UW Firewall Implementation & Information

The University of Wyoming firewall was implemented to help secure university computing systems and comply with federal regulations. Department network and server administrators will find helpful information below.

General Information

Information Technology Security Office has installed a firewall device between the campus network and the Internet.  The firewall will provide greater security for the campus network from the escalating attacks of hackers.  The firewall isolates the campus network from the outside Internet while allowing campus users to access the Internet. See Firewall Zones Diagram.

 Users who require and can justify a need for a Reserve DHCP address will be assigned one.  They will need to submit the Reserve DHCP Address Request Form, justifying the need for a static address.  Users requiring a Reserve DHCP address will be assigned a new static address and will have to manually install the address.  Users should consider carefully if this would be a good time to switch to DHCP assigned addressing.

The IP addresses of servers available to the general public will be in a special zone called a DMZ (for demilitarized).  The IP addresses of these systems will change and will have to be reentered manually. Operators of these systems need to submit a Reserve DHCP Address Request form.  Users of servers that are not available to the general public can still access the servers from off campus by using VPN to access their servers - see information on WyoSecure VPN.

The firewall isolates the campus network from the outside Internet while allowing campus users to access the Internet by assigning non-routable IP addresses to the systems inside the firewall. These addresses are chosen from the Class A 10.x.x.x subnet and the Class B 172.16.0.0 thru 172.31.254.254 subnets.  See UW Firewall Zones Diagram.

Access-Restricted UW Network Services

Information Technology has prohibited access to some network services through the gateway router as part of our ongoing efforts to improve information security. The gateway router connects the University’s campus network to the Internet. The services that are blocked are not commonly needed or are known to be popular vehicles for security compromise.

The restricted services are listed in the tables below. The restriction of these services should have little effect on most users with the exception of the netbios service. The netbios service is used by Windows systems for sharing files, Outlook, and other Window services. This will only affect remote access to the internal University of Wyoming network from the Internet. UW dial in and DSL users will not be affected. Authorized users who need these services and who access the University network from a non-university Internet Service Providers (ISP) such as MSN, AOL, AT&T, Qwest, etc., will need to use Virtual Private Networking (VPN) to access the restricted services. UW's WyoSecure VPN service is available at https://wyosecure.uwyo.edu/. For information see the WyoSecure VPN FAQ.

Because it is almost impossible to know all of the ramifications of restricting these services, IT had two testing periods before the restrictions were put in place permanently. The restrictions were activated on September 7, 2002 for networks in the IT Data Center and September 15, 2002 for all of campus. The network services were permanently restricted on Sunday, September 22, 2002. Any problems should be reported to IT_Security_Office@uwyo.edu.

Services restricted (both incoming and outgoing)

Hackers commonly use these ports to probe and attack internal networks. This list of ports is taken from the National Security Agency recommendations and represents a minimum set they recommend should be blocked. These ports will be blocked for both incoming and outgoing requests. Users who are not connected to the UW network will need to use the WyoSecure VPN to access these services.

Services restricted at the Router for incoming requests

These services are blocked on the incoming side from off-campus access. Users who are connected to the UW network will be able to use these services.