Firewalls: General Principles & Configuration (in Linux) Bruhadeshwar Bezawada International Institute of Information Technology, Hyderabad

Overview General Principles of Firewalls Types Issues in design and deployment Rules, conflicts and performance issues Configuration IPTables IPChains

Relevant OSI Layers for Firewall Operation

General Principles of Firewalls Network firewalls are devices or systems that control the flow of network traffic between networks employing different security postures One usage is to limit/control connectivity to the Internet Another usage in corporate networks is to restrict connectivity to and from internal networks servicing more sensitive functions, like accounting or personnel department Firewalls operate at different layers in network Firewalls that can examine information at more than one layer is more thorough and effective A firewall that works with layers 2 and 3 does deal with specific users A firewall at application layer like an application-proxy gateway firewall can enforce user authentication as well as logging events to specific users.

Add-ons Supported by Firewalls NAT, DHCP, encryption for VPNs, and application content filtering Firewalls support DHCP so as to allocate IP addresses for those systems that will be the subject of firewall's security control and to simplify network management Firewalls can act as VPN gateways, where the gateway is responsible for encrypting traffic that is leaving its boundary and destined to other systems in the VPN Active content filtering, firewall is capable of filtering actual application data at layer 7 For example, scanning email attachments for viruses, filtering out active content in technologies like Java, JavaScript, ActiveX Can filter on content or key words to restrict access to inappropriate sites or domains.

Types of Firewalls Packet Filters Stateful Inspection Firewalls Application-proxy Gateway Firewalls Dedicated proxy servers Hybrid Firewalls Network Address Translation (NAT)

Packet Filters

Packet Filter Firewalls Packet filters operate at layer 2/3 of OSI The basic functionality is designed to provide network access control based on the information at network layer source address of packet, the IP address from which the packet originated destination address of the packet, i.e., the IP address where it is going Type of traffic, i.e., the type of specific network protocol being used to communicate between source and destination Source and destination ports Incoming, outgoing interfaces for the packet filter type of traffic e.g., ICMP traffic the layer 3 protocol is ICMP Prevent attacks that exploit weaknesses in TCP/IP suite The access control functionality of a packet filter is decided by a set of directives called as a ruleset

Boundary Router Packet filters also called boundary routers Packet filter gateways have both speed and flexibility as they examine a limited amount of data, they can operate very quickly The ability to block attacks, filter unwanted protocol, perform access control, block denial-of-service and related attacks, makes it ideal to be placed at the outermost boundary with an un-trusted network. E.g., the boundary router accepts packets from un-trusted networks, performs access control according to the policy in place, say, block SNMP, permit HTTP, block ICMP etc. The boundary router will pass the packets to a more powerful firewall that can perform access control and filtering at higher layers of the OSI stack

Boundary Router

Sample Packet Filter Ruleset

Examining the Rule Set Some notes on the ruleset Actions taken are 192.168.1.0 indicates all addresses in the range 102.168.1.0 to 192.168.1.254 (Firewall has interface: 192.168.1.1) Examines source port, destination port, source address, destination address, basically all information that is necessary for examining the rules in the ruleset Actions taken are Accept: firewall passes the packet through the firewall as requested Deny: drops packet. An error message is returned to the sending system Discard: drops the packet and does not return an error to the source system Example Rule 1 allows any TCP connections from outside Rule 3 says deny any attempts to connect to firewall from outside Rule 5, 6 say allow packets going to SMTP (192.168.1.2) and HTTP (192.168.1.3) servers Last rule is default, if packets don’t match any of the above they are denied

Weaknesses As they don't examine upper-layer data, they cannot prevent attacks that employ application specific vulnerabilities or functions For example, it cannot block specific application commands: if a packet filter firewall allows a given application, all functions available from that application will be permitted Logging functionality is limited as packet firewalls work on a small amount of data Most packet filters do not support advanced user authentication schemes Vulnerable to attacks and exploits that take advantage of problems within TCP/IP specification and protocol stack, such as IP spoofing Due to small number of variables used in access control decisions, packet filter firewalls are susceptible to security breaches caused by improper configuration These firewalls are suitable for high-speed environments where logging and user authentication with network resources are not important

Stateful Inspection Firewalls

Stateful Inspection Firewalls Address some functionalities of the TCP layer Many clients connect to remote systems from high-numbered ports E.g., client port is >1023 in most cases Packet filter firewall must allow all communication to happen above this port Allowing so many ports leaves the network vulnerable Stateful inspection firewall solves this problem by adding the state information of the relevant TCP connection Only ports having legitimate TCP connections are allowed State table is maintained for every connection

Sample State Table

Application-Proxy Gateway Firewalls

Application-proxy Gateway Firewalls Combine application layer information with lower layer information for filtering purposes Application proxies take over the routing task of packets from inside and outside the network If it fails no packets can pass through the firewall All network packets must traverse the firewall under software control Each individual application-proxy (proxy agent) interfaces directly with the firewall access control ruleset to determine whether a given traffic should be permitted to transit the firewall Authentication of each user is possible based on login-password, source address, bio-metrics etc

Advantages Over Previous Firewalls They have more extensive logging capabilities as the entire packet is examined E.g., malicious commands like su – root from outside can be logged They allow administrators to enforce the required authentication based on the security policy of the organization IP spoofing can be detected as the attackers need to know more information such as login and password

Typical Proxy Agents

Disadvantages Needing to read entire packet makes these firewalls slow Not suited for high-bandwidth or real-time applications Some work is often offloaded to dedicated proxy servers They are not flexible in supporting new network applications and protocols They ship with generic support This can allow malicious traffic to tunnel through these generic application without check

Dedicated Proxy Servers Proxy servers are deployed behind traditional firewalls Main firewall will accept inbound traffic and forward the traffic to proxy, if that application is handled by proxy E.g., email proxy server Proxy servers can also accept outbound traffic from internal systems Filter or log the traffic accordingly E.g., HTTP proxy that is behind firewall Dedicated proxies allow enforcement of user authentication requirements in addition to filtering and logging Prevent email viruses Protect web server updates from internal users

Email and Content Scanning Java applet or application filtering (based on digital signature availability) ActiveX control filtering (same as above) JavaScript filtering (eliminating cross-site scripting attacks) Blocking specific Multipurpose Internet Multimedia Extensions types Virus scanning and removal Application-specific commands like HTTP “delete” and User-specific controls, including blocking content types for certain users Caching of web pages to reduce incoming traffic

Sample Proxy Configuration

Hybrid Firewall Technologies Combining basic packet filters with application-proxy gateway firewalls Combining stateful inspection firewalls with application-proxy functionality to offset weaknesses of existing stateful inspection firewalls

Network Address Translation Two reasons for NAT: Hiding the real IP addresses in the network prevents many attackers from attacking individual systems Depletion of IP address space has made NAT necessary for most organizations Three techniques Static Address Translation Hiding Network Address Translation Port Address Translation

Static Address Translation Every internal IP has a different routable IP (fixed) Not very frequently used due lack of IPs Very fast and scalable

Sample Table

Hiding NAT All Internal IP addresses share the SAME external IP address E.g., All systems connecting to Internet through a proxy For those addresses that need mapping from outside will require their external addresses for efficiency purposes

Port Address Translation Forward inbound connections based on ports Client port is used to identify connection, unlike NAT where IP address is used to identify connection Each connection internal connection gets a port from the firewall based on the connection When response comes from outside, the firewall looks up the destination port and identifies the client

Sample PAT Table

Other Firewalls Host-based firewalls in Linux based systems for application servers Server application is protected better A separate hardware/software is not necessary Personal Firewalls to protect PCs Personal Firewall Appliance for protecting small networks like ISP-client connections etc Integrates with the following devices, cable modem, routing modules, DHCP servers, hubs, switches, SNMP agents, application-proxy agents

DMZ Created out of a network connecting two firewalls Specifically, for nodes that should not be put in protected internal networks

DMZ