| 2.3 |  | Securing the Perimeter Router |
| 2.3.1 |  | Inbound and outbound traffic |

| Besides disabling services, another option to increase network security is to filter packets using Access Control Lists (ACLs) on inbound and outbound traffic . ACLs can control traffic based on a number of variables, including source and destination network address and port numbers. By carefully constructing access lists, it is possible for a network administrator to reduce many types of network threats. The traffic that will be filtered will depend on the network security policy that is in place. There are some key rules for both inbound and outbound traffic that every network policy should include.

Inbound traffic should be secured on the perimeter as follows:

- Filter packets that have an internal address as their source. RFC-2827
- Filter packets with private addresses as their source. RFC-1918
- Filter BOOTP, Trivial File Transfer Protocol (TFTP), and traceroute packets.
- Allow TCP connections only if they are initiated from the internal network.
- Allow all other incoming connections to access the DMZ servers only.

Outbound traffic should be secured on the perimeter as follows:

- Allow only packets with a source address from the internal network to access the Internet.
- Filter any IP addresses that are not allowed to leave the network as defined by the security policy.

As a review, always apply the following general rules when deciding how to handle router services, ports, and protocols:

- Disable unused services, ports, or protocols. In the case where no one, including the router itself, needs to use an enabled service, port, or protocol, disable that service, port, or protocol.
- Limit access to services, ports, or protocols. In the case where a limited number of users or systems require access to an enabled router service, port, or protocol, limit access to that service, port, or protocol using access control lists.

Figure contains a list of common router services that can be used to gather information about your network, or worse, can be used to attack your network. Unless your network configuration specifically requires one of these services, they should not be allowed to traverse the router. Block these services inbound to the protected network and outbound to the Internet using access lists.