Actually, that's not right if the firewall is well configured, you must activate the "control IP forwarding" on the firewall, to disable routing until the firewall service is up and running.

The true problems with FW1 Checkpoint is that the DNS rules is enable by default from any source to any destination. So if you set the trojan port to 53, you will be able to connect to it (depends of course of the anti-spoofing features and the address plans of the private network)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/171/4921#4921