Firewalls: General Principles & Configuration (in Linux)

1. Firewalls: General Principles & Configuration (in Linux) Bruhadeshwar Bezawada International Institute of Information Technology, Hyderabad

2. Overview • General Principles of Firewalls • Types • Issues in design and deployment • Rules, conflicts and performance issues • Configuration • IPTables • IPChains

3. Relevant OSI Layers for Firewall Operation

4. General Principles of Firewalls • Network firewalls are devices or systems that control the flow of network traffic between networks employing different security postures • One usage is to limit/control connectivity to the Internet • Another usage in corporate networks is to restrict connectivity to and from internal networks servicing more sensitive functions, like accounting or personnel department • Firewalls operate at different layers in network • Firewalls that can examine information at more than one layer is more thorough and effective • A firewall that works with layers 2 and 3 does deal with specific users • A firewall at application layer like an application-proxy gateway firewall can enforce user authentication as well as logging events to specific users.

5. Add-ons Supported by Firewalls • NAT, DHCP, encryption for VPNs, and application content filtering • Firewalls support DHCP so as to allocate IP addresses for those systems that will be the subject of firewall's security control and to simplify network management • Firewalls can act as VPN gateways, where the gateway is responsible for encrypting traffic that is leaving its boundary and destined to other systems in the VPN • Active content filtering, firewall is capable of filtering actual application data at layer 7 • For example, scanning email attachments for viruses, filtering out active content in technologies like Java, JavaScript, ActiveX • Can filter on content or key words to restrict access to inappropriate sites or domains.

6. Types of Firewalls • Packet Filters • Stateful Inspection Firewalls • Application-proxy Gateway Firewalls • Dedicated proxy servers • Hybrid Firewalls • Network Address Translation (NAT)

7. Packet Filters

8. Packet Filter Firewalls • Packet filters operate at layer 2/3 of OSI • The basic functionality is designed to provide network access control based on the information at network layer • source address of packet, the IP address from which the packet originated • destination address of the packet, i.e., the IP address where it is going • Type of traffic, i.e., the type of specific network protocol being used to communicate between source and destination • Source and destination ports • Incoming, outgoing interfaces for the packet • filter type of traffic e.g., ICMP traffic the layer 3 protocol is ICMP • Prevent attacks that exploit weaknesses in TCP/IP suite • The access control functionality of a packet filter is decided by a set of directives called as a ruleset

9. Boundary Router • Packet filters also called boundary routers • Packet filter gateways have both speed and flexibility as they examine a limited amount of data, they can operate very quickly • The ability to block attacks, filter unwanted protocol, perform access control, block denial-of-service and related attacks, makes it ideal to be placed at the outermost boundary with an un-trusted network. • E.g., the boundary router accepts packets from un-trusted networks, performs access control according to the policy in place, say, block SNMP, permit HTTP, block ICMP etc. • The boundary router will pass the packets to a more powerful firewall that can perform access control and filtering at higher layers of the OSI stack

10. Boundary Router

11. Sample Packet Filter Ruleset

12. Examining the Rule Set • Some notes on the ruleset • 192.168.1.0 indicates all addresses in the range 102.168.1.0 to 192.168.1.254 (Firewall has interface: 192.168.1.1) • Examines source port, destination port, source address, destination address, basically all information that is necessary for examining the rules in the ruleset • Actions taken are • Accept: firewall passes the packet through the firewall as requested • Deny: drops packet. An error message is returned to the sending system • Discard: drops the packet and does not return an error to the source system • Example • Rule 1 allows any TCP connections from outside • Rule 3 says deny any attempts to connect to firewall from outside • Rule 5, 6 say allow packets going to SMTP (192.168.1.2) and HTTP (192.168.1.3) servers • Last rule is default, if packets don’t match any of the above they are denied

13. Weaknesses • As they don't examine upper-layer data, they cannot prevent attacks that employ application specific vulnerabilities or functions • For example, it cannot block specific application commands: if a packet filter firewall allows a given application, all functions available from that application will be permitted • Logging functionality is limited as packet firewalls work on a small amount of data • Most packet filters do not support advanced user authentication schemes • Vulnerable to attacks and exploits that take advantage of problems within TCP/IP specification and protocol stack, such as IP spoofing • Due to small number of variables used in access control decisions, packet filter firewalls are susceptible to security breaches caused by improper configuration • These firewalls are suitable for high-speed environments where logging and user authentication with network resources are not important

14. Stateful Inspection Firewalls

15. Stateful Inspection Firewalls • Address some functionalities of the TCP layer • Many clients connect to remote systems from high-numbered ports • E.g., client port is >1023 in most cases • Packet filter firewall must allow all communication to happen above this port • Allowing so many ports leaves the network vulnerable • Stateful inspection firewall solves this problem by adding the state information of the relevant TCP connection • Only ports having legitimate TCP connections are allowed • State table is maintained for every connection

16. Sample State Table

17. Application-Proxy Gateway Firewalls

18. Application-proxy Gateway Firewalls • Combine application layer information with lower layer information for filtering purposes • Application proxies take over the routing task of packets from inside and outside the network • If it fails no packets can pass through the firewall • All network packets must traverse the firewall under software control • Each individual application-proxy (proxy agent) interfaces directly with the firewall access control ruleset to determine whether a given traffic should be permitted to transit the firewall • Authentication of each user is possible based on login-password, source address, bio-metrics etc

19. Advantages Over Previous Firewalls • They have more extensive logging capabilities as the entire packet is examined • E.g., malicious commands like su – root from outside can be logged • They allow administrators to enforce the required authentication based on the security policy of the organization • IP spoofing can be detected as the attackers need to know more information such as login and password

20. Typical Proxy Agents

21. Disadvantages • Needing to read entire packet makes these firewalls slow • Not suited for high-bandwidth or real-time applications • Some work is often offloaded to dedicated proxy servers • They are not flexible in supporting new network applications and protocols • They ship with generic support • This can allow malicious traffic to tunnel through these generic application without check

22. Dedicated Proxy Servers • Proxy servers are deployed behind traditional firewalls • Main firewall will accept inbound traffic and forward the traffic to proxy, if that application is handled by proxy • E.g., email proxy server • Proxy servers can also accept outbound traffic from internal systems • Filter or log the traffic accordingly • E.g., HTTP proxy that is behind firewall • Dedicated proxies allow enforcement of user authentication requirements in addition to filtering and logging • Prevent email viruses • Protect web server updates from internal users

23. Email and Content Scanning • Java applet or application filtering (based on digital signature availability) • ActiveX control filtering (same as above) • JavaScript filtering (eliminating cross-site scripting attacks) • Blocking specific Multipurpose Internet Multimedia Extensions types • Virus scanning and removal • Application-specific commands like HTTP “delete” and • User-specific controls, including blocking content types for certain users • Caching of web pages to reduce incoming traffic

24. Sample Proxy Configuration

25. Hybrid Firewall Technologies • Combining basic packet filters with application-proxy gateway firewalls • Combining stateful inspection firewalls with application-proxy functionality to offset weaknesses of existing stateful inspection firewalls

26. Network Address Translation • Two reasons for NAT: • Hiding the real IP addresses in the network prevents many attackers from attacking individual systems • Depletion of IP address space has made NAT necessary for most organizations • Three techniques • Static Address Translation • Hiding Network Address Translation • Port Address Translation

27. Static Address Translation • Every internal IP has a different routable IP (fixed) • Not very frequently used due lack of IPs • Very fast and scalable

28. Sample Table

29. Hiding NAT • All Internal IP addresses share the SAME external IP address • E.g., All systems connecting to Internet through a proxy • For those addresses that need mapping from outside will require their external addresses for efficiency purposes

30. Port Address Translation • Forward inbound connections based on ports • Client port is used to identify connection, unlike NAT where IP address is used to identify connection • Each connection internal connection gets a port from the firewall based on the connection • When response comes from outside, the firewall looks up the destination port and identifies the client

31. Sample PAT Table

32. Other Firewalls • Host-based firewalls in Linux based systems for application servers • Server application is protected better • A separate hardware/software is not necessary • Personal Firewalls to protect PCs • Personal Firewall Appliance for protecting small networks like ISP-client connections etc • Integrates with the following devices, cable modem, routing modules, DHCP servers, hubs, switches, SNMP agents, application-proxy agents

33. DMZ • Created out of a network connecting two firewalls • Specifically, for nodes that should not be put in protected internal networks

34. DMZ