Firewall security: Problems with simple Samba file share 3611
It isn't the same situation - it's not a one off at all. Your use of the firewall is predicated on a continuous background of "experiments" dedicated at breaking in hence the laws of statistics apply, rotundly.
No, the expected additional loss is zero - it does not stop attacks, because attacks are aimed at generically open services like ftp, nfs (locally), rpc, domain, smtp, pop, etc.. They have to be, or the attacks would never become worth considering - you can't catch a disease if nobody else has it.
It is a neglible risk - by the laws of statistics, because they apply here. It is the number of experiments that makes it not a candidate for the "always bet on long odds...
You're getting more and more ridiculus. SSH is of course vulnerable to attacksfrom-China-. Yes. No. However. But that's not the point. Besides, SSH is just an example. Not always. But just once. On my...
ONCE. Do it consistently and you lose. The idea is to pull off a once-only. Keep betting and the law of averages will have you lose.
I already gave the argument - it does not protect any services that are being attacked, because attacks are only on open services. Diseases that only attack one-legged red-haired catholic nuns do not spread. You do not need innocculation against them.
Besides, what are these ficbreastious services of yours that are for local use only? I bet they don't even route. Is it ssh? Well, I told you that ssh is secure independent of where the connect comes from! No entry without authorization, and if they have gotten authorization falsely, then they have already logged in to your so-called safe IPs to get it! So they aren't safe.
Peter
Firewall security: Problems with simple Samba file share 3612
Linux groups from Newsgroups
Firewall security: Problems with simple Samba file share 3610