Depends where you will put your ACL too, we have this on our Ingress from the internet 10 deny ip 127.0.0.0 <http://127.0.0.0> 0.255.255.255 <http://0.255.255.255>any (118 matches) 20 deny ip 10.0.0.0 <http://10.0.0.0> 0.255.255.255 <http://0.255.255.255>any (23297 matches) 30 deny ip 172.16.0.0 <http://172.16.0.0> 0.15.255.255 <http://0.15.255.255>any (8 matches) 40 deny ip 192.168.0.0 <http://192.168.0.0> 0.0.255.255 <http://0.0.255.255>any (19 matches) 50 deny tcp any any eq 135 (6750649 matches) 60 deny udp any any eq 135 (20275 matches) 70 deny tcp any any eq 445 (18420302 matches) 80 deny udp any any eq 1026 (3481591 matches) 90 deny ip x.x.x.x 0.0.0.255 <http://0.0.0.255> any where x.x.x.x is your IPs and you could add bogons But of course you might not want to block some of those as some home customers could use them to connect back to their intranet, but those should use tunnels IMHO. On 9/15/05, Peter Dambier <peter@peter-dambier.de> wrote:
There is only one port worth blocking:
Block port 80 (http)
All other ports might be in use for redirected ssh, telnet, ftp, ...
Blocking port 80 will keep windows people from accidently clicking nonsense.
:)
Kind regards, Peter and Karin Dambier
Luke Parrish wrote:
Everyone,
Does anyone have a reference point for commonly blocked ports?
We have a list, some reactive and some proactive, however we need to remove ports that are no longer a threat and add new ones as they are published.
Thanks luke
-- Peter and Karin Dambier Public-Root Graeffstrasse 14 D-64646 Heppenheim +49-6252-671788 (Telekom) +49-179-108-3978 (O2 Genion) +49-6252-750308 (VoIP: sipgate.de <http://sipgate.de>) mail: peter@peter-dambier.de http://iason.site.voila.fr http://www.kokoom.com/iason