Firewalls. Content. Location of firewalls Design of firewalls. Definitions. Forwarding. Gateways, routers, firewalls.

Transcription

1 Firewalls INFO Lecture 10 31/03/2009 nfoukia@infoscience.otago.ac.nz Credit: Cameron Kerr : ckerr@cs.otago.ac.nz Definitions Content Gateways, routers, firewalls Location of firewalls Design of firewalls Stateful firewalls Implementing firewalls using IPTables Network Address Translation and Port Forwarding

2 Gateway A very broad term Convert between 2 different types of networks and Protocols SMS/ format gateway VoIP/PSTN: compression/decompression, protocol translation Application Layer specific filter = Application-Level Firewall = Proxy , web Other extended sense is default router = entrance connection point to the open network: Internet Gateway If used to implement a Web Proxy can be enforced by router/firewall If used as filtering solution All outgoing & incoming must go through a mailhub only authorised hosts can be servers All is scanned Attachments: viruses, worms Content: SPAM

3 IP-PSTN Gateway Taken from: Routers Primary purpose is to route packets Determining the best route for the data to travel in order to forwards data between networks Demarcates a broadcast zone or domain Segments networks May demarcate management borders Used to shield the border of networks Security domains Switch where you can, route where you must (cf. INFO334/TELE302) Often firewall/filtering capabilities (Layer 4) (Fig 6.4 from Ref.7 cf. next slide)

4 Border Router Large-grain inspection Block offensive networks from getting inside your network Hide parts of interior network from outside Stop interior hosts from accessing internet directly Force use of web proxy or gateway (cf. previous slides)

5 Demarcation Router Segregate/demarcate parts of the network Creates administrative zones/domains May have a shared router or both parties have a router, and an empty network between them Provides a looking-glass for monitoring the network De-Militarized Zones (DMZ) Small, isolated network positioned bw public and private network = bastion cf. Fig 5.16 and 5.17 Ref. 6, next slides Configure so that public & private access to systems/services Create a different network for public servers Limited number of application for outsiders Internal machines should not trust these machines Ideally, these machines will be independent of internal machines must be strongly protected from outsiders using them for other purpose Don t use same back-end servers for databases, etc.

6

7 Firewalls (Combination of) system(s) enforce boundary between 2 or more networks (Ref.6) In Access Control List (ACL) in router, hardware, software (Linux) Insulate private from public network at different layers Filter traffic at layers 3-4 of OSI model most commonly with IP, TCP, UDP & ICMP Possibly also other layers Content filtering (Layer 7): ex web proxy Deep Packet Inspection Shallow Packet Inspection MAC Address filtering (Layer 2) Owning process/user Two varieties Packet Filtering and Application Firewall/Proxy

8

9 Packet Filtering vs. Application Firewall Application-level Firewall Control access to internal services imposed by administrator as internal host authorized Control from outsider: no proxy = service is blocked Can support strong user authentication and provide detailed logging information Rules are often easier than with packet filtering Host needs special software to access proxy Packet Filtering vs. Application Firewall Packet Filtering Firewall Cheaper could be in router via rules to deny or permit Transparent to users Potential attack depends on number of host to which traffic is permitted Need of authentication support if host access from outside (Internet) Administrator needs to regularly inspect these hosts

10 Firewall: Location Individual hosts commonly have firewall Fast becoming out-of-box configuration Useful for dial-up users, large networks, visitor networks Useful for both servers and clients Can limit based on application/user Useful for both ingress and egress filtering Firewall: Location Can be inside router To implement a finer-grained access policy TCP/UDP ports, ICMP message types, rate limiting Protects against illegitimate packets Packet Filtering firewall/router and SOCKS firewalls/proxies: bw L4 and L7 Clients behind a firewall access exterior servers connect to a SOCKS proxy. Proxy controls the eligibility of the client to access the external server and passes the request on to the server

11 Firewall: Location tradeoffs Place firewall inside of router Routers are faster, better equipped for simple dropping Place in front of infrastructure Beware the filtering rate for high Packet Per Minute (PPM) applications Effect of packet drop Firewalls incur some delay, but it is usually negligible when compared with the Internet Firewalls are not a panacea! ( Cameron!) Firewall: Location Firewall on same machine as router, possibly also proxy Uses Network Address Translation (NAT) to share one public IP address Commonly uses Linux with IPTables (see next slides)

12 Firewall Design Map your network subnets and services, in relation to the firewall and vice versa design your firewall in relation with services and subnets Identify the unidirectional flows going from each subnet to each other and the firewall Number of flows scales poorly, but many simple, all easy to manage, and verification is easier Firewall Design: Flow Map 3 interfaces and 12 flows How scalable is this method? How manageable is this method? How easily can you audit it? Quantity of data/audit log can be a burden

13 Stateful Firewall A stateful ( stateless) firewall tracks connections, making it easier to write rules, and with more closure Connection = (saddr,sport,daddr,dport) At the start of the firewall, we enter a rule to allow/deny packets that are part of, or related to existing connections Further down, we allow the TCP SYN packets for the connections we want Stateful Firewall Some protocols may need to be tracked specially, using data available inside the application layer payload FTP: because requires server to open connection to client UDP is connectionless, so tracking is a little less precise, but still good enough Because of the higher resource requirements for stateful firewall, it may not be suitable for border routers on larger networks

14 LINUX/UNIX Solution Under Linux 2.4+, use of IPTables Previously IPChains (check [9] for the difference) OpenBSD uses PF (Packet Filter + address tranlation) Other BSDs (incl Mac OS) use IPFW (IP Firewall = Free BSD firewall software) [10] All tools are command-line Firewall defined in a script Many front-ends and wrapper scripts are available to make it easier for administrators Packet Filtering Process Think of a firewall as three inverted trees INPUT, OUTPUT and FORWARD Each packet starts at the top of its respective tree Packet is inspected one test at a time Accept or Deny (processing stops) Jump into another rule-set (continue processing) Return from a rule-set (or fall-off a rule-set) Falling-off the tree invokes the default policy for that tree

15 Packet Filtering Process via tree Track Connections Policy and Requirements Set of rules, principles and practices = how security is implemented in organization Educate users, documentation State your Policy Requirements E X A M P L E Hosts on the wireless network may only access SSH on the wired network Otherwise reject

16 From Policy to Pseudo-Code Transform from Policy Requirements to pseudo-code Aim to identify the traffic requirements of each policy and application From Wireless To Wired E X A M P L E Allow SSH To Firewall Allow WWW From Firewall To Outside Allow DNS E X A M P L E Pseudo-Code to Rules Take pseudo-code and transform it into a script with rules using iptables iptables -N FrWless iptables -i eth1 -j FrWless iptables -N FrWlessToWire iptables -A FrWless -o eth0 -j FrWlessToWire iptables -A FrWlessToWire --protocol tcp --syn \! --destination-port ssh -j ACCEPT iptables -A FrWlessToWire -j LOGnDROP...

17 IPTables Conditions Common conditions protocol, source/dest addr/port, input/output interface, state Less common TCP flags, ICMP type and code, MAC source address, packet type (broadcast, etc.) Useful extensions Length, ToS (IPv4 Type of Service), content matching, rate limiting, packet mark (label - DS tag) IPtables Rules The stateful rule: track connection iptables -A FORWARD -m state state ESTABLISHED,RELATED -j ACCEPT Only /16 can use the web server iptables -A xxx --proto tcp --syn --dport 80 -s /16 j ACCEPT Log and Drop: assuming a drop-by-default policy iptables -N LOGnDROP iptables -A LOGnDROP -j LOG --log-prefix LOGnDROP: iptables -A LOGnDROP -j DROP

18 Network Address Translation (NAT) Outgoing packets rewritten (header) so they appear to originate from the NAT gateway Allows to share one public IP address with many devices on internal network with several private addresses Private addresses: 10/8, /16, /12 Tracking of connections Connection = (saddr,sport,daddr,dport) Some protocols need to be specially tracked Incoming connections need to be forwarded (cf. Fig ref. 5: see next slides)

19

20 Source-NAT and IPTables We use the POSTROUTING table, and the SNAT rule POSTROUTING: operate on packets after routing decision SNAT: source NAT DNAT: destination NAT iptables -t nat -A POSTROUTING -o eth1 -j snat for dynamic public addresses, use j masquerade: new IP address from a pool at every connection Don t forget that the NAT does the translation after traversing the firewall, so don t forget to ACCEPT it at some point Destination-NAT and IPTables Assume has a web server, which you want to be made available to the internet Use DNAT based on incoming port number iptables -t nat -A PREROUTING --dport 80 -j DNAT -- to PREROUTING: catch packets through device before routing decision, typically with DNAT AKA Port forwarding, NAPT, Pinholing, Port Address Translation (PAT) (Cisco) After DNAT translation, you must still ACCEPT it through the firewall (see previous slide)

21 References 1. IPTables homepage, including HOWTOs 2. SANS Reading Room firewalls 3. CERT Link at: 4. Cisco PIX 501 Intro Required Reading 5. Linux Network Security: Peter G. Smith 6. Top-Down Network Design: Prescilla Oppenheimer Ed Principles of Information Security: M. E. Whitman & H. J. Mattord Ed Information Security Principles and Practices: M. Merkow & J. Breithaupt 9. iptables-differences.html 10.