Posted 05 January 2008 - 06:32 PM
I have a few boxes sitting around and am considering constructing the components to deal with some of the security issues at the boundary of the network. I also want to be able to block ports in both directions. Particularly I hope to add virus scanning to the squid server, enforcing some of the exception lists at the appropriate point (possibly a deliberately poisoned internal DNS server), securing DNS (DJBDNS), may be even an e-mail server with virus scanning. The ability to block and monitor use of proxy/monitoring bypassing websites (redirection?) is also an item of interest if anyone has any ideas. I am considering placing wireshark in the initial router to allow for a quick review of traffic on a demand / as-needed basis as a diagnostic tool. Where am I headed wrong and what might work better?