Doug wrote:

Does anyone have a base 'rule-of-thumb' for filtering ports.

Sure. Run an operating system where you only run the network daemons you wish to run, can choose whether to make them bind to localhost only or to outside interfaces as well, and where you can easily turn them on/off, determine what's running and why, and substitute different implementations if you don't trust the current one.

If any of those things isn't true -- and in particular if you cannot reasonably control what network services are exposed to outside -- then you're not running a reasonable operating system, and should start your work there.

Fortunately, any modern microcomputer operating system will do fine. Take your pick: *BSD, Mac OSX, or Linux.

Rick Moen
rick@linuxmafia.com