Blocking IP/MAC address with firewall...

Archived from groups: comp.security.firewalls (More info?)

I have a server running SQL Server. I want the database to be
accessable to some other computers over the internet. Simply opening
the SQL port would be very insecure. Also, I don't think that using a
VPN would be very practical for what I'm looking to do.
I'm thinking that the best solution would be to use a firewall that
can block computers based on their IP or MAC address. So it would
have a list of IPs or MAC addresses that would be allowed to get
through to the SQL port and all other computers would be blocked and
could not access SQL server.
Is it possible to do this using the windows firewall? If not, what's
the best software or hardware solution to do this? Are there any
routers that can do this? It is very important that if this is a
software solution it must be very stable, it can't ever crash the
server.
Any suggestions?

Archived from groups: comp.security.firewalls (More info?)

On 2 May 2004 16:20:35 -0700, Ray Lavelle spoketh

>I have a server running SQL Server. I want the database to be
>accessable to some other computers over the internet. Simply opening
>the SQL port would be very insecure. Also, I don't think that using a
>VPN would be very practical for what I'm looking to do.
>I'm thinking that the best solution would be to use a firewall that
>can block computers based on their IP or MAC address. So it would
>have a list of IPs or MAC addresses that would be allowed to get
>through to the SQL port and all other computers would be blocked and
>could not access SQL server.
>Is it possible to do this using the windows firewall? If not, what's
>the best software or hardware solution to do this? Are there any
>routers that can do this? It is very important that if this is a
>software solution it must be very stable, it can't ever crash the
>server.
>Any suggestions?

You can't do it with MAC addresses, as they are irrelevant on the
internet. They get changed with every router the packet passes through.

Most firewall appliances can allow/deny traffic based on source and/or
destination IP address. It should be a fairly simple task with one of
these devices to create a rule allowing SQL traffic for IP address
a.b.c.d.

And, a firewall appliance won't crash your computer...


Lars M. Hansen
http://www.hansenonline.net
(replace 'badnews' with 'news' in e-mail address)