Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I understand that each Business has it's own needs and situation, but I'm looking for a general guideline to commonly blocked services and ports and other policies to be looking for when configuring the firewall. For example should I block everything coming in (WAN --> LAN) with the exception of what I know to be safe? Are there specific ports to be worried about internally (LAN, WLAN, VPN)? Should I allow ALL access to resources from VPN to LAN?

I understand that there are a lot of questions here, but what I'm looking for is a general guideline to setting up firewall/security for small business.

share|improve this question

4 Answers 4

up vote 7 down vote accepted

This is pretty broad but I'll give it a shot.It comes down to knowing who is doing what and verifying they still need it

  • start a spreadsheet for everything you do. track what ports, when its opened, who asked for it and why.

  • block EVERYTHING inbound by default. Any service that needs to come in should be approved and you need to be aware of it. You may already know about inbound mail, web, etc. Open ports to specific destinations for these, add them to the spreadsheet. In other words, open port 80 to your web server, not to any other host on the network (until you know why)

  • block everything outbound. Open ports for specific services (80, 443, DNS, NTP) as you learn/are asked about them. Open ports as restrictively as possible for the business case. If the mail service needs outbound port 25, open it but not for every desktop.

  • once/yr, check the spreadsheet and verify with the requester that it is still needed

Draconian, perhaps, but if you manage it tightly from the beginning, you'll have a better chance of knowing what's going on. Keep in mind this is a business, not your home network so it is ok for employees to have some restrictions. The down side to a break in could be much more serious.

share|improve this answer
    
It's easier to allow things you know are necessary than to block things you know are bad. Lessens the administrative burden (apart from the initial set-up, but that's painful anyway) and increases security. Since this is, essentially, @uSlackr's answer, I just voted it up, instead of writing a new, duplicate answer. –  Vatine Jun 15 '11 at 10:12
    
Why block outbound traffic by default? –  TheLQ Jun 16 '11 at 18:56
    
For one reason virii, spam bots, etc, all rely on outbound traffic to communicate and spread. Blocking outbound will help prevent the spread and might alert you to an infected machine. –  uSlackr Jun 16 '11 at 19:41

As I work for a small business I'll simply tell you what I've done.

All inbound starts off as blocked and ports are only opened as and when required. In my case that includes selectively opening ports for external support when needed and closing them again when they're done. There are cron jobs configured on the firewall to close those ports at a given time, just in case I haven't manually closed them for any reason.

Nearly all outgoing is allowed from our network, with just a few exceptions. e.g. Port 25 (SMTP) is only open for those machines which are permitted to send email directly, such as the Exchange server and monitoring system. The later must cannot route through the Exchange server because it may well be trying to tell me that Exchange is down.

This differs markedly from the more common practice in larger organisations, where outbound starts of as blocked and access only opened as required. One of the reasons for the difference is due to the equipment being used. Our firewall for instance has no way to grant or deny outbound based on user ID, so it would be much more difficult to implement such features.

share|improve this answer
    
Out of curiosity why do you block client side SMTP? –  KronoS Jun 14 '11 at 0:53
3  
@KronoS, I learned to do this the hard way. We had a virus that started sending out infected emails from client machines, which promptly landed us on several block lists. Besides, there should be no legitimate reason for most machines sending emails directly. –  John Gardeniers Jun 14 '11 at 1:01

As a general rule, I'd:

  1. Block all inbound connections by default (plus outbound, I was reminded of that by uSlackr).

  2. Run firewall programs on the internal servers and clients themselves, and also put up a perimeter firewall on dedicated hardware (which might also be your VPN server). The perimeter firewall won't help at all on internal-only traffic, but will greatly reduce the amount of hammering your internal systems get from the outside world.

  3. Allow specific inbound (and outbound) connections to ports/IPs that should be offering (or using) services. This may make for a lot of ports to allow on the perimeter firewall, but a system like Shorewall may make things easier by letting you define a set of ports as "Web traffic", for example. If the internal clients/servers are Windows or OS X, then built-in firewall GUIs tend to make it easier to say "allow traffic for File and Printer Sharing".

  4. If we're talking about a VPN system like OpenVPN, I'd only use it for specific cases that would not make it through the perimeter firewall, and are critical for your remote users. OpenVPN lets you define a client configuration directory where you can put in specific rules for specific users. For example, my rule allows me to connect to my office printer from offsite, but doesn't open it up to the rest of the VPN users.

share|improve this answer
    
I'm using SonicWALL firewall router as my perimeter router. I didn't realize though that the perimeter router didn't have anything to do with internal (LAN) connections, but that makes sense as I sit here and think about it. –  KronoS Jun 14 '11 at 0:51

The general guidance for most anyone is, Only allow what you need, block everything else.

That's a very high-level guide, and is especially applicable for inbound connections.

Blocking outbound connections is where things get interesting. The strictest interpretation says you should do the same for outbound as well; ports 80 and 443 for everyone, DNS if needed. In a small business context, this is not likely to be politically acceptable as you're likely to know everyone in the business and implicitly trust them to not be evil. If you do, you're going to be adding ports left right and sideways for weeks/months as users identify things they need.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.