1. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Firewall Kittiphan Techakittiroj engktc@au.ac.th

2. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Firewall Isolate two side of network –trusted & untrusted network Work on higher layer –not physical Hardware/Software http://fbox.vt.edu:10021/T/thalgali/

3. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Characteristic of Firewall Service Control: –TCP/IP e.g. e-mail, ftp, http or UDP dns Direction Control –for web-browsing, the initiate from inside to outside –for web-server, the initiate from outside to inside User Control Behavior Control –spam e-mail Firewall

4. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Firewall cannot protect! Attacks that bypass the firewall –inside network containing dial-in or dial-out Attacks from inside –two employee attack each other Attacks that embedded in seem-to-be-secure message –virus inside the e-mail –trojan horse from the download file Firewall

5. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Category of Firewalls Packet-Filtering –mostly embedded inside the router –transparent Application-Level Gateway –mostly a dedicated computer Circuit-Level Gateway Bastion Host Firewall

6. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Packet Filtering Filter out the prohibit traffic Usually on layer 3 & 4 –IP number: allow & prohibit, source & destination IP –TCP port number: allow & prohibit e.g. #21 for FTP, #23 for telnet, #25 for E-mail (SMTP), #80 for world wide web –Separate Interface Policy e.g From HCNL to BTL, but not from BTL to AUNet Firewall

7. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Packet Filtering cont. Transparent for the allow service Standard Configuration –dual homed: hosting two network card –screening router Firewall http://fbox.vt.edu:10021/T/thalgali/

8. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Application-Level Gateway Proxy server, acts as a relay of application traffic Application Specific –web proxy, telnet proxy Require high computational power Firewall http://fbox.vt.edu:10021/T/thalgali/

9. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Circuit-Level Gateway Look like proxy server, but connection oriented If “A” want to talk to “B”, then “A” open connection to “firewall” and “firewall” open connection to “B”. Firewall http://fbox.vt.edu:10021/T/thalgali/

10. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Bastion Server Server act like a gateway Some server reqiured authentication Can be configured to support the specific security needed. Firewall http://fbox.vt.edu:10021/T/thalgali/

11. Kittiphan Techakittiroj (21/05/58 10:00 น. 21/05/58 10:00 น. 21/05/58 10:00 น.) Reference Books Cyrptography and Network Security by William Stallings (Prentice Hall: 2003) Internet Firewall Tutorial: A White Paper (RPAnetwork: July 2002) Developing Secure Commerce Applications by Online O’Reilly Web Development Courses (http://208.233.153.3/oreilly/security/westnet: 1999) Client/Server Survival Guide by Robert Orfali, Dan Harkey, Jeri Edwards (John Wiley & Sons: 1999)