The easiest way to hide system names and IP addresses from external scanners is to use Network Address Translation (NAT) on your network. NAT devices (usually border firewalls) allow you to use private addresses on your internal network and public addresses on your external one. Unless a NAT rule is specifically enabled, such configuration prevents anyone on the Internet from reaching systems that use private addresses.
When using NAT, it's a matter of best practice to use RFC 1918-reserved private address ranges. These include the 10.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, and 192.168.0.0-192.168.255.255 address ranges. These addresses are not routable over the Internet, and they can protect you from firewall mis-configurations.
- A SearchSecurity.com reader asks whether firewalls alone can block port-scanning activity.
- Is it ever a good idea to put a firewall before a router?
Dig Deeper on Real-time network monitoring and forensics
Related Q&A from Mike Chapple
Explore the differences between wired and wireless network security, and read up on best practices to ensure security with or without wires. Continue Reading
Choosing to encrypt confidential data with AES or DES encryption is an important cybersecurity matter. Learn about the important differences between ... Continue Reading
It's not possible to eradicate the risk of DoS attacks, but there are steps infosec pros can take to reduce their impact. Mike Chapple shares ... Continue Reading