Introduction to Networking Firewalls Part 4

Custom Services/Schedules Creating a custom service will allow us to define a new connection with its own type (which is the protocol it will use) as well as the ports used We can also create a schedule that will allow us to apply different rules at different times/days For example, we may want to separate business hours and after-hours and treat them separately

Default Outbound Policy Our default inbound rule (connections coming in from the internet) is to always block any connection unless there is a rule allowing it For our default outbound rule (connections originating from our private network) we can decide whether to allow or block connections without rules This would typically be based on the user’s needs. If they access one or two specific websites for their work, we can block everything and only allow access to those IP addresses. If the users need to access websites in order to perform research or test things, we could allow everything and only block malicious or inappropriate sites

Blocking a Service Here’s an example of blocking a service We can choose what zone the connection starts from and what zone we are attempting to connect to We can choose from a list of predefined services, or create our own We can choose to always block, always allow, or block/allow by schedule We can choose a specific IP or a range for either the source or destination. Alternatively, we can say that this rule applies to all hosts We can also choose whether or not to log when this blocking happens. This can tell us if an employee is trying to access something they shouldn’t, or help us investigate an attack on our system

Rule Priority Note that we could have rules that can’t always be satisfied at the same time, they may contradict each other For example, we may allow access from our network to the IP address 184.76.52.139, and deny access from our network to port 22. What would happen then, if we tried to access 184.76.52.139 through port 22? We’d have to look at their order on this list. Whatever rule is higher would take priority

Blocking Attacks We have the ability to automatically defend against specific types of attacks For example, we can disable responses to ping or any ICMP messages We can set a detection rate for SYN floods. If the firewall detects too many SYN handshake requests, we’ll register it as an attack and respond appropriately, depending on the firewall

MAC Addresses We are able to control our network traffic by MAC addresses as well We can set our firewall so that only certain MAC addresses are permitted, and the rest our blocked, or we can block a few and let the rest through. The former is usually preferred, and definitely more secure We can also set up an IP address - MAC address binding We would do this for when we have a MAC address that always uses the same IP address (for example, with a static IP) This would prevent other devices from joining our network using these addresses illegitimately, trying to get through our firewall

Session Settings Session Settings are another tool we have to prevent attacks on our system We can limit the maximum number of half open sessions to prevent a SYN flood We can also set timeouts for other sessions. This controls how long the network will consider a session open without a reply