Network and System Security Risk Assessment Firewall

Review Last week, we have talked about sniffer and firewall Sometimes, sniffer can sniff users’ private information http, telnet…. Wireshark sniffing on the network Firewall can control a computer/network communication Iptables, ufw

Review Stateful firewall Traditional: to allow outgoing website visiting and to drop other communication To allow input tcp with source port 80 and ack Can’t visit websites on ports other than 80 To use stateful firewall State tracking sudo iptables -A OUTPUT -p tcp --dport 80 -j DROP sudo iptables -A INPUT -p udp -j ACCEPT (DNS) sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A INPUT -p tcp --sport 80 --tcp-flags SYN,ACK,RST,FIN ACK -j ACCEPT

Practice Iptables Examples Prevent a machine from telneting to other machines Prevent a telnet server from being connected by other machines Prevent inner network from connecting a social network 1.2.3.4 iptables -A OUTPUT -p tcp --dport 23 -j DROP Iptables –A INPUT –p tcp –dport 23 –j DROP Iptables –A INPUT –p tcp –d 1.2.3.4 –j DROP

Practice Iptables examples Disable to be pinged, enable to ping To limit the number of pings To change the source IP of a ping packet sent out from our machine sudo iptables -A INPUT -p icmp --icmp-type 8 -j DROP iptables -P INPUT DROP iptables -A INPUT -I eth0 -p icmp -m state --state ESTABLISH,RELATED -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/min --limit-burst 8 -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-request -j DROP sudo iptables -t nat -A POSTROUTING -p icmp --icmp-type 8 -j SNAT --to-source 192.168.137.131

Practice Allow outgoing web access; Disable all other communication iptables –A INPUT –p tcp –sport 80 –j ACCEPT Problem?

Practice Iptables example To act as a firewall (protect inner network) To enable packet forward Find /etc/sysctl.conf sudo sysctl –p /etc/sysctl.conf to redirect the input packet to a specific website To change the source and dst to change the reply packet to a specific source and port sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 202.38.64.3:80 iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.200:80 Iptables –t nat –A PREROUTING –p tcp –dport 8123 –j DNAT –to 192.168.141.235:80 sudo iptables -t nat -A PREROUTING -p tcp --dport 8123 -j DNAT --to 192.168.141.235:80 sudo iptables -t nat -A POSTROUTING -p tcp -s 192.168.141.1 -j SNAT --to 192.168.141.226 sudo iptables -t nat -A PREROUTING -p tcp -s 192.168.141.235 --sport 80 -j DNAT --to 192.168.141.1 sudo iptables -t nat -A POSTROUTING -p tcp -s 192.168.141.235 --sport 80 -j SNAT --to 192.168.141.226:8123

Practice Iptables example To stop conntrack sudo iptables -t raw -A OUTPUT -j NOTRACK sudo iptables -t raw -A PREROUTING -j NOTRACK

Practice Iptables example To act as a firewall (protect inner network) To enable packet forward Change the .1 machine to the firewall itself sudo iptables -t nat -A PREROUTING -p tcp --dport 8123 -j DNAT --to 192.168.141.235:80 sudo iptables -t nat -A POSTROUTING -p tcp -s 192.168.141.1 -j SNAT --to 192.168.141.226 sudo iptables -t nat -A PREROUTING -p tcp -s 192.168.141.235 --sport 80 -j DNAT --to 192.168.141.1 sudo iptables -t nat -A POSTROUTING -p tcp -s 192.168.141.235 --sport 80 -j SNAT --to 192.168.141.226:8123 sudo iptables -t nat -A OUTPUT -p tcp --dport 8123 -j DNAT --to 192.168.141.235:80

Practice Iptables example To disable traffic To enable ftp Must enable ip_conntrack_ftp Modprobe ip_conntrack_ftp You should use ESTABLISHED and RELATED at the same time. Otherwise, either the command or the data connection can’t be established.

Practice Iptables example the secure version of telnet: ssh Besides encryption, ssh has another function: port forwarding Using ssh port forwarding, firewall rules can be bypassed sudo iptables -A INPUT -i lo -j ACCEPT Sudo iptables –t nat –A OUTPUT –p tcp –dport 21 –j DEDIRECT –to-ports 7001

SSH服务器拥有一项服务，SSH客户端电脑希望能够使用。但是SSH服务器限定为仅有本机可以使用这种服务。 使用了端口转发之后，TCP 端口 A 与 B 之间现在并不直接通讯，而是转发到了 SSH 客户端及服务端来通讯，从而自动实现了数据加密并同时绕过了防火墙的限制

Practice Iptables example ftp server: only allows localhost ftp service Also demonstrate ftp data and control connections On the server, ftp is blocked On the client, we try to do ssh port forwarding sudo iptables -t nat -A OUTPUT -p tcp --dport 21 -j DNAT --to-destination 127.0.0.1:7002 ssh -L 7002:localhost:21 guoyan@192.168.137.151

Practice Iptables example Support squid to act as a web proxy iptables -t nat -A PREROUTING  -p tcp --dport 80 -j REDIRECT --to-ports 3128 iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-ports 3128