Controlling access with packet filters and firewalls

Security vulnarabilities of the TCP/IP protocols IP packets are transmitted in the clear and without authentication facilities Can routers trust routing updates received from others? TCP and UDP segments are transmitted in clear and without authentication facilities Auxiliary protocols have similar problems (ICMP, DNS, ARP, BOOTP, TFTP) Application protocols are without protection or use weak password protection (TELNET, FTP) Specific protection applied as “add ons” (NFS, SNMP, X11)

Methods of access control Physical protection of entities (devices, cables) Packet Filter Network Relay Firewalls –visible –invisible Security mechanisms of individual computers or applications („personal firewall“, „personal internet security“, security, telebanking)

Physical security Protection against physical access to power distribution or network cables Protection of internal or external access points (distributors, patch panels) Protection of active devices (routers, bridges) against physical access (lock them up) Problems: How to support mobile users How to protect a wireless infrastructure How to allow secure access to external resources

Access control using packet filters Operates primarily on IP layer, however also peeking into transport layer information Filtering based on –IP address of the source –IP address of the receiver –Port number of receiver –Sometimes port number of the source –Type of transport protocol used (TCP/UDP) Uses set of filter rules Pure packet filters do not have information on connection states

Filter rules RuleSourceDestinationAction A / /24Permit B / /16Deny C / /0Deny PF

Access control using network relay Monitoring and controlling host Router External connections Internal connections Invisible private subnet Configuration and logging database

Access control by visible firewall Users use the Internet exclusively from the firewall All users need to have a user account on the firewall The firewall terminates DNS, , http User authentication must be secure (with cryptographic means)  Reduced user friendliness

Access control by invisible firewall Termination of all store-and-forward services (DNS, ) with servers on the firewall Selective forwarding of connections (stateful) Authentication of external and internal peers Logging and intrusion detection Network Address Translation Proxy functions InternetFirewall 1 Firewall 2 Protected internal network DNSDNS (DMZ – „de-militarized zone“) public servers DNSDNS Variant 1

Access control by invisible firewall (Variant 2) Uses only one physical firewall unit Internet Protected internal network DNSDNS (DMZ – „de-militarized zone“) public servers DNSDNS Ruleset 1 Ruleset 2 Firewall

User or application is “proxy aware” Internet Explorer Netscape Navigator

Proxy-based firewall services

Some applications are not “proxy aware” talk, ping, … Specific implementation of such applications Offering replacement applications Such appliations may also not be accessible to normal users at all

Literature B. Chapman, E. Zwicky, “Building Internet Firewalls”, O’Reilly & Associates, 1995 W. Cheswick, S. Bellovin, „Firewalls and Internet Security“, Addison-Wesley, 1994