Alternatively, the site could obtain a firewall capable of locating the systems that require NFS on a screened subnet, thus preserving the restrictive design policy for the rest of the site systems. On the other hand, the risks of using NFS may be considered too great, so NFS would have to be dropped from the list of services to use remotely. As you can see, choosing the best approach for the needs of the organization must precede the selection and implementation of the firewall itself. The network services access policy discussed earlier determines which protocols and fields to filter. This says which systems should have what types of Internet access.
Intruders can even gain control of a server through the X-server.
Other services, whether inherently dangerous or not, are usually filtered and often restricted to only those systems that need them. FTP, at ports 20 and 21, is often restricted to only certain systems. SMTP at port 25 is often restricted to a central e-mail server. RIP, the routing information protocol at port 520, can be spoofed to redirect packet routing. 119 is used for accessing and reading network news.