Firewall Technology Planning and Implementation Mr. Simon Kwan GPSS company PolyU AIT course trainer Portion of this presentation was adapted from AIT course notes, with kind permission from Dr. C K Leung of the Hong Kong Polytechnic University. Our greatest thanks shall be with Dr. C K Li of EIE, PolyU/HKIE for his kind assistance and technical advises. Our ultimate thanks goes to HKIE for hosting this section of the seminar. Dr. C.K. Leung & Simon Kwan AIT Module D

Background The Internet was designed without much security consideration The IP header information, TCP header information, routing information … etc. are usually accepted “as is” Dr. C.K. Leung & Simon Kwan AIT Module D

CERT Information CERT: www.cert.org, Computer Emergency Response Team (an USA official organization): Security is a major concern of organizations connected to the Internet The FBI estimates annual losses of US$7.5 billion due to electronic attack US DoD: 88% of their computers can be penetrated 96% of hacker attacks are undetected Dr. C.K. Leung & Simon Kwan AIT Module D

What is a Firewall? A ‘Security Guard’ standing at out front door Servers Firewall Internet Workstations Dr. C.K. Leung & Simon Kwan AIT Module D

What does a Firewall do? A firewall consists of the following components or capabilities: Packet filtering VPN (Virtual Private network) Traffic Shaping (bandwidth management) Content Filtering and Broadband Access sharing Automatic intrusion detection, logging and reporting Dr. C.K. Leung & Simon Kwan AIT Module D

Acquiring a Firewall Old PC running Linux Little hardware cost Need in-house Linux expertise As part of a new Linux file server Nowadays 240G Bytes Linux server can be setup cheaply Standalone hardware firewalls can offer more functionalities and security Dr. C.K. Leung & Simon Kwan AIT Module D

Management of Firewalls Firewalls need to be setup properly A simple firewall can take 5 seconds to setup Proper setup by a properly trained professional may take many hours There are Firewall training courses that take several weeks, full-time Dr. C.K. Leung & Simon Kwan AIT Module D

Packet Filtering Firewall An important countermeasure to guard against hacking of school servers Packet filter Good packet Internet Pass Bad packet drop Dr. C.K. Leung & Simon Kwan AIT Module D

Packet Filtering Principle Packets are inspected as they arrive at the firewall The final result on the packet will be: Accept Deny / Reject Dr. C.K. Leung & Simon Kwan AIT Module D

Firewall Policy ---Easy or Hard There can be two default policies for packet filtering Accept All Deny / Reject All Dr. C.K. Leung & Simon Kwan AIT Module D

Accept By Default Packet Enters Accept Packet yes Satisfy Rule 1? Accept or Deny packet no Satisfy Rule 2? yes Accept or Deny packet Accept or Deny packet Satisfy Rule n? yes Accept or Deny packet Accept Packet Dr. C.K. Leung & Simon Kwan AIT Module D

Deny By Default Packet Enters Deny Packet yes Satisfy Rule 1? Accept or Deny packet no Satisfy Rule 2? yes Accept or Deny packet Accept or Deny packet Satisfy Rule n? yes Accept or Deny packet Deny Packet Dr. C.K. Leung & Simon Kwan AIT Module D

Packet Information The most common information to be inspected about a packet are: IP Header – Source and Destination addresses; protocol TCP/UDP Header – Source and destination ports ICMP - type Dr. C.K. Leung & Simon Kwan AIT Module D

Direction of Packet Movement Individual Accept/Deny rules for data moving into and leaving the computer Accept from any SA, TCP:80 Deny all other Internet Firewall Send to any DA, TCP<>80 Deny all other Dr. C.K. Leung & Simon Kwan AIT Module D

Web Server Service Dr. C.K. Leung & Simon Kwan AIT Module D Operation Protocol Remote Address Remote Port In/Out Local Address Local Port TCP Flag Local Client Request TCP Any (not local) 80 Out Local 102465535 Any Remote server response In Remote client request Web client Local server response Ack Dr. C.K. Leung & Simon Kwan AIT Module D

Stateful Packet Filter Basic filters only inspect individual packet Advanced Stateful packet filter will be able to “remember” what has happened before and is capable of performing more complex operations Operations are checked to see if they are happening in sequences Dr. C.K. Leung & Simon Kwan AIT Module D

VPN (Virtual Private Network) Building a ‘Secured Tunnel’ between your school server and teachers’ home PCs VPN Server (included with firewall) Windows VPN Client software (free of charge) Server Home PC Internet Dr. C.K. Leung & Simon Kwan AIT Module D

VPN (Virtual Private Network) Building a ‘Secured Tunnel’ between remote servers (of the same administration group) Server VPN Server VPN Server Server Internet Dr. C.K. Leung & Simon Kwan AIT Module D

Traffic Shaping Different priority can be assigned to different network services WEB browsing can be given a higher priority than FTP WEB browsing will not be slowed down by FTP Dr. C.K. Leung & Simon Kwan AIT Module D

Content Management Sharing of broadband access By ‘black listing’ the IP address of a particular site, all forms of communication with our network are prohibited Many firewalls also have facilities that help the sharing of a broadband access NAT DHCP PPPoE PAP/CHAP/MS CHAP V2 IPSec ESP MD5 SHA1 DES 3DES IKE Dr. C.K. Leung & Simon Kwan AIT Module D

Maintenance of Firewalls The world is constantly changing Firewalls need to be kept up-to-date over their life time Some companies provides subscription management services similar to that of anti-virus services Dr. C.K. Leung & Simon Kwan AIT Module D

Setting up of a standalone Firewall Dr. C.K. Leung & Simon Kwan AIT Module D

Dr. C.K. Leung & Simon Kwan AIT Module D

Dr. C.K. Leung & Simon Kwan AIT Module D

Setting up of Linux Firewall Dr. C.K. Leung & Simon Kwan AIT Module D

Setting up of Windows VPN Dr. C.K. Leung & Simon Kwan AIT Module D

Setting up if IPSec VPN Dr. C.K. Leung & Simon Kwan AIT Module D

Seek Professional Help “Just buying a lock” will not help to reduce crime rate --- good security requires: Evaluation Planning Implementation REMEMBER FIREWALLS NEED TO BE SETUP PROPERLY BEFORE THEY CAN BE HELPFUL Dr. C.K. Leung & Simon Kwan AIT Module D

Firewall Technology Planning and Implementation Mr. Simon Kwan GPSS company PolyU AIT course trainer Dr. C.K. Leung & Simon Kwan AIT Module D

Many Thanks Dr. C.K. Leung & Simon Kwan AIT Module D