has been Installed, Now What? Developing a Local Firewall Security Policy
    • Protecting the Network without Breaking the Bank
    • A Review Of Floppy-Based Firewalls And Their Security Considerations
    • Building an IPv6 Firewall with OpenBSD
    • CBAC - Cisco IOS Firewall Feature Set Foundations
    • A Layer-7 Secure Security Posture
    • Protecting the Next Generation Network – Distributed Firewalls
    • Application Level Content Scrubbers
    • Proxies and Packet Filters in Plain English
    • Achieving Defense-in-Depth with Internal Firewalls
    • IPSec VPN Using FreeBSD
    • Cisco Router Hardening Step-by-Step
    • Active Net Steward – Distributed Firewall
      
    • Using Open Source to Create a Cohesive Firewall/IDS System
      
    • Sidewinder 5.1 Split DNS Architecture
      
    • Private Internet Exchange: The Fastest Firewall in the World?
      
    • Setting up a Firewall with IPF, IPNAT and OpenBSD
      
    • Raptor Firewall 6.5 Running on NT 4.0
      
    • Security Logs and Checkpoint Firewall-1
      
    • Protecting Your Corporate Laptops from Hackers, While they are on the Road
      
    • Protecting Yourself with Norton Personal Firewall
      
    • Distributed Firewall
      
    • Three Tiered DMZ's
      
    • A Brief Taxonomy of Firewalls – Great Walls of Fire
      
    • Anatomy of a Stateful Firewall
      
    • Who Forgot to Lock the Back Door?
      
    • Check Point Firewall-1’s Stateful Inspection
      
    • 4^th Generation of Linux Based Firewalls
      
    • Stealth Firewalls
      
    • Choosing The Best Firewall
      
    • Network Air Gaps – Drawbridge to the Backend Office
      
    • IP Fragmentation Attacks on Checkpoint Firewalls
      
    • A Comparison of Packet Filtering Vs Application Level Firewall Technology
      
    • Designing a DMZ
      
    • Securing a Solaris Check Point Firewall
      
    • The New Firewall Design Question
      
    • Improved Filtering on the Firewall Routers - Fixing the "Bad Ping Filter"
      
    • Securing Your Nework Perimeter by Filtering Inbound Traffic on ACK and Reset Bits on Nortel Routers
      
    • Linux Comes of Age with Stateful Firewalling
      
    • Personal Firewalls: Not Enough
      
    • Is Your Generic Port 80 Rule Safe Anymore?
      
    • Remote Access--Protecting the Internal Network or, How to Allow "Them" in While Keeping "Them" Out
      
    • Restricting Commands on a Cisco Router with Privilege Levels
      
    • Securing Your Internet Access Router
      
    • The Need for Content Security
      
    • AES: The New Key on the Block
      
  • Tester : Perl scripts to test your firewall
    
• Firewalk X 2 full featured firewall for Mac OS X
• fragroute
  intercepts, modifies, and rewrites egress traffic destined for a specified host
• ftp:
  • Active FTP vs. Passive FTP : a Definitive Explanation
    

• GotoMyPC Tunneling:
  • Analysis of GotoMyPC threat
    commercial rat
  • PestPatrol will detect & disable
    

• GRE Tunneling:
  GRE is a tunneling protocol developed by Cisco that can encapsulate a wide variety of protocol packet types inside IP tunnels (Jan 2002)
  • Configuring IPSec with EIGRP and IPX Using GRE Tunneling
    
  • Inbound PPTP Traffic and Windows 2000 Network Address Translation (Q263925) NAT, GRE
    
  • IPSec/GRE with NAT : Cisco sample configuration
    
• GTA Firewall VPN Products
  small office

• HA:
  • Achieving High Availability
    
  • Network-Level Redundancy/Resilience for High-Availability Campus LANs
    
  • HSRP Denial of Service
    
• HSRP:
  • RFC2281 : Cisco Hot Standby Router Protocol
    
  • HSRP FAQ
    
  • HSRP Denial of Service
    

• IANA:
  • Protocol Numbers and Assignment Services
    
• ICMP:
  • ICMP Usage in Scanning : the complete know-how
    
• IDS:
  • Wayne's IDS Intrustion Detection Tips and Resources
    
• Info Security:
  • U.S. Information Security Law
    

• 
  

• IP Addressing:
  • IP Subnetter Free Utility
    calculates subnets, subnet mask, binary hosts, binary masks, broadcast address, host range, and more
    
  • IP Address Subnetting Tutorial
    
  • IP Addressing and Subnetting for New Users Cisco
    
  • Understanding IP Addressing: Everything You Ever Wanted To Know 3com>
  • Understanding TCP/IP Addressing and Subnetting Basics Microsoft>

• IP:
  • IP Insecurity ComputerWorld article
    
  • IP spoofing Department of Computer Science, Princeton University
    
  • IP Subnetter Free Utility
    calculates subnets, subnet mask, binary hosts, binary masks, broadcast address, host range, and more
    
  • IP Network Configuration Calculator
    
  • Linux Mobile IP mechanism for maintaining transparent network connectivity to mobile hosts. Mobile IP protocol enables a mobile host to be addressed by the IP address it uses in its home network (home IP address), regardless of the network to which it is currently physically attached. Therefore, ongoing network connections to a mobile host can be maintained even as the mobile host is moving from one subnet to the other.
    
  • Layer 2 Attacks and their mitigation
    
• IPchains : Using Tripwire to lock down an IPchains firewall Tripwire
  
• IPCHAINS-HOWTO
  describes how to obtain, install and configure the enhanced IP firewalling chains software for Linux, and some ideas on how you might use them.
• IpTables
  The netfilter/iptables project is the Linux 2.4.x / 2.5.x firewalling subsystem.It delivers you the functionality of packet filtering (stateless or stateful), all different kinds of NAT (Network Address Translation) and packet mangling
• IPTables : MonMotha's IPTables Firewall
  
• IPSEC:
  • IPsec Tips and Resources
    

• 
  

• Linux:
  • Howto : Firewall and Proxy Server linux oriented
    
  • Linux Firewall-related /proc Entries
    
  • Linux stateful firewall design - Tutorial
    By the end of the tutorial, you will understand how Linux stateful firewalls are put together and have several example configurations to use in your own projects.
  • Linux 2.4.x / 2.5.x firewalling subsystem
    
  • Linux disaster recovery
    donate-ware open source
  • SmoothWall: linux-based firewall
    
• book
  
• Logs:
  • Logging / Syslog / Log Analysis Resources
    

• Mac (Media Access Control) Addresses : hardware addresses that uniquely identifies each node of a network
  Each ethernet device is assigned a unique hardware address by the manufacturer. Manufacturers are each assigned a range of addresses that they may use in their manufacturing, so that it is not possible for two vendors to assign the same address. These hardware addresses are called MAC Addresses.
  • MAC vendor codes
    
  • Vendor/Ethernet MAC address lookup
    
  • IEEE's Public OUI registrations (MAC addresses)
    
  Be aware that MAC addresses can be changed - a technique used in penetration testing. See MAC section of my Penetration Testing page for link to SMAC, a free GUI tool that is capable of changing MAC addresses on almost any network adapters on Windows 2000 & XP systems. Also link to Arpwatch which watches for and report duplicate MAC addresses on your network.

• Mac OS : Firewalk X 2 full featured firewall for Mac OS X
• Anti-Relay: Stop Third-Party Mail Relay
• Mailing Lists / Archives :
  • Check Point's FireWall-1 Mailing List / Archive:
    • Check Point's FireWall-1 Mailing List
      
    • Schmoo's FireWall-1 Mailing List
      
  • Schmoo's General Firewall Mailing List
    
• MED:
  • Multi-Exit Discriminator, How BGP Routers Use the Multi-Exit Discriminator for Best Path Selection
    
• Monitoring :
  • Nagios : host and service monitor
    The monitoring daemon runs intermittent checks on hosts and services you specify using external "plugins" which return status information to Nagios. When problems are encountered, the daemon can send notifications out to administrative contacts in a variety of different ways (email, instant message, SMS, etc.). Current status information, historical logs, and reports can all be accessed via a web browser. licensed under the terms of the GNU General Public License
  • WhatsUp Gold
    automatically map your entire network and monitor critical devices and services
• MRTG :
  Multi Router Traffic Grapher Companion Sites
  
• Multicast :
  • Multicast primer
    
  • Intro to IP Multicast
    

• NAT :
  Network Address Translation NAT tips and resources
  
• Netcat :
  TCP/IP Swiss Army knife tool
  
• netFilter :
  Linux 2.4.x / 2.5.x firewalling subsystem
  
• Nettimer :
  • Nettimer : end-to-end network performance measurement
    Project of MosquitoNet Mobile Computing Group at Stanford University
  • Nettimer : a tool for measuring bottleneck link bandwidth
    
• Network Configuration Calculator
  
• newsgroups / mailing lists for firewalls:
  • Check Point FireWall-1 Mailing List
    
  • Check Point FireWall-1 Wizards Mailing List
    
  • Check Point FireWall-1 Searchable index
    
  • Check Point FireWall-1 Searchable index
    
  • Tek-Tips' PIX Firewall Help Forum
    
• Nokia:
  • Analysis of VRRPv2 - Issues and Solutions
    
  • Firewall Failover Using Nokia Firewalls and VRRP
    
  • Nokia Firewall Failover Using VRRP - Deployment Worksheet
    

• OSI :
  • OSI Reference Model Illustrated
    
  • OSI Reference Model
    

• Performance:
  • IPerf: tool to measure maximum TCP bandwidth
    freeware. While tools to measure network performance, such as ttcp, exist, most are very old and have confusing options. Iperf was developed as a modern alternative for measuring TCP and UDP bandwidth performance. Iperf is a tool to measure maximum TCP bandwidth, allowing the tuning of various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, datagram loss.
• Penetration Testing / Hacking:
  for firewall admins - what techniques will be used against you
  
  • Diggin Em Walls - Detection of Firewalls, and Probing networks behind firewalls
    
  • Diggin Em Walls - Firewall Penetration through Port Redirection
    
  • Diggin Em Walls - Advanced/Other Techniques for ByPassing Firewalls
    
  • Firewall Penetration Testing
    
  • IP Spoofing
    • IP Spoofing : A Mammoth Description
      
    • IP spoofing Department of Computer Science, Princeton University
      
    • IP spoofing Demystified ==Phrack Magazine==
      
  • Tester : Perl scripts to test your firewall
    
• Performance :
  • Nettimer : end-to-end network performance measurement
    Project of MosquitoNet Mobile Computing Group at Stanford University
  • Nettimer : a tool for measuring bottleneck link bandwidth
    
• Personal Firewalls for SOHO Small Office and Home
  • Wayne's Windows Freeware and Commercial Personal Firewall Resources for SOHO Small Office and Home
    
• PIX Firewall Tips and Resources
  
• PKI:
  • Ten Risks of PKI: What You're Not Being Told About Public Key Infrastructure
    
  • Public Key Infrastructure NSS Group white paper
    
• Internet Firewall Policy
  
• Ports:
  • TCP and UDP port resources
    
• PPOE : Step-by-Step Guide to Building an OpenBSD PPPoE Gateway, with Firewall
  
• Proxy:
  • NTLM Authorization Proxy Server

  • Proxy Servers for web clients, supporting FTP, gopher, and HTTP data objects

  • Proxy Inspector cost-effective solution for analysis of your corporate Internet connection usage. It works with popular WinGate proxy server to retrieve from its log-files comprehensive information about you employees' behavior on the Internet. It will provide you with visual easy-to-understand reports on users activity, visited sites, attempts to access blocked resources etc.

• Reporting :
  • fwlogsum : generic, all purpose, flexible summarizer for Checkpoint's Firewall-1 logs
    implemented using standard Perl 5 and is freely available under GPL. The generated output is HTML including most of the graphics.
  • WebTrends : Firewall Reporting Center
    
• RFCs:
  • RFC1403 : BGP OSPF Interaction
    
  • RFC1597 : Address Allocation for Private Internets
    
  • RFC1657 : BGP MIB
    
  • RFC1771 : Border Gateway Protocol 4
    
  • RFC1772 : Application of the Border Gateway Protocol in the Internet
    
  • RFC1773 : Experience with the BGP-4 protocol
    
  • RFC1774 : BGP-4 Protocol Analysis
    
  • RFC1912 : Common DNS Operational and Configuration Errors
    
  • RFC1965 : Autonomous System Confederations for BGP
    
  • RFC1966 : BGP Route Reflection
    
  • RFC1997 : BGP Communities Attribute
    
  • RFC1998 : Application of the BGP Community Attribute in Multi-home Routing
    
  • RFC2281 : Cisco Hot Standby Router Protocol
    
  • RFC2827 : Defeating Denial of Service Attacks which employ IP Source Address Spoofing
    
• Router support sites:
  • iponeverything.net/cisco.shtml
    
  • routergod.com
    
• Routing:
  • 
    
    
  • Routing Basics
    
• Rulebase : Building Your Firewall Rulebase
  

• Scripting - Expect : tool for automating interactive applications such as telnet, ftp, passwd, fsck, rlogin, tip
  
• scponly
  ssh-based method to allow remote users to both read and write local files without providing any remote execution priviledges. a wrapper to the "tried and true" ssh suite of applications

• Security :
  • ISN : InfoSec News
    
    • Articles catering to security, hacking, firewalls, new security encryption, products, public hacks, hoaxes, legislation affecting these topics
    • Information on where to obtain articles in current magazines.
    • Security Book reviews and information.
    • Security conference/seminar information.
    • New security product information.
    
    
• Security Policies:
  • Sample security policies and guidelines
    
    
• Sidewinder / Gauntlet Firewall :
  Secure Computing
  Secure Computing purchased Guantlet from NAI
• Session Initiation Protocol ( SIP )
  • Getting SIP through Firewalls and NATs
    
    Internet Draft rosenberg-sip-firewalls-00
    
  • GNU oSIP library
    
    
  • SipCenter.com
    
    
  • Columbia.edu Session Initiation Protocol (SIP)links
    
    
  • Overview of the Cisco VoIP Infrastructure Solution for SIP
    
    
• SmoothWall: linux-based firewall
  • SmoothWall FAQ
    
  • SmoothWall Releases
    
• SMTP:
  • MAILsweeper for SMTP
    enforce policies on internet mail
• Snoop:
  • Secrets of Snoop
    built-in sniffer
• Snort:
  • packet sniffer/logger
    
  • Hogwash drops or modifies specific packets based on a signature match
  • RazorBack a log analysis program that interfaces with the SNORT
  • Snot Triggers snort alerts taking a snort rules file as input. Use to decoy your local IDS admin
  • SnortSam plugin for Snort to allow automated blocking of IP addresses on a Checkpoint firewall
  • Windows version (including XP)
    
• SonicWall Firewall :
  SonicWALL
  
• Spoofing:
  • Spoof Bounce
    
  • RFC2827: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
    
• Ssh Secure Shell (April 2002)
  
• Stateful Inspection:
  • SANs: Anatomy of a Stateful Firewall
    
  • FW-1, Understanding the FW-1 State Table
    
  • FW-1, SANs: Check Point Firewall-1’s Stateful Inspection
    
  • FW-1, Stateful Inspection of FireWall-1
    
  • Linux stateful firewall design - Tutorial
    By the end of the tutorial, you will understand how Linux stateful firewalls are put together and have several example configurations to use in your own projects.
  • Stateful Inspection Firewall Technology
    vendor document compares packet filters, application layer gateways, and stateful inspection
  • SecuriTeam: FireWall-1 stateful inspection vulnerability allows attacking of internal hosts
    
• Subnetting :
  • IP Subnetter Free Utility
    calculates subnets, subnet mask, binary hosts, binary masks, broadcast address, host range, and more
    
  • Partial Octet Subnetting
    
  • tcp/ip Subnetting
    
  • Proper use of the FAYTROUNI TCP/IP subnetting table (Dec 2001)
    
• Symantec Raptor Firewalls :
  Raptor
  

• TAP: Taps provide a passive access point for analyzers
  • Netoptics adaptive, copper, fibre tabs
    
  • Case for taps vs span port vs in-line
    
• TCP:
  • 
    
    
  • ISN Initial Sequence Number Vulnerability (June 2001)
    
  • Monitor network activities
    
  • TCP/IP Subnetting Tables (Dec 2001)
    
  • tcptraceroute By sending out TCP SYN packets instead of UDP or ICMP ECHO packets, tcptraceroute is able to bypass the most common firewall filters.
    
  • Proper use of the FAYTROUNI TCP/IP subnetting table (Dec 2001)
    
• Tester : Perl scripts to test your firewall
  
• Tivoli
  • Tutorial : Get ready for Tivoli monitoring
    
• Tutorials
  • Getting the Most From Your Shell
    
  • Linux and Unix Q and A
    
  • Tutorial : Get ready for Tivoli monitoring
    
  • Vi/Ex Editor
    

• UDPFlood :
  UDP packet sender utility free
  

• VPN :
  • Cisco Top Issues : IOS VPN tech assistance center
    
  • Microsoft VPN White Papers
  • SecurityDogs VPN library
  • SSL VPN vs IPsec VPN
  • VPN Clients and Split Tunneling newsletters.cramsession.com
    
• VRRP:
  • Analysis of VRRPv2 - Issues and Solutions
    
  • Firewall Failover Using Nokia Firewalls and VRRP
    
  • Nokia Firewall Failover Using VRRP - Deployment Worksheet
    
  • RFC2338 : Virtual Router Redundancy Protocol
    

• WatchGuard Firewall :
  WatchGuard Technologies
  
• Whois :
  • GeekTools Whois Proxy
    

Consider making a direct contribution to help keep is-it-true.org on the Net by clicking on my Amazon honr system contribution paybox.

FYI if you click on any of my Amazon book, movie, or music links and purchase anything from Amazon, is-it-true.org will get a small percentage. Consider coming back to my site and getting into Amazon from one of my Amazon links, if you are going to purchase an item. It will help keep my site on the Net.