Carefully consider which TCP/IP services will be allowed through and to the perimeter routers and firewalls (inbound and outbound). Use the following guidelines for creating filters:  those services that are not explicitly permitted are prohibited.  The following tables present common services to restrict because they can be used to gather information about the protected network or they have weaknesses that can be exploited against the protected network. 

1) Table 1 lists those TCP or UDP servers that should be completely blocked at the perimeter router or firewall.  These services should not be allowed across the router or the firewall in either direction.  Also, they should not be allowed to the router or the firewall. 

2) Table 2 lists those TCP or UDP servers on the protected network, on the router or on the firewall that should not be accessible by external clients. 

3) Table 3 lists the common TCP or UDP servers on the protected network, on the router or on the firewall that may need some access by internal or external clients and servers.  Many of these services can be filtered to the few authorized computers (e.g., ftp server, mail server, domain name server, web server) on the protected network or on the DMZ subnet. 

4) Table 4 lists the ICMP message types that can be allowed outbound from the protected network, while all other message types should be blocked. 

In general, the administrator should create filters focusing on what services and hosts are permitted and denying everything else.  This method means that one may not need to block each service in the tables below with a specific filter statement.  Finally, use an intrusion detection system on the protected network to monitor the TCP/IP traffic that is allowed past the perimeter routers and firewalls.

Table 1:
TCP or UDP Servers to Completely Block at the Perimeter Router / Firewall

Table 2:
TCP or UDP Servo Block at the Perimeter Router/Firewall from External Clients

Table 3:
TCP or UDP Servers to Allow Limited Access at the Perimeter Router/Firewall