Firewalls

Transcript Firewalls

Firewalls What they do.

How they work.

cs490ns - cotter 1

Outline

• What is a firewall?

• Architectures – Stand Alone / application / proxy – Personal / host based – Gateway / packet filters – Enterprise / hardware • Roles – Bastion – DMZ • Packet Filtering concepts – IPTables – Stateful filtering • Packet Forwarding • Ethernet bridge cs490ns - cotter 2 2

What is a Firewall?

• A hardware or software device that monitors (and controls ?) the transmission of packets that attempt to pass through the perimeter of a network (or host).

• Provide 2 basic security functions – Packet Filtering – Application Proxy gateways • Additional security features – Log unauthorized (and authorized ?) access attempts – Provide VPN Connections – Support user authentication – Shield internal machines from outside view cs490ns - cotter 3 3

What should a firewall do?

• Control the flow of packets to/from Internet • Block external login as root (?) • Must distinguish between local and Internet packets (even spoofed addresses) • Support limited user accounts • Log all system activities cs490ns - cotter 4 4

Types of Firewalls

• Stand Alone / application / proxy • Enterprise / Local • Hardware / Software • Gateway / router / packet filter • Personal / host based – Windows firewall – incoming protection – ZoneAlarm, Linux, etc. – incoming / outgoing filter cs490ns - cotter 5 5

Types of Firewalls

Stateful Firewall Router / packet filter Internet Host-based Firewall Application Proxy

Corporate Network

cs490ns - cotter 6 6

Standalone Proxy Firewalls Application Gateways

• Intended to buffer the interface between an internal application and the Internet – Web Servers – Mail Servers – File Transfer • Controls flow of packets into and out of local network – Limit access to specific web sites – Cache results for use by other internal hosts – Hide internal IP addresses from network view cs490ns - cotter 7 7

Enterprise Firewalls

• Intended to support larger traffic volumes • Provides more sophisticated support – Stateful filtering, etc.

• Software – Checkpoint Firewall 1, Microsoft ISA, Semantic Enterprise, etc.

• Hardware – Cisco PIX, SonicWall, Watchguard, etc.

• Expensive!

cs490ns - cotter 8 8

Gateway / Packet Filter

• May be embedded in sophisticated routers • May be used for SOHO networks – May be incorporated into small SOHO routers – May be incorporated into a gateway host (Linux ?) • Provides the ability to monitor and control packets through the gateway / router.

– Generally support in / out / through filtering – May not include stateful filtering capabilities cs490ns - cotter 9 9

Host-based Firewalls

• Intended as a last line of defense for the host computer • Runs as a background process on host – Limited bandwidth available – Generally supports incoming port filtering – Can specify which ports (if any) can support incoming connection requests.

– Occasionally supports outgoing filtering (looking for worms, trojans, etc.) cs490ns - cotter 1010

Firewall Roles

• Bastion Hosts – Hardened systems that typically run a firewall and perhaps an application as well • DMZ – demilitarized zone – An isolated subnetwork that includes all services that are offered over the internet (and perhaps to the internal network as well).

cs490ns - cotter 11

Bastion Firewall and Host

LAN Internet

Firewall cs490ns - cotter Web Server 12

Internet

DMZ

DMZ Web E-mail LAN

cs490ns - cotter 13

What is Packet Filtering?

• The process of deciding which packets to allow through the filter, based on attributes of the packet – Source / Destination Port – Source / Destination IP Address – Status flags in the packet (syn) – Originating protocol (icmp, tcp, etc.) – Connection state (tcp) • Linux (2.4+) supports Netfilter (based on iptables) cs490ns - cotter 1414

How does Packet Filtering Work?

• Define rules to allow or block specific types of packets • Firewall screens all packet headers to look for matches against the rules • Apply rules in the order in which they are stored • Allow or block packets based on rule matches.

• If a packet matches no rules, apply default behavior to the packet (usually deny).

cs490ns - cotter 1515

Packet Filtering Issues

• Rules are complex. Easy to introduce errors • Filters based on IP addresses. If authorized sites are hacked, your site is compromised • IP Spoofing can fake authorized (internal?) sites. • Routers can be hacked to reroute internal packets • Activities need to be logged • Internal host adresses should be hidden cs490ns - cotter 1616

Iptables

• Administration tool for IPv4 packet filtering and NAT • Used to set up, maintain, and inspect the tables of IP packet filtering rules used by the kernel to manage packet flow through the firewall.

• Based on tables that specify the overall task and chains that identify the position of the packet in the packet flow.

cs490ns - cotter 1717

IPTables tables

• Filter table – Used to control the flow of packets based on packet attributes – Only filter packets, don’t modify packets here.

• Network Address Translation (NAT) table – Used to change the source / destination IP address and / or port of selected incoming / outgoing packets • Mangle table – Supports specialized packet handling / routing – Change contents of packet • Experimental and developing tables … cs490ns - cotter 1818

filter table Basic Packet Filtering

Input Forward LAN Internet

RH-Firewall-1-INPUT

Output

cs490ns - cotter 1919

Incoming Packets to Filter

• Illegal Incoming Source IP Addresses – Your IP Address – Your LAN Address – Private Network Addresses – Multicast IP Addresses – Loopback Interface Addresses • Nuisance sites / networks • Remote Source Port Filtering • Local Destination Port Filtering • Incoming TCP connection-state filtering • Probes and Scans • DoS Attacks • Etc.

cs490ns - cotter 2020

Packet Filtering alert list

• CERT – – www.cert.org

– Carnegie-Mellon Software Engrg Inst.

www.us-cert.gov

– • Port Filter List (3/08) – DNS zone transfers – tftpd – link – RPC / NFS – BSD “r” commands – lpd – uucpd – openwindows – X windows cs490ns - cotter 53 69 87 111 / 2049 512, 513, 514 515 540 2000 6000 + 2121

Outgoing Packets to Filter

• Why?

– Consideration for fair use in Internet – Distribution of private information – Detection of unwanted client programs (Trojans, etc.) • See http://www.us-cert.gov/cas/tips/ST06-001.html

• What – Legitimate, routable addresses only – Destination IP Addresses – Destination ports – Source Ports cs490ns - cotter 22

Filter TableChains

• May be associated with any interface (eth0, etc.) • INPUT – Used to test packets that come into the firewall • OUTPUT – Used to test packets that are leaving the firewall • FORWARD – Used to test packets that are passing through the firewall • Packets should pass through only 1 chain cs490ns - cotter 23

Filter table packet flow

cs490ns - cotter Routing Forward Chain Drop Local Processes Output Chain Drop 24

Iptables rule structure

• Iptables –t “table” “action” “chain” rule “target” – Which table are we working with (filter is default) – What action do we want to do to that table (insert, delete, etc.) – Which chain in that table are we working with – What do we want to do?

– Where do we go if we match the rule?

cs490ns - cotter 25

IPTables Actions

• Create a new chain (-N). • Delete an empty chain (-X). • Change the default policy for a chain. (-P). • List the rules in a chain (-L). • Flush the rules out of a chain (-F). • Zero the packet and byte counters on all rules in a chain (-Z). cs490ns - cotter 26

IPTables Actions

• • • • Append a new rule to the end of a chain (-A). Insert a new rule at some position in a chain (-I). Replace a rule at some position in a chain (-R). Delete a rule at some position in a chain, or the first that matches (-D). cs490ns - cotter 27

IPTables targets

• ACCEPT – Stop processing and pass to application / OS • DROP – Stop processing and block packet • LOG – Packet info sent to syslog. Continue processing • REJECT – Stop processing and send reject message to source • DNAT – Change destination network address • SNAT – Change source network address • MASQUERADE – Do source network address translation (PAT) cs490ns - cotter 28

Example Filter Rules

• #Allow traffic on the loopback interface • iptables –A INPUT –i lo –j ACCEPT • iptables –A OUTPUT –i lo –j ACCEPT • # Set Default policy for chain • Iptables --policy INPUT DROP • #Allow all outgoing connections • iptables -A block -m state --state NEW -i ! ppp0 \ -j ACCEPT • #Block incoming attempts to Xwindows • iptables –A INPUT –i eth1 -p tcp --syn \ --destination-port 6000-6003 -j REJECT cs490ns - cotter 29

Example Filter Rules

#Allow incoming connections to local web server Iptables –t filter -A block –p tcp --dport 80 --i eth1 \ -j ACCEPT #Insert a rule that allows incoming udp packets to port 12345 iptables –I block 7 –p udp –dport 12345 –j ACCEPT #Allow DNS requests NOT from outside iptables -A block –p tcp --dport 53 -m state --state NEW \ -i ! eth1 -j ACCEPT #Allow (and redirect) incoming web connections to 192.168.5.6

iptables –t nat –A PREROUTING –d eth1 -p tcp \ --dport 80 -j DNAT --to-destination 192.168.5.6

cs490ns - cotter 30

Simple Firewall table

## Insert connection-tracking modules (not needed if built into kernel). insmod ip_conntrack insmod ip_conntrack_ftp ## Make chain that blocks new connections, except if coming from LAN. iptables -N block iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT iptables -A block -j DROP ## Jump to that chain from INPUT and FORWARD chains.

iptables -A INPUT -j block iptables -A FORWARD -j block cs490ns - cotter 31

Iptables default config file

/etc/sysconfig/iptables # Firewall configuration written by system-config-securitylevel # Manual customization of this file is not recommended.

*filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0] -A INPUT -j RH-Firewall-1-INPUT -A FORWARD -j RH-Firewall-1-INPUT -A RH-Firewall-1-INPUT

-i lo

-j ACCEPT -A RH-Firewall-1-INPUT -p icmp --

icmp-type any