LeakTest for Hardware Firewall

[SDK]

I'm looking for a program that will test my outbound connection for every port. I'm running a Nat Firewall and I pretty sure all outbound connection pass without problem but I want to be sure. I know their a few leak test out there but they test software firewall. I need one who test hardware firewall. Thank you.

[Shrekkie]

Let someone Nmap you

[SDK]

I don't need someone to test my inbound firewall. I need a program to test my OUTBOUND firewall..

[swarisd]

I'm thinking your ACL's will give you a good idea as to what is blocked and what's not. Most firewalls by default allow everything out, nothing in. Using Nmap from the inside my give you what you want.

[br_fusion]

http://grc.com/lt/leaktest.htm

This may solve your problem.

[souleman]

grc leaktest sucks arse and it doen't work. There is a program called firehole (I think) that works better.

find someone on the outside that will let you nmap them...that will work just as well.

[S3cur|ty4ng31]

I dont think NMAP will work in this case if I userstand what the problem is.

NMAP will scan all the ports on the target computer but the client will still only use a few ports on the host machine and not test all outbound ports like he wants.

[souleman]

well, does he want to test if it will connect to a certain outbound port, or if it will connect from a certain internal port? I guess thats the real question. If he is looking to outbound ports, nmap will work. If he is looking from certain internal ports...then I really have no idea unless you write your own program to do it.

[Tiger Shark]

SDK: I think you need someone to help you determine what ports your firewall will allow you internal machines to connect to on a remote machine.... Your firewall's egress rules..... It'll probably be a lot.....

What you need to do is have someone with a good firewall, well logged, that will allow you to use a scanner that can be configured to scan every port available, there's a million of those out there..... Then that person can send you the log of the scan and you can see what went out. The scan should be a plain SYN scan so the remote will definitely pick it up.

Another option is to give someone your IP address that you will appear to scan from that runs a Snort box outside the firewall and have then implement a rule as follows:-

alert tcp xxx.xxx.xxx.xxx any -> any any (msg; "Bills test": flags; S; classtype: bad-unknown:)

Where the xxx.xxx.xxx.xxx is your IP address.

The second option will actually work better IMO, since the logging on some firewalls will ignore a whole bunch of stuff unless the work is put in to log it.

Hope this helps

[etruscan]

scrip it w/ netcat ... if you want help pm me