firewall rules help

[facemelt]

Would someone mind looking at my firewall rules to make sure that they are ok, I am a newb at this, and the internal/external stuff source/destination doesn't make sense to me (at least I think). So far I have my untangle server running pretty well. My server is also a nat server thats on the edge of my network. I also host a webserver on a mythtv box(10.1.1.15) and use bittorrent on another pc(10.1.1.10). I have yet to test the vpn (haven't got a chance to hope on a different network) so I am not sure if that rule is even correct.

http://www.emendit.net/untanglefirewall.gif

The first rule is in place because I don't care much about outgoing traffic, just incomming, i shouldn't be worried about outgoing right? Its just a home server for me and my wife. please advise if i am severely doing something wrong. I have yet to test the vpn.

Thank you. I love this product so much more then my old Netgear router, plus it gave me a chance to upgrade to gigabit.

[mdh]

i shouldn't be worried about outgoing right?

Except for bots that can get your ISP to drop you, no.

Your basic philosophy is good, and using a "block all" rule at the bottom here instead of using default rules means that you can monitor attempted intrusions. That's also good. Where I would do more work is to eliminate the use of "any" unless that is the only word that applies. If you are referring to your network, specify the subnet (or exact address) that you are referring to. It takes longer to set up, but security is all about being specific.

I would also block port 25 outbound (in case you do get a bot in your network) and port 6667 (so they can't talk to each other). All in all, you have a real good start here.

Also, since you clearly plan to use torrents, make sure that you watch how your torrent computer is affected by Attack Blocker, and what effect torrents have on other things you need to do. There likely will be effects.

[facemelt]

Thank you for such the prompt feedback (and specifically nice input). I will try changing the ANY rules to be a bit more specific. Good point on the bots, I was just lazy when it comes to unblocking access to certain ports that are outgoing (thanks for the heads up on 25 and 6667). What about the VPN rule, anyone have any input on that? its going to be used for when I am on the road with my laptop and want to access some files or do safe web browsing, what can i change there?