Hi, If I block any, will I block any or will x11 get through because it does not match for any? Please don't bother answering that, but in my belief it states that not matching anything for any will always be the stupidest thing some crippled mind in the CheckPoint shop has ever invented. No mather what crap explanations you can come up with, like sysadmins not knowing how x11 works??? What has that got to do with anything?
Any should be any, if it isn't, name it differently. -----Oorspronkelijk bericht----- Van: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] Namens Crist Clark Gepost om: donderdag 5 februari 2004 22:13 Gepost naar: Security Discussie: [FW-1] X11 Problem Onderwerp: Re: [FW-1] X11 Problem David Strom wrote: > Not quite, with X11. I had a long, drawn-out discussion about this > new "feature" with Checkpoint support, even got bumped back to Israel > for in-depth explanation. Checking the "Match for Any" box is the > default for X11, iirc, and it won't help in NG FP3 and later. > > Basically, new with NG FP3, X11 protocol is *blocked* when you have a > rule for allowing "Any" service. Yes, this is totally different from > anything else that FW-1 does. This is documented in the release notes > for NG FP3. If you want to allow services in the 6000 range of ports > (overlapping the X11 range), you must add a rule *above* the "allow any" > services rule. Note that there is a pretty good description in the > Tracker (Log Viewer) when packets are blocked, but no reference to the > rule number associated with this block (the allow any rule). The rule number given in the log entry is the "Any" rule which blocked the connection. > One > argument I had with Checkpoint was that the Log should show the rule > number which caused the X11 block, even though unintended by the FW > administrator, so that if the FW admin WANTS X11 ports to be allowed, > he/she would see what rule number to put the allow X11 (or other > 6000-range ports) *above*. Lost the argument, but they may have added > it to the RFE list. In the R55 Tracker, it's in the "Rule" column just like any other log entry. > This new X11 "feature" is actually not sane behavior, IMO, but I > suspect there aren't too many FW-1 customers who really want to allow X11 traffic. Probably because so many FW-1 administrators do not understand how X11 works. The machine that you are sitting at is the SERVER and the remote machine is the CLIENT. If you telnet into a remote machine, you have a telnet client at your desk connecting to the remote telnet server. When you then start an xterm on the remote machine, the xterm is the CLIENT and your machine's X server is the SERVER. It's the reverse of the telnet situation and too much for many sysadmins-stuck-being-network- security-admin-too to wrap their head around. -- Crist J. Clark [EMAIL PROTECTED] Globalstar Communications (408) 933-4387 ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
