> however, as m0n0 has NO IDEA AT ALL about what the traffic really is
> (no packet inspection) anyone with more than half a clue could simply
> run whatever they wanted through those open ports.

We are running an in-line IPS directly behind m0n0wall for added
layered security, and are quite pleased.

internet--router--m0n0--IPS--lan

You would not beleive the crap the IPS is catching/blocking. 

Anyway, I was originally just wondering how everyone else is doing
things. More to confirm my thoughts as well as improve upon the steps
I've taken.

- Don


On Apr 1, 2005 3:29 AM, A dot L dot M dot Buxey at lboro dot ac dot uk <A dot L dot M dot Buxey at lboro dot ac dot uk> wrote:
> Hi,
> 
> > What types of traffic are you blocking from a business perspective ? I
> > am just curious about what traffic I might want to block in the LAN
> > outbound direction..ie P2P, IM, 445 ports.
> 
> for the purpose in which we are using/testing m0n0 we are only allowing
> 
> 80/443 ('web' and 'secure web')
> 22 ('ssh')
> 465/993/995 ('SSL mail protocols')
> 554 ('RTSP')
> 
> ..and of those, only the required TCP or UDP port.
> 
> however, as m0n0 has NO IDEA AT ALL about what the traffic really is
> (no packet inspection) anyone with more than half a clue could simply
> run whatever they wanted through those open ports.
> 
> such traffic, with our current setup, is actually trapped by a few more boxes
> further along the network (and detected with SNORT etc)
> 
> alan
>