1 An Introduction to Internet Firewalls Dr. Rocky K. C. Chang 12 April 2007

2 Rocky K. C. Chang 1. Components of a firewall: Packet filtering  A firewall today uses a combination of packet filtering and proxy services.  Screening router: It performs packet filtering based on the source and destination addresses, types of packets, TCP/UDP ports, etc. For example, it blocks all incoming connections except for incoming SMTP connections, or it blocks all connections to and from certain systems you distrust.  The principle of default deny stance is usually employed for packet filtering: That which is not expressly permitted is prohibited.

3 Rocky K. C. Chang 1.1 Components of a firewall: Proxies  With an intermediate proxy, an TCP connection is broken into two and the proxy is responsible for splicing them.  An UDP association, similarly, consists of two separate UDP associations. Proxy TCP connection TCP

4 Rocky K. C. Chang 1.1 Components of a firewall: Proxies  Transport-level proxies: Proxies that do not understand particular application protocols, e.g., SOCKS. For example, a SOCKS proxy only allows users inside the firewall to open TCP connections, and refuses to accept connection requests from outside.  Application-level proxies: Proxies that understand particular application protocols, e.g., telnet, ftp, http proxies. For example, a FTP proxy may refuse to let users export files, or may allows users to import files only from certain sites.  The proxies are usually run on a bastion host, which is a highly secured system.

5 Rocky K. C. Chang 1.2 Stateful inspection by Checkpoint  Unlike application proxies, stateful inspection does not break an TCP connection or an UDP association.  Unlike transport-level proxies, stateful inspection understands application protocols.  Stateful inspection, however, is not a proxy technology, and it intercepts packets at the network layer and then the INSPECT engine takes over. The engine extracts “state-related information” required for the security decision from all application layers. It maintains this information in dynamic state tables for evaluating subsequent connection attempts. For example, establishing a FTP back connection.

6 Rocky K. C. Chang 2. Screened host firewall architecture  This architecture consists of a separate bastion host and a screening router.  For the incoming connectivity, the packet filter is set up in such a way that the bastion host is the only system on the internal network that hosts outside can communicate with.  For the outgoing connectivity, the packet filter permits the bastion host to open allowable connections to the outside world. For other internal hosts, the packet filter may allow them to open connections to outside for certain services or disallow all connections from internal hosts (forcing them to use proxy services via the bastion host).  The zone of risk is restricted to the screening router and the bastion host.

7 Rocky K. C. Chang 2. Screened host firewall architecture

8 Rocky K. C. Chang 3. Screened subnet firewall architecture  This architecture adds an extra layer of security to the screened host architecture by adding a perimeter network. A perimeter network lies between an external network and a protected network, sometimes called a De- Militarized Zone (DMZ). By isolating the bastion host on a perimeter network, the impact of a break-in on the bastion host is significantly reduced.  A simple design is to have a single perimeter network with two screening routers (exterior and interior). It is also possible to create a layered series of perimeter nets. Less trusted and more vulnerable services are placed on the outer perimeter nets.

9 Rocky K. C. Chang 3. Screened subnet firewall architecture  The interior router does most of the packet filtering. It allows selected services outbound from the internal net to the Internet. The services between the bastion host and internal hosts may also be limited to services that are actually needed, e.g., SMTP and DNS, and limited to certain hosts, e.g., SMTP mail servers.  The exterior router may block any incoming packets that have forged source addresses.  Other variations: Use different bastion hosts for different services. Merge the interior router and the exterior router.

10 Rocky K. C. Chang 3. Screened subnet firewall architecture

11 Rocky K. C. Chang 4. Packet filtering  A screening router parses the headers of incoming packets and then apply rules from a simple rule base to determine whether to route or drop the packet. The filtering rules are generally expressed as a table of conditions and actions that are applied in a certain order until a decision is reached.  For example, consider a network employs a policy to allow all incoming packets destined to its mail server , Except for a malicious IP address

12 Rocky K. C. Chang A packet filtering example  Rule A: Permit all incoming SMTP packets destined to the mail server.  Rule B: Deny incoming packets from the malicious IP address.  Rule C: Permit any outgoing packets.  Rule D: Permit any incoming or going packets. Firewall Internal network Internet 0 1

13 Rocky K. C. Chang A consistent problem  Rules A and B are in conflict: A malicious packet matches to both rules A and B, but have different decisions.  In other words, the decision for a malicious packet is rule-order dependent. A rule cannot be understood by its literal meaning. The rule B should be “discard all non-SMTP packets originated from ”  Swap rules A and B.

14 Rocky K. C. Chang A completeness problem  The set of rules should ensure that all possible packets are considered, i.e., matched to at least a rule.  Rule D says that non-SMTP packets from all, except the known malicious IP, are allowed to reach the mail server.  Two new rules added after rule A.

15 Rocky K. C. Chang A compactness problem  A rule in a firewall is redundant iff removing the rule does not change the firewall’s function. That is, it does not change the decision of the firewall for every packet.  A firewall is compact iff it does not have redundant rules.  Rule C is redundant Rules C and D have the same decision if a packet does not match rules A and B.

16 Rocky K. C. Chang 4.3 Dynamic packet filtering  Compared with TCP, it is much more difficult to filter UDP packets. There are no state information to rely on for keeping track of the connection’s status.  However, some firewalls modify filtering rules on the fly. The firewalls remember outgoing UDP packets that they have seen, and then allow only the corresponding response packets back in through the filtering mechanism. Those rules modified on the fly are time- limited; they time out after a few seconds or minutes.

17 Rocky K. C. Chang 4.3 Dynamic packet filtering

18 Rocky K. C. Chang 5. SOCKS: A generic proxy  SOCKS is a session/transport layer proxy, providing a generic mechanism for IP to traverse a firewall. SOCKS provides relay services for UDP and TCP traffic with network and port translation. SOCKS usually allows only TCP connections and UDP packet transmissions initiated from inside. SOCKS provides a single platform integrating other security mechanisms, e.g., user-level authentication (from user password to IPSec), encryption methods, key management systems, etc.  A TCP/UDP data connection is initiated by a SOCKS server to the remote server on behalf of the actual client.

19 Rocky K. C. Chang 5.1 Socksified clients  A client needs to be “socksified” in order to use the proxy service. Socksification of a client creates a thin SOCKS layer between the application and transport layers. A proxy client resides in that layer to communicate with a proxy server.  There are two ways to socksify a client: The first one requires compiling and relinking the applications. The second is to perform dynamic library linking.  A socksified client intercepts a socket call, and if the local policy is allowed, it will redirect the call to the proxy server.

20 Rocky K. C. Chang 5.2 SOCKS’ transport model  The SOCKS protocol exchange between a server and a client consists of two phases: Proxy establishment and data relay. In the first phase, user authentication and other option negotiation are performed in the control channel. In the second phase, the data packets are relayed between the SOCKS client and SOCKS server.  SOCKS supports both TCP and UDP data transmissions. SOCKS uses an in-band transport model for TCP data. SOCKS uses an out-of-band transport model for UDP data.

21 Rocky K. C. Chang 5.2 SOCKS’ transport model

22 Rocky K. C. Chang Acknowledgements  The slides on the firewalls are based on E. Zwicky, S. Cooper, and D. Chapman, Building Internet Firewalls, Second Edition, O’Reilly & Associates, Inc.,  The SMTP filtering example is based on M. Gouda and A. Liu, “Firewall design: Consistency, Completeness, and Compactness,” Proc. IEEE ICDCS, 2004.