Is there a general guideline to setting up Firewall policies for Small Business?

Question

I understand that each Business has it's own needs and situation, but I'm looking for a general guideline to commonly blocked services and ports and other policies to be looking for when configuring the firewall. For example should I block everything coming in (WAN --> LAN) with the exception of what I know to be safe? Are there specific ports to be worried about internally (LAN, WLAN, VPN)? Should I allow ALL access to resources from VPN to LAN?

I understand that there are a lot of questions here, but what I'm looking for is a general guideline to setting up firewall/security for small business.

Answer 1

This is pretty broad but I'll give it a shot.It comes down to knowing who is doing what and verifying they still need it

• start a spreadsheet for everything you do. track what ports, when its opened, who asked for it and why.

• block EVERYTHING inbound by default. Any service that needs to come in should be approved and you need to be aware of it. You may already know about inbound mail, web, etc. Open ports to specific destinations for these, add them to the spreadsheet. In other words, open port 80 to your web server, not to any other host on the network (until you know why)

• block everything outbound. Open ports for specific services (80, 443, DNS, NTP) as you learn/are asked about them. Open ports as restrictively as possible for the business case. If the mail service needs outbound port 25, open it but not for every desktop.

• once/yr, check the spreadsheet and verify with the requester that it is still needed

Draconian, perhaps, but if you manage it tightly from the beginning, you'll have a better chance of knowing what's going on. Keep in mind this is a business, not your home network so it is ok for employees to have some restrictions. The down side to a break in could be much more serious.

Answer 2

As I work for a small business I'll simply tell you what I've done.

All inbound starts off as blocked and ports are only opened as and when required. In my case that includes selectively opening ports for external support when needed and closing them again when they're done. There are cron jobs configured on the firewall to close those ports at a given time, just in case I haven't manually closed them for any reason.

Nearly all outgoing is allowed from our network, with just a few exceptions. e.g. Port 25 (SMTP) is only open for those machines which are permitted to send email directly, such as the Exchange server and monitoring system. The later must cannot route through the Exchange server because it may well be trying to tell me that Exchange is down.

This differs markedly from the more common practice in larger organisations, where outbound starts of as blocked and access only opened as required. One of the reasons for the difference is due to the equipment being used. Our firewall for instance has no way to grant or deny outbound based on user ID, so it would be much more difficult to implement such features.

Answer 3

As a general rule, I'd:

1. Block all inbound connections by default (plus outbound, I was reminded of that by uSlackr).

2. Run firewall programs on the internal servers and clients themselves, and also put up a perimeter firewall on dedicated hardware (which might also be your VPN server). The perimeter firewall won't help at all on internal-only traffic, but will greatly reduce the amount of hammering your internal systems get from the outside world.

3. Allow specific inbound (and outbound) connections to ports/IPs that should be offering (or using) services. This may make for a lot of ports to allow on the perimeter firewall, but a system like Shorewall may make things easier by letting you define a set of ports as "Web traffic", for example. If the internal clients/servers are Windows or OS X, then built-in firewall GUIs tend to make it easier to say "allow traffic for File and Printer Sharing".

4. If we're talking about a VPN system like OpenVPN, I'd only use it for specific cases that would not make it through the perimeter firewall, and are critical for your remote users. OpenVPN lets you define a client configuration directory where you can put in specific rules for specific users. For example, my rule allows me to connect to my office printer from offsite, but doesn't open it up to the rest of the VPN users.

Answer 4

The general guidance for most anyone is, Only allow what you need, block everything else.

That's a very high-level guide, and is especially applicable for inbound connections.

Blocking outbound connections is where things get interesting. The strictest interpretation says you should do the same for outbound as well; ports 80 and 443 for everyone, DNS if needed. In a small business context, this is not likely to be politically acceptable as you're likely to know everyone in the business and implicitly trust them to not be evil. If you do, you're going to be adding ports left right and sideways for weeks/months as users identify things they need.