Methods to overcome corporate firewall restrictions E. Prokhorenko, RAU, 16/04/07, Yerevan

Introduction Here we will deal with the following idealized network configuration: LAN with Windows based PCs and personal firewalls Corporate firewall to provide Internet access to LAN and defend it.

Main firewall settings Firewall does NAT for LAN requests (some networks may be filtered, others – restricted by traffic) Some ports on firewall are closed for security reasons Some services on LAN (WWW, FTP, etc.) made visible to Internet through the holes on firewall There exists corporate proxy for HTTP, FTP, HTTPS, GOPHER, WAIS, WHOIS protocols (may be transparent) Traffic is logged for billing and security purposes

Additional services for LAN SMTP, POP3, POP3S, IMAP, IMAPS are allowed or firewall itself run E-mail service SSH is allowed (may be for some people only, incoming and outgoing) VPN is allowed TELNET is not allowed X Window is not allowed

All that is not enough! After some time of functioning users find out that this ideal configuration lacks support for many applications, which need to be run to increase users productivity Here is partial list for needed protocols support: REAL AUDIO, ICQ, IMs, IRC, edonkey, kaaza, SKYPE, NEETMEETING and other video/audio conferencing tools.

Standard actions to implement addons For each protocol needed ports must be found and open on the firewall Tests must be run to prove proper configuration Logging for usage of those protocols must be turned on and inspecting regularly All changes on the firewall must be documented

Problems of realization It’s hard to decide which applications must be allowed (consult boss to decide) Many applications don’t work with NAT (can be solved in Linux router with helper modules in the netfilter; alternatively SOCKS proxy can be used) It’s hard to find needed ports for some applications (traffic capturing tools must be used) Sometimes access to prohibited networks must be granted for some applications

Proposed methods for solution Tunnels – universal solution (VPN was already mentioned) Group of tunnels (application patterns) must be created for each application Tunnel software must not work through firewall but have full access to outside with own access list (rinetd – good candidate!) To access prohibited networks dedicated computers outside LAN must be used to create tunnels

Additional activity Authors of poorly written programs must be informed and asked to provide solution for firewall usage in the newer versions Applications templates must be activated on requests of top management for clearly defined time periods In emergency situations all patterns must be switched off with one button script

To the future Comparing to current firewall solutions (hardware routers with 2-3 predefined applications patterns) serious solution must include authorization service and the list of patterns, allowed to be managed by defined group of users. Reports for users must show used resources To link different branches VPNs must be used with LAN oriented applications