Should a laptop firewall trust a private IP address range?

Wow. Thanks Keith. I find this amazing. Especially given most people use a 192.168.0.x network. It looks like too many would trust 192.168.0.3, for example.

It wouldn't be as bad if Kerio would allow to specify the mac address or name of a peer on the network. Computer names would work for me as I use DDWRT to DNS masquerade the local machines into the DNS domain. Mac addresses would be manageable for say < 4 machines but even tha becomes unmanageable after about 6.

I moved the trusted range into something obscure, and made it as narrow as possible.

Can machines keep changing their IP address and theorectically step through likely addresses looking for holes in other's firewalls?

It wouldn't quite work that way.

remember that the addresses 192.168.0.0 - 192.168.255.255 are in the private range so are not routeable across the internet. The exposure would only come if you went and plugged into a network somewhere and someone already on that network tried to compromise your box.  Likelihood? - who knows.....

however, attacks on the firewalls on their public IP addresses are extremely common place and happen all the time. This is why the best firewall implementation would not allow Internet traffic to work at all..... If there is no outside access, there cannot be attacks from outside.

As soon as you open a port, you open a hole; this is why we use targetted access whenever we can. For example, only allowing access from certain ip addresses TO certain ip addresses limiting the hole wherever we can.

regards
K

> exposure would only come if you went and plugged into a network somewhere and someone already on that network tried to compromise your box.

Yes, that's true, but I take my laptop onto untrusted networks every day.

I'm far less worried at home as I am on a non-routeable address, behind a NAT with SPI.

In an internet cafe someone could keep changing IP addresses until they get to the one to which I have enabled NBT. Obscure, but with very undesirable consequences if the shares get exposed.

Yes, they could. This is a risk you take

I guess I could turn off NBT File and Print sharing when I am not on a trusted network.

Ideally Kerio would do this for me when it notes a change of SSID, but would just stopping the 'Server' and 'Computer Browser' services suffice?

I assume can stop them with 'net stop' commands in a batch file, and that there may exist a tool to execute the batch file when I switch between SSIDs. (Indeed, the mac address of my DD-WRT Linksys Router is known is I want to be paranoid.)

It is always going to come back to the point that if you open a port for flexibility, access etc, you open a hole in your protection system. You cannot 100% protect a system when you have the ports open.

Thanks.

Is there a solution you would recommend that automates the switching on and off of NBT according to which SSID the laptop is connected to?