Your filter allows tcp traffic with either source or destination port telnet (23). If you telnet to a webserver the source port (router point of view) will be chosen dynamically (it is not 23!) and the destination port is 80. Since neither source or destination port of the tcp connection is equal to 23, the (return) traffic is dropped.
Expand your filter (suggestions in earlier mails) to allow return traffic from tcp connections that originated from the router. See also this http://www.cymru.com/gillsr/documents/junos-template.htm and this http://juniper.cluepon.net/index.php/Secure_access for some directions on hardening. /Eduard > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of > Kanagaraj Krishna > Sent: donderdag 28 juni 2007 12:46 > To: David Ball > Cc: juniper-nsp@puck.nether.net > Subject: Re: [j-nsp] juniper-nsp Digest, Vol 55, Issue 33 > > Hi, > Aren't the incoming filters used to filter access to > certain services/port into the router? I'm curious on how an > external response (from a telnet request) could be affected > unless it tries to respond to port 80 of the initiator which > in normal circumstances is not likely. Any comments? > > /Kana > ----- Original Message ----- > From: David Ball > To: Kanagaraj Krishna > Cc: juniper-nsp@puck.nether.net > Sent: Thursday, June 28, 2007 3:42 AM > Subject: Re: [j-nsp] juniper-nsp Digest, Vol 55, Issue 33 > > > It very likely IS allowing OUTgoing telnet, even without the > adjustment in your filter. The problem is, it's not allowing the > response from the (assumed) web server in the INbound > direction, hence > your need for the allowance in your input filter. > > David > > > On 6/27/07, Kanagaraj Krishna <[EMAIL PROTECTED]> wrote: > > Hi, > > I've applied an input filter (hardening) to protect > the routing engine of > > an m7i by applying it on the loopback IP. Refer to the > config below. The > > issue > > is that, we can't telnet port:80 to any external IP from > the box itself. > > Obviously I've not allowed access to port 80 on my box in > the input filter > > but > > why would it affect the outgoing telnet. I tried allowing > port 80 access on > > the input filter and after that the outgoing telnet > works. Anyone facing the > > same issue? > > > > Regards, > > Kana > > > > > > lo0 { > > unit 0 { > > family inet { > > filter { > > input protect-RE; > > } > > address xxx.xxx.xxx.xxx/32; > > } > > } > > } > > > > firewall { > > filter protect-RE { > > ---config omitted---- > > > > term telnet { > > from { > > protocol tcp; > > port telnet; > > } > > then { > > policer telnet-policer; > > accept; > > } > > } > > > > ---config omitted---- > > _______________________________________________ > > juniper-nsp mailing list juniper-nsp@puck.nether.net > > https://puck.nether.net/mailman/listinfo/juniper-nsp > > > _______________________________________________ > juniper-nsp mailing list juniper-nsp@puck.nether.net > https://puck.nether.net/mailman/listinfo/juniper-nsp > This e-mail and its contents are subject to the DISCLAIMER at http://www.tno.nl/disclaimer/email.html _______________________________________________ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/juniper-nsp
