Re: [cobalt-users] Is a firewall necessary with a RaQ?

["Gerald Waugh" <gerald@xxxxxxxxx>]

> Our 'out-of-the-box' RAQ4R temporarily blocks an IP address when they
> 'poke' around..like when you get port scanned the IP gets suspended for
> about 60 seconds.

What does this? I never heard of it!
 
> I guess the real difference with something like port sentry and IP
> chains is that a permanent rule gets automatically created to block that
> IP, as you mention above.

Port Sentry does not necessarily create a permanent block!
ipchains 'deny' or 'reject' do not create a permanent rule.
Port sentry may write to /etc/hosts.deny [permanent] or
it may just block the route (which is *not* permanent) lost on reboot.

> A useability thought here - if someone is on a dynamic IP address the
> next time they logon (given a fresh IP address) then the firewall would
> cease block the correct person...further an innocent person who may have
> been assigned the original 'now blocked' dynamic IP could not see your
> server and therefore any of or websites!

somewhat!
That's the bad thing about port sentry, ipchains does not do that!

Gerald