Solved

PPTP Port 1723 Security Scan port as open

Posted on 2004-04-23
5
6,610 Views
Last Modified: 2008-01-09
I went to the symantec site and used their Security Scan program to scan my network to see if it was safe. The program results said my port 1723 is open and could be used for an attack. Now I need this port open so I can VPN into my server. I am using a Linksys router BEFSR41 to forward the port to my VPN server. How can I stealth or hide this port and still be able to use it?
0
Comment
Question by:Djrobluv
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 10

Expert Comment

by:snerkel
ID: 10903902
Simple answer you can't.

If you stop the VPN server but leave the port forwarding instruction then the port becomes stealthed.

If the VPN server is running then in order for you to connect the port will respond as open.
0
 
LVL 11

Expert Comment

by:PennGwyn
ID: 10905035
Presumably, a client trying to use the VPN must not only connect to the port, but then negotiate encryption and authenticate.  IF you've configured your VPN well (Symantec has no way to check that!) then you've very little to worry about.

0
 
LVL 23

Expert Comment

by:Tim Holman
ID: 10906790
You can't stealth it as it NEEDS to be open for PPTP VPN users.  I wouldn't worry too much about it.
The worse that could happen is that an intruder could find out your username and brute-force your password, so make sure you have two-factor authenitication in place (RSA SecurID / Alladin) and ensure you're logs are set to log all login attempts, and alert you if you start getting suspicious activity.
0
 
LVL 7

Expert Comment

by:shahrial
ID: 10920183
Ensure you use a strong password...minimum 8 character(alphanumeric, uppercase / lowercase combination & use of special characters)...that should make it complex....
0
 
LVL 1

Accepted Solution

by:
axelt earned 250 total points
ID: 10956658
All TCP communication start with a three way handshake:

First: a SYN packet from the source. "Hello, are you there?"
Second: a SYN_ACK packet from the destination is sent back to the source. "Yes, I'm here"
Third: an ACK packet from the source: "Let's talk"

You can see what state communcations are in by running the netstat command.
Most port scanning is done by sending SYN packets to all ports on the server. All open ports will reply with a SYN_ACK packet. And the scanner sees the port as open. If the scanner wants too, he can also completely connect to the port to see more information about the port.

But you can increase security:
If you only VPN in from a permanent/semi-permanent location you can stop all incoming VPN from other locations.

F.ex lets say you work from time to time from home. You do not have a static ip address at home, but the ISP gives you addresses in 130.45.x.x range
Add a filter to your router/firewall only allowing 1723 access from 130.45.0.0 mask 255.255.0.0 and 99.9% of the internet is blocked....
If you have a static ip - you could add only that ip - much more secure.

Another option is using L2TP/IPSec instead of PPTP - That way you can use a sertificate installed on the machine you use to connect to VPN.
If you use windows 2000 and use nat on the router, see this link http://support.microsoft.com/default.aspx?scid=kb;en-us;818043

I would recommend you use a separate account without admin-rights and strong password + account lockout after f.ex 3 tries to connect to your VPN.

If you want access from all over the world, using any machine. Not much you can do except using a strong password. Security and ease of use go in opposite directions.... :)
0

Featured Post

Get Actionable Data from Your Monitoring Solution

Your communication platform is only as good as the relevance of the information you send. Ensure your alerts get to the right people every time with actionable responses. Create escalation rules that ensure everyone follows the process and nothing is left to chance.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to security, close monitoring is a must. According to WhiteHat Security annual report, a substantial number of all web applications are vulnerable always. Monitis offers a new product - fully-featured Website security monitoring and pr…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
Suggested Courses

687 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question