Firewalls 3p444z

Firewalls: General Principles & Configuration (in Linux) Bruhadeshwar Bezawada International Institute of Information Technology, Hyderabad

Overview   

General Principles of Firewalls Types Issues in design and deployment 



Rules, conflicts and performance issues

Configuration  

IPTables IPChains

Relevant OSI Layers for Firewall Operation

General Principles of Firewalls 

Network firewalls are devices or systems that control the flow of network traffic between networks employing different security postures  



One usage is to limit/control connectivity to the Internet Another usage in corporate networks is to restrict connectivity to and from internal networks servicing more sensitive functions, like ing or personnel department

Firewalls operate at different layers in network

Firewalls that can examine information at more than one layer is more thorough and effective  A firewall that works with layers 2 and 3 does deal with specific s  A firewall at application layer like an application-proxy gateway firewall can enforce authentication as well as logging events to specific s. 

Add-ons ed by Firewalls 

NAT, DH, encryption for VPNs, and application content filtering 





Firewalls DH so as to allocate IP addresses for those systems that will be the subject of firewall's security control and to simplify network management Firewalls can act as VPN gateways, where the gateway is responsible for encrypting traffic that is leaving its boundary and destined to other systems in the VPN Active content filtering, firewall is capable of filtering actual application data at layer 7 



For example, scanning email attachments for viruses, filtering out active content in technologies like Java, JavaScript, ActiveX

Can filter on content or key words to restrict access to inappropriate sites or domains.

Types of Firewalls      

Packet Filters Stateful Inspection Firewalls Application-proxy Gateway Firewalls Dedicated proxy servers Hybrid Firewalls Network Address Translation (NAT)

Packet Filters

Packet Filter Firewalls Packet filters operate at layer 2/3 of OSI

 

The basic functionality is designed to provide network access control based on the information at network layer

      



source address of packet, the IP address from which the packet originated destination address of the packet, i.e., the IP address where it is going Type of traffic, i.e., the type of specific network protocol being used to communicate between source and destination Source and destination ports Incoming, outgoing interfaces for the packet filter type of traffic e.g., ICMP traffic the layer 3 protocol is ICMP Prevent attacks that exploit weaknesses in T/IP suite

The access control functionality of a packet filter is decided by a set of directives called as a ruleset

Boundary Router 

Packet filters also called boundary routers 



Packet filter gateways have both speed and flexibility as they examine a limited amount of data, they can operate very quickly The ability to block attacks, filter unwanted protocol, perform access control, block denial-of-service and related attacks, makes it ideal to be placed at the outermost boundary with an un-trusted network. 



E.g., the boundary router accepts packets from un-trusted networks, performs access control according to the policy in place, say, block SNMP, permit HTTP, block ICMP etc.

The boundary router will the packets to a more powerful firewall that can perform access control and filtering at higher layers of the OSI stack

Boundary Router

Sample Packet Filter Ruleset

Examining the Rule Set 

Some notes on the ruleset  



Actions taken are   



192.168.1.0 indicates all addresses in the range 102.168.1.0 to 192.168.1.254 (Firewall has interface: 192.168.1.1) Examines source port, destination port, source address, destination address, basically all information that is necessary for examining the rules in the ruleset Accept: firewall es the packet through the firewall as requested Deny: drops packet. An error message is returned to the sending system Discard: drops the packet and does not return an error to the source system

Example    

Rule 1 allows any T connections from outside Rule 3 says deny any attempts to connect to firewall from outside Rule 5, 6 say allow packets going to SMTP (192.168.1.2) and HTTP (192.168.1.3) servers Last rule is default, if packets don’t match any of the above they are denied

Weaknesses 

As they don't examine upper-layer data, they cannot prevent attacks that employ application specific vulnerabilities or functions 

   



For example, it cannot block specific application commands: if a packet filter firewall allows a given application, all functions available from that application will be permitted

Logging functionality is limited as packet firewalls work on a small amount of data Most packet filters do not advanced authentication schemes Vulnerable to attacks and exploits that take advantage of problems within T/IP specification and protocol stack, such as IP spoofing Due to small number of variables used in access control decisions, packet filter firewalls are susceptible to security breaches caused by improper configuration These firewalls are suitable for high-speed environments where logging and authentication with network resources are not important

Stateful Inspection Firewalls

Stateful Inspection Firewalls  

Address some functionalities of the T layer Many clients connect to remote systems from highnumbered ports  





E.g., client port is >1023 in most cases Packet filter firewall must allow all communication to happen above this port Allowing so many ports leaves the network vulnerable

Stateful inspection firewall solves this problem by adding the state information of the relevant T connection  

Only ports having legitimate T connections are allowed State table is maintained for every connection

Sample State Table

Application-Proxy Gateway Firewalls

Application-proxy Gateway Firewalls  

Combine application layer information with lower layer information for filtering purposes Application proxies take over the routing task of packets from inside and outside the network 





If it fails no packets can through the firewall All network packets must traverse the firewall under software control

Each individual application-proxy (proxy agent) interfaces directly with the firewall access control ruleset to determine whether a given traffic should be permitted to transit the firewall 

Authentication of each is possible based on -, source address, bio-metrics etc

Advantages Over Previous Firewalls 

They have more extensive logging capabilities as the entire packet is examined 



E.g., malicious commands like su – root from outside can be logged

They allow s to enforce the required authentication based on the security policy of the organization 

IP spoofing can be detected as the attackers need to know more information such as and

Typical Proxy Agents

Disadvantages 

Needing to read entire packet makes these firewalls slow  



Not suited for high-bandwidth or real-time applications Some work is often offloaded to dedicated proxy servers

They are not flexible in ing new network applications and protocols  

They ship with generic This can allow malicious traffic to tunnel through these generic application without check

Dedicated Proxy Servers  

Proxy servers are deployed behind traditional firewalls Main firewall will accept inbound traffic and forward the traffic to proxy, if that application is handled by proxy 



Proxy servers can also accept outbound traffic from internal systems  



E.g., email proxy server

Filter or log the traffic accordingly E.g., HTTP proxy that is behind firewall

Dedicated proxies allow enforcement of authentication requirements in addition to filtering and logging  

Prevent email viruses Protect web server updates from internal s

Email and Content Scanning      

 

Java applet or application filtering (based on digital signature availability) ActiveX control filtering (same as above) JavaScript filtering (eliminating cross-site scripting attacks) Blocking specific Multipurpose Internet Multimedia Extensions types Virus scanning and removal Application-specific commands like HTTP “delete” and -specific controls, including blocking content types for certain s Caching of web pages to reduce incoming traffic

Sample Proxy Configuration

Hybrid Firewall Technologies 



Combining basic packet filters with application-proxy gateway firewalls Combining stateful inspection firewalls with application-proxy functionality to offset weaknesses of existing stateful inspection firewalls

Network Address Translation 

Two reasons for NAT: 





Hiding the real IP addresses in the network prevents many attackers from attacking individual systems Depletion of IP address space has made NAT necessary for most organizations

Three techniques 

 

Static Address Translation Hiding Network Address Translation Port Address Translation

Static Address Translation 

 

Every internal IP has a different routable IP (fixed) Not very frequently used due lack of IPs Very fast and scalable

Sample Table

Hiding NAT 

All Internal IP addresses share the SAME external IP address 



E.g., All systems connecting to Internet through a proxy

For those addresses that need mapping from outside will require their external addresses for efficiency purposes

Port Address Translation  

Forward inbound connections based on ports Client port is used to identify connection, unlike NAT where IP address is used to identify connection 



Each connection internal connection gets a port from the firewall based on the connection When response comes from outside, the firewall looks up the destination port and identifies the client

Sample PAT Table

Other Firewalls 

Host-based firewalls in Linux based systems for application servers  

 

Server application is protected better A separate hardware/software is not necessary

Personal Firewalls to protect PCs Personal Firewall Appliance for protecting small networks like ISP-client connections etc 

Integrates with the following devices, cable modem, routing modules, DH servers, hubs, switches, SNMP agents, application-proxy agents

DMZ 



Created out of a network connecting two firewalls Specifically, for nodes that should not be put in protected internal networks

DMZ