UDP Port Scan returns bad results

[funkyacidmonkey]

Hello all...first post here so go easy on me.

Background: I guess you could call me a noob at network security although I've learned a lot in the last year. I'm one of those people who got thrown into a Network Admin position for a small office just because I can use Google well and have common sense.

Well, I recently installed a Hotbrick VPN 600/2 Firewall so I can take advantage of the redundancy and performance of two connections (Dual WAN Ports w/ "load balancing").

I have several complaints about this thing, but I will try to stay on topic. The device is our gateway router and firewall. I've yet to set up VPN because I don't know how much I trust this thing.

Well since its up and running and I've got it configured the way I want, I started running some port scans from the outside. They all came back good until I ran Sygate's UDP port scan from here.

Right off the bat, it said it detected no firewall and almost all of the UDP ports returned a "Closed" result. One UDP port (DHCP Server) came back with "Open"! The TCP scan and the "Trojan Scan" all came back perfect with all ports "stealthed".

I called Hotbrick and they said this was by design. He said the DHCP Server port was open for situations where the hotbrick was to be a DHCP client, and it's non-configurable. After much prying, he finally admitted the UDP ports are not stealthed because "that would have cost more money to develop"! Can you believe this?

He tried to satiate me by telling me that the hotbrick had never been hacked because the policies are still enforced.

A couple questions:

1: Am I vulnerable since my firewall is responding to all UDP port scans and the DHCP Server port is wide open?

2: Is it possible that the stateful packet inspection is protecting my network despite the UDP issue?

3: Would you trust this device as a firewall/VPN device in light of what I've told you?

4: Am I just a worry wart?

Their website is www.hotbrick.com, but you won't find anything of value there...or at least I couldn't.

Thank you for any insight you might have. If this is the wrong forum/site, please make a suggestion.

 

[Nothinman]

Can you believe this?

Sure, most commercial products do stupid things to cut costs.

1: Am I vulnerable since my firewall is responding to all UDP port scans and the DHCP Server port is wide open?

Probably not, it depends on their software. The fact that the port is listening might get you some more break in attempts from automated scripts but if the DHCP client and server aren't actually listening and processing the packets there's almost no chance of anything happening from that.

2: Is it possible that the stateful packet inspection is protecting my network despite the UDP issue?

They're two completely seperate things. Statefull packet inspection doesn't give much protection, it's just used to keep track of which packets are part of what stream/connection so that return packets can be let back through in a smart manner.

3: Would you trust this device as a firewall/VPN device in light of what I've told you?

Generally I don't like anything that's not extensively configurable, at work we pretty much only use products from Cisco and SecureComputing and even the newer stuff from Secure does some really stupid things that I don't like. If it was a small company and it was just me on the team I would probably use all Open Source software for this sort of thing.

4: Am I just a worry wart?

You should be, network security requires a level of paranoia to work well. The hard part is deciding what risks are acceptable.

 

[funkyacidmonkey]

3: Would you trust this device as a firewall/VPN device in light of what I've told you?

Generally I don't like anything that's not extensively configurable, at work we pretty much only use products from Cisco and SecureComputing and even the newer stuff from Secure does some really stupid things that I don't like. If it was a small company and it was just me on the team I would probably use all Open Source software for this sort of thing.

Thanks for the input. Are you suggesting a "Open Source software" solution like a linux box? Isn't the Hotbrick probably a safer bet for a novice like me?

Anyone else?

 

[Nothinman]

For a novice, probably, but overall probably not. There are secure out of the box Linux distros designed just to be a router and VPN device, but I havn't used them so I can't comment on how well they work or how easily. It really depends on how much time you want to put into this and how much you want to learn.

And no offense, but IMO a novice should never be put in your position, the biggest problem on the Internet is people who don't setup their stuff properly. I mean christ, I still get CodeRed attempts from infected machines out there and that was how many years ago?

 

[funkyacidmonkey]

Originally posted by: Nothinman


And no offense...q]

None Taken. I have taken classes and done reading to keep up on a multitude of security concepts, so I guess I'm more intermediate but what I meant was I would be a novice to Linux. I've only had an hour or two of hands on with Red Hat and so on.

I guess you disagree with what I was taught...that a software based firewall is never as secure as a hardware solution?

I am a M$ Action Pack Subscriber and could be using M$ Internet Security and Acceleration Server 2000, but I don't trust it after readin reviews.

I regret buying the hotbrick, but I don't regret my decision to use a hardware solution.

Keep the input coming!

 

[Iron Woode]

as an aside:

I use Freesco as my firewall/router. By using an old PC and some nics that were kicking around, I have a secure* multipurpose setup.

I know squat about Linux and it only took me about 10 min to setup and another 10 min or so to get everything on the lan working (ie: fine tuning). I also installed Samba so all my PCs could transfer files between them. Samba is also setup to be secure*.

So far it has been a nearly maintenance free device.

*secure means no security issues but no one has really tried anything either so it ain't enterprise level that I am aware of. Further testing will be in order.

/my $.02 worth.