Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our network is currently isolated from the outside by a Linux box, running iptables and Squid to control web access.

By default we deny all outgoing traffic from all IP's, to force Web traffic through the proxy, and deny the rest. However, we need to allow FTP for some users but not all.

The previous admin used to manually add corresponding entries for those that are allowed to FTP in the routing table, however, as we get more and more requests for people to FTP out of the network, I was wondering if it wouldn't be easier to force FTP traffic through the proxy, and manage users that are allowed to FTP out through the proxy's ACLs ?

Would it be considered less secure than manually managing allowed IP's (which in my opinion is plain stupid since the old admin regularly forgot to remove the appropriate routes when people left the company and IP's were reassigner...) ?

share|improve this question
up vote 1 down vote accepted

If the proxy is good enough for your HTTP traffic, then it should be good enough for your FTP traffic.

In theory making a system easier to administer shouldn't make it more secure, since you should be doing the existing, horrible admin tasks properly. But as you point out, in the real world, the easier it is to stay in policy the more likely you are to stay in policy.

(One minor caveat: while every web browser is really easy to set up to use a proxy server, I've found some ftp clients to be a lot fiddlier.)

share|improve this answer
...and you can't use transparent (zero configuration) proxying with FTP. BTW there are web to ftp gateways (e.g. notftp) as well as ftp specific proxies. – symcbean Apr 2 '12 at 13:39
We don't use transparent proxying (our ACL's rely on the Active Directory), and we require our users to authenticate in the proxy. – T. Fabre Apr 2 '12 at 13:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.