If you are caught on the network with an unsecure gate, or open proxies, you will be removed forcably from the network. If you are an abuser of this gate/proxy, stop using it. If you are a user that didnt realize you had an open port for such a thing, below you will find the "how's" and "why's", and "how to fix" on these issues, if you are glined or klined from a server for having unsecure gates on your system.

Note: You can have the gline lifted AFTER you have secured your machine by emailing the person that glined you, their email being 'oper-name-here@alias.chatnet.org'.( For example, Justmoi is justmoi@alias.chatnet.org ) or simply by emailing 'gate@chatnet.org'.

There has been increasing amounts of press and publicity concerning unauthorized use of proxy/firewalls to perform illicit activities which may be attributable to a firewall user. A number of these instances have involved the use of WinGate. This page is an information source to tell users of the issues, and how they can defend themselves against abuse of their systems.

Why should I do anything?-

There are unfortunately people out there who spend a great deal of time looking for a way to bypass security measures used increasingly by ISPs to thwart spammers - people who send large volumes of unsolicited mail to large numbers of email addresses. One way to bypass ISP security for sending mail is to appear to be a valid ISP client. This can be done through proxy software such as WinGate, if it is not securely configured.

So. In general, in order to stop people doing things that may be attributed to you, which could result in things like you getting your account shut down, you should ensure that your proxy server installation is secure from unauthorized use.

How do I do it?-

There are a number of methods of securing WinGate, which should not take you longer than a couple of minutes to implement.

There are two main ways to secure access:

1. Logically, by rule. This involves setting up rules as to who may or may not do certain things in WinGate.

2. Physically. By binding a service to a specific interface (see below), that service is simply not available from any other interface, so by binding a service to your LAN adapter, you can easily block all access from the Internet.

3. You may also choose a mixture of these two methods, depending on your requirements for access. Here are some examples of some typical ways of securing your access.

Example: A small LAN using WinGate Lite or free version for net access. Not running any servers that need to be accessed from the internet.

This is by far the most common scenario.

Option 1-

If all the services are using the default security arrangement as installed, then perform the following steps.

1. Open GateKeeper and log into WinGate as Administrator.

2. Double click on Policies, and double click on "Default Policies"

3. Select the right "Users can access services"

4. There will be one recipient there - "Everyone". Double click on this recipient.

5. Select the Location tab.

6. Select "Specify locations from where this recipient has rights"

7. Add the following IP addresses under Included locations: 127.0.0.1, and the first three numbers of your WinGate machine's network card followed by a .* - for example if your network card has IP address 192.168.0.1, then you would add 192.168.0.*. If you have more than one network card in the WinGate machine then add an entry for each one that will be requiring access to WinGate.

8. Hit OK, and remember to save changes.

9. Now only your LAN users can access any service in WinGate. If some of your services are using their own rules rather than the global ones, you can perform this action for each recipient in those service-specific rules.

Alternative method using option 2.

Because the Lite version of WinGate cannot bind a service to more than one interface (WinGate 2.1 Pro can do it), in order to use option 2, of binding services, then you need to create a separate service for each interface you need to bind to. Minimum is 2 - the localhost interface, which is used for your second free user license, and the interface of your WinGate machine LAN card. For each LAN card in your machine you need to create another service and bind it to that LAN card IP address.

To bind a service to an interface do the following:

1. Open GateKeeper and log into WinGate as Administrator.

2. Double click on "Services" in the right hand pane.

3. Double click on the service you want to modify.

4. The "General" tab you see in front of you has an option on it - "Bind to specific interface" - enable this option, and type in the address of the interface you are binding to. The interface address is the IP address of a LAN card in your WinGate machine, or 127.0.0.1 for the free user (localhost). Note - You cannot change the binding in the Remote Control Service in WinGate Lite.

What if I am running a server behind WinGate that requires public access?

We recommend that you do not run Telnet or SOCKS servers with public access. If you do, you will want to restrict what requests the server will perform. You could require users of these services to be authenticated if they connect from the internet. This will ensure no unauthorized use. Otherwise you can specify where a user can connect to, or at what times.

For WWW, if say you are running a WWW server behind WinGate, you can stipulate that internet users can only connect to your internal WWW server, and internal users can connect out.

General techniques and hints.

This first question is "Do I really need to allow access to this service from the Internet, and Why?". Basically the reasons to require access from the internet are relatively few.

You may be running mail, WWW or other servers on your LAN that require access from the internet. You may require field staff to telnet into your Unix server from the field. You may have a requirement for some secure inter-office communication. If none of these apply, you need to seriously question why you would allow access from the internet to a service.

There are ways and means to specify different access rights depending on where a user accesses WinGate from. You can either create duplicate services bound to the different interfaces with different policies per service, or you can do it with a single service, with location based policies.

E.g. POP3 service using service specific rules. Create two recipients called everyone - the first one is restricted by location, and must connect from your LAN. The second can connect from anywhere, but is restricted by request - say only allow connections to certain servers or ports.

Note- The information provided on this page was provided to us via the webpage 'http://www.wingate.nl/secure_wingate.htm'