internet router access list standards

[csross]

I am setting up a router which connects to the cable modem. It will also be a dhcp server for a private internal network. I don't want anyone to get in except for ssh but if the clients on the inside request web pages, or send mail, or ftp out, for example, if I deny all but port 22 in, will they be able to execute all those things. We use a cable modem for the private network but I don't want to leave it open. There is also a public internal network but it doesn't go out the cablevision network.

Does anyone have a standard secure access list for a router thats on cablevision (or other private provider).

Thanks

 

[StarTAC]

u can write your access list to permit and/or deny any traffic using source/destination ports for flexibility, in any direction..

it all depends on wot u want, and how u set it up, unless wot u r asking is whether we can give u very specific ACL configs..

good luck..

 

[csross]

Thanks for the response.

I guess I am looking for direction on the standards acls that are used in this kind of situation. My company is getting more and more concerned with security and I don't want to let them down.

If there is a faq or site you can point me to, I would be very appreciative.

thanks

 

[pmesjar]

Try this NSA Cisco router security guide:

http://www.nsa.gov/snac/downloads_cisco.cfm?MenuID=scg10.3.1

there is also an example access-list you can use.

Peter Mesjar
CCNP, A+ certified
pmesjar@centrum.sk

"The only true wisdom is in knowing you know nothing.

 

[csross]

Thank you very much. It appears to be a good source.

 

[ccmuser]

Just like post above yours. The best practice is to AT MOST only allow established TCP traffic back onto your internal net...

Try to move all global services behind a different interface(dmz) Nat makes this rather simple.. Just re ip and move your important devices and change the nat pool..

Then you can apply an more open access-list only to these devices...and if they happen to get infected or attacked you can place another access-list between this network and your internal to provide protection..