Originally posted here by Darksnake
Sir Dice, you can still use a ids on the incoming port from the internet which would inform you about these fishy things people try. Wouldnt you say?
Yes. But I like to put an IDS before and after the firewall. That way I can verify that the firewall is doing it's job properly (i.e. nobody made a configuration error).