Member Names: ECE4883 Lab 8 Fall 2003 Firewalls

Transcription

1 Member Names: Group Number: ECE4883 Lab 8 Fall 2003 Firewalls Version: March 1, 2004 Date Issued: March 2, 2004 Due Date: March 16, 2004 This lab is divided into two major portions. The first part explores the Linux firewall implementation in the form of the iptables program. In part two, you will configure a Cisco PIX 15E firewall for a particular network structure. Both portions of the lab are substantial and it will take a good amount of time to complete this lab. Therefore it is recommended that you start early. Note: Both portions of the lab require you to reserve a slot to use the equipment. The signup sheets will be posted on the lab door. Since the two portions are separate from each other, you can do either part first. Part 1 Linux Firewalls In this section of the lab you will explore the Linux firewall iptables. The initial sections give an overview of basic firewall concepts with exercises and examples. In the later sections, you will implement all the rules in the iptables.firewall file available from the Lab8 directory on the NAS server. The effects of these rules are to be examined. Lab Setup A couple of Firewall stations have been setup for you in the lab. The virtual machine network structure on these stations is shown below. Basically, the virtual machines have been setup with host only networking. So any traffic they send or receive goes through the Host machine, which also acts like the Firewall. This network structure mimics the network structures of the real world where a firewall sits between the inside and the outside networks. Since we are only trying to show you the capabilities of the ipchains program, only two machines are sufficient. 1

2 Figure 1-1. Network structure on the Firewall machines System Setup Protected: A normal Linux virtual machine with IP , netmask , and gateway The gateway is a virtual interface on the host machine which acts like a router and firewall. This is the machine that is on the inside network and needs to be protected with the firewall. Linux Firewall: RedHat 8.0 base system that is configured to act like a router and runs a firewall with ipchains. It forwards packets received on its two virtual interfaces (vmnet1 and vmnet2) to the intended destinations. You will make firewall rules on this machine to protect the inside network. BlackHat: Same configuration as the Protected machine. IP address is and gateway is , which is the virtual interface vmnet2 on the host machine. This is the machine where you will try to attack the protected machine from. Note: All the root passwords for these machines have been set to password. Setting up routing and iptables Some of the information given in this section will be only be clear and useful later on when you actually use iptables. The executable binary for the iptables application is the /sbin/iptables file. So when execute iptables this is the file that is executed. RedHat also has an executable script in the /etc/init.d/iptables file so that it can start its default firewall at startup. An easy way to reset the firewall rules is to use this script as /etc/rc.d/init.d/iptables stop This flushes all the rules in memory and gives you a clean start. 2

3 You can flush individual rules with iptables F flushes all chains iptables X <chain name> deletes a chain iptables X deletes all chains To check if there are any current rules, type iptables L It ll show you a couple of chains, but there won t be any rules in them. You might have to do /etc/init.d/iptables restart to apply these changes. The /root/fresh_iptables directory contains a file called iptables.firewall file. This file contains all of the firewall rules we will use in this lab. The contents of this file are included in Appendix 1-A so you may follow the lab discussion in that file. You can execute this file to enable all the rules at once by executing it. Don t execute it yet. Now go to the root directory (~/) and make a directory with your group name. Copy both the files from the /root/fresh_iptables directory to your directory. Make sure that whenever you edit the files, you are doing it in your own group directory. Later in the lab, every time you need to restart the firewall with your rules, you can use the following commands: /etc/rc.d/init.d/iptables stop./iptables.firewall (in the directory with your edited iptables.firewall file) To enable packet forwarding on the Firewall machine, the line below needs to be executed. echo 1 > /proc/sys/net/ipv4/ip_forward This has already been done for you. However, make sure you have a 1 in the file specified, by typing cat /proc/sys/net/ipv4/ip_forward Now see if you can ping the firewall from the BlackHat machine. Also check whether you can ping the protected machine from this machine. You should be able to ping both Background Only you can protect your system.. Firewalls have become one of the most popular ways to help secure a network. A firewall is hardware, software, or a combination of the two that prevents unauthorized access to or from a private network. Think of it as Internet customs and immigration. The firewall is the agent that checks each item entering or leaving the network. Each item must pass the right criteria in order to make it through. So a hacker attempting to enter the network of California with a Florida orange would be stopped at the border. Firewalls use one or more of three methods to control traffic flowing in and out of the network: Packet filtering - Packets (small chunks of data) are analyzed against a set of filters. Packets that make it through the filters are sent to the requesting system and all others are discarded. Proxy service - Information from the Internet is retrieved by the firewall and then sent to the requesting system and vice versa. 3

4 Stateful inspection - A newer method that doesn't examine the contents of each packet but instead compares certain key parts of the packet to a database of trusted information. Information traveling from inside the firewall to the outside is monitored for specific defining characteristics, then incoming information is compared to these characteristics. If the comparison yields a reasonable match, the information is allowed through. Otherwise it is discarded. Exercise 1 No firewall functionality running From the BlackHat machine, use nmap to scan the Linux Machine behind the firewall. You can use the graphical interface for nmap with these options: SCAN -> SYN Stealth DISCOVER -> Don t Ping OPTIONS -> Don t resolve Fast Scan You can also use the command line with nmap ss P0 n F <Protected Linux Machine IP> Write down which ports are open: Firewall Configuration Firewalls are customizable. This means that you can add or remove filters based on several conditions. Some of these are: IP addresses Domain names Protocols -! IP (Internet Protocol) - the main delivery system for information over the Internet! TCP (Transport Control Protocol) - used to break apart and rebuild information that travels over the Internet! HTTP (Hyper Text Transfer Protocol) - used for Web pages! FTP (File Transfer Protocol) - used to download and upload files! UDP (User Datagram Protocol) - used for information that requires no response, such as streaming audio and video! ICMP (Internet Control Message Protocol) - used by a router to exchange the information with other routers! SMTP (Simple Mail Transport Protocol) - used to send text-based information ( ) 4

5 ! SNMP (Simple Network Management Protocol) - used to collect system information from a remote computer! Telnet - used to perform commands on a remote computer Ports Specific words and phrases - This can be anything. The firewall will sniff (search through) each packet of information for an exact match of the text listed in the filter. For example, you could instruct the firewall to block any packet with the word "X-rated" in it. The key here is that it has to be an exact match. The "X-rated" filter would not catch "X rated" (no hyphen). But you can include as many words, phrases and variations of them as you need. A software firewall, such as ZoneAlarm, can be installed on the computer in your home that has an Internet connection. This computer is considered a gateway because it provides the only point of access between your home network and the Internet. With a hardware firewall, the firewall unit itself is normally the gateway. A good example is the Linksys Cable/DSL router. It has a built-in Ethernet card and hub. Computers in your home network connect to the router, which in turn is connected to either a cable or DSL modem. You configure the router via a Web-based interface that you reach through the browser on your computer. You can then set any filters or additional information. Hardware firewalls are incredibly secure and not very expensive. Home versions that include a router, firewall, and Ethernet hub for broadband connections can be found for well under $ What It Protects You From: There are many creative ways that unscrupulous people use to access or abuse unprotected computers. The level of security you establish will determine how many of these threats can be stopped by your firewall. The highest level of security would be to simply block everything. Obviously that defeats the purpose of having an Internet connection. But a common rule of thumb is to block everything, and then begin to select what types of traffic you will allow. You can also restrict traffic that travels through the firewall so that only certain types of information, such as , can get through. This is a good rule for businesses that have an experienced network administrator that understands what the needs are and knows exactly what traffic to allow through. For most of us, it is probably better to work with the defaults provided by the firewall developer unless there is a specific reason to change it. One of the best things about a firewall from a security standpoint is that it stops anyone on the outside from logging onto a computer in your private network. While this is a big deal for businesses, most home networks will probably not be threatened in this manner. Still, putting a firewall in place provides some peace of mind. 1.4 Demilitarized Zone: DMZ stands for Demilitarized Zone. A DMZ is your frontline when protecting valuables from direct exposure to an untrusted environment. SI Security defines a DMZ as, "A network added between a protected network and an external network in order to provide an additional layer of security." A DMZ is sometimes called a "Perimeter network" or a "Three-homed perimeter network." A DMZ is a step towards defense in depth because it adds an extra layer of security beyond that of a single perimeter. A DMZ separates an external network from directly referencing an internal network. It does this by isolating the machine that is being directly accessed from all other machines. Most of the 5

6 time the external network is the Internet and what is in the DMZ is the web server but this isn t the only possible configuration. A DMZ can be used to isolate a particular machine within a network from other machines. This might be done for a branch office that needs its own Internet access but also needs access to the corporate network. In DMZ terminology, an internal connection is generally thought of as having more secret or valuable information than an external network. An easy way to understand which one is the internal network is to ask yourself which network I am protecting. Separation is important. Any system should have its important applications separated. This acts as system of checks and balances to make sure that if any one area goes bad that it cannot corrupt the whole. It is important to separate information so an attacker can t get to all the systems. It would be bad enough for the attacker to get to the web server but if that attacker can get through the web server to your database then that s even worse. This is the type of problem that a DMZ is designed to prevent. A DMZ s separation will degrade performance. If configured correctly the degradation in performance is usually minimal and seldom noticeable. However, it does exist and you need to be aware of it. This effect on performance must be calculated in the total cost of implementing a DMZ. Usually the performance drop is nominal and the security increase is significant. Exercise 2 What ports do you think should be left open to allow for normal internet traffic? Explain how your answer differs for say a host versus a server Iptables Introduction: Up until now, we've looked at stateless and stateful firewalls. Remember, stateless firewalls only have the features of a given packet to use as criteria for whether that packet should be passed, blocked, or logged. With a stateful firewall, in addition to the fields in that packet, we also have access to the kernel's table of open connections to use in deciding the fate of this packet. There's a problem, though. Picture an attacker that has launched attacks against almost every port on our web server box for the past half hour. The firewall has successfully repelled all of them, but now the attacker turns his attention to port 80. All of the hostile overflow attempts are let through unhindered. Why? Because the firewall ruleset allows all traffic to the web server through, and our firewall can't remember the fact that this IP address has been pounding all the other ports on the system. What if we could tell the firewall to remember the IP address of attackers and block them for a short period of time following their last attack? By remembering their past actions, we can block incoming web server connections that would otherwise have been allowed. 6

7 2.2 - Iptables modules: The firewall code in the current Linux kernel ( ) is called iptables or netfilter (while there is a technical distinction, they're equivalent names for this discussion). The crucial feature of this firewall is its modular design. You have the ability to add new types of tests to perform on a packet and actions to take on it. These tests and action modules can be added to a running kernel What s going on in the kernel? (taken from netfilter HOWTO by Rusty Russell) The kernel starts with three lists of rules in the filter table; these lists are called firewall chains or just chains. The three chains are called INPUT, OUTPUT and FORWARD. The chains are arranged like so: (Note: this is a very different arrangement from the 2.0 and 2.2 kernels!) Figure 1-2 Routing chains The three circles represent the three chains mentioned above. When a packet reaches a circle in the diagram, that chain is examined to decide the fate of the packet. If the chain says to DROP the packet, it is killed there, but if the chain says to ACCEPT the packet, it continues traversing the diagram. A chain is a checklist of rules. Each rule says if the packet header looks like this, then here s what to do with the packet. If the rule doesn t match the packet, then the next rule in the chain is consulted. Finally, if there are no more rules to consult, then the kernel looks at the chain policy to decide what to do. In a security-conscious system, this policy usually tells the kernel to DROP the packet. 1. When a packet comes in (say, through the Ethernet card) the kernel first looks at the destination of the packet: this is called routing. 7

8 2. If it s destined for this box, the packet passes downwards in the diagram, to the INPUT chain. If it passes this, any processes waiting for that packet will receive it. 3. Otherwise, if the kernel does not have forwarding enabled, or it doesn t know how to forward the packet, the packet is dropped. If forwarding is enabled, and the packet is destined for another network interface (if you have another one), then the packet goes rightwards on our diagram to the FORWARD chain. If it is ACCEPTed, it will be sent out. 4. Finally, a program running on the box can send network packets. These packets pass through the OUTPUT chain immediately: if it says ACCEPT, then the packet continues out to whatever interface it is destined for Creating your own rules The iptables tool inserts and deletes rules form the kernel s packet filtering table. Initially all chains are set to ACCEPT by default. A detailed description can be obtained from the man pages (man iptables). Commands to change chains: 1. create a new chain (-N) NOTE: use upper case letters 2. delete an empty chain (-X) 3. list the rules for a chain (-L) 4. flush a chain (delete all rules in a chain) (-F) Commands to add/delete rules: 1. Append a new rules to a chain (-A) 2. Delete a rule at some position in a chain, or the first that matches (-D) The sections Note: The examples in these sections only demonstrate particular rules. They may or may not work for the network setup for the lab Iptables Parameters Parameters specify the type of packet that you are looking to match with your rule Specifying jump If a packet matches one of your rules, you can tell the packet to jump to another chain with the -j option Example: #jump all packets in INPUT chain to the drop CHAIN iptables A INPUT j DROP Specifying protocol The protocol can be specified with the p option. Protocols can either be the number in the IP header or tcp, udp, or icmp (case insensitive). Example: #drop all icmp packets 8

9 iptables A INPUT p icmp Specifying inversion To invert (negate) any of your rules use the! character Example: #drop all packets that are not tcp iptables A INPUT p! tcp Specifying interface Interfaces can be specified with the -i (input) and -o (output) paramaters. Note, a rule in the INPUT chain checking with -o will never match any packet and a rule in the OUTPUT chain checking with -i will never match any packet. Example: #check packets coming in from the eth0 interface iptables A INPUT i eth Specifying source/dest The source/dest address of the packet can be specified in 4 ways. The source/dest can be specified as a named address ( localhost, by the IP address (e.g ), by group using network bits (e.g /24 ), or by using network address/netmask ( e.g / ) Although this next example is not in our iptables.firewall take a look at this example: Example: #allow tcp packets coming from /24 machines to machine iptables A INPUT s /24 d p tcp State matching If the ip_conntrack module is loaded, then connection-tracking analysis can be done on packets. The states which can be checked are: NEW A packet which creates a new connection ESTABLISHED A packet which belongs to an existing connection (i.e., a reply packet, or outgoing packet on a connection which has seen replies). RELATED A packet which is related to, but not part of, an existing connection, such as an ICMP error, or (with the FTP module inserted), a packet establishing an ftp data connection. INVALID 9

10 A packet which could not be identified for some reason: this includes running out of memory and ICMP errors which don t correspond to any known connection. Generally these packets should be dropped. An example of this powerful extension would be: iptables A FORWARD i eth0 m state! state NEW j DROP Limit explanation This module must be explicitly specified with `-m limit' or `--match limit'. It is used to restrict the rate of matches, such as for suppressing log messages. It will only match a given number of times per second (by default 3 matches per hour, with a burst of 5). It takes two optional arguments: --limit Followed by a number; specifies the maximum average number of matches to allow per second. The number can specify units explicitly, using `/second', `/minute', `/hour' or `/day', or parts of them (so `5/second' is the same as `5/s'). --limit-burst Followed by a number, indicating the maximum burst before the above limit kicks in. This match can often be used with the LOG target to do rate-limited logging. To understand how it works, let's look at the following rule, which logs packets with the default limit parameters: # iptables -A FORWARD -m limit -j LOG The first time this rule is reached, the packet will be logged; in fact, since the default burst is 5, the first five packets will be logged. After this, it will be twenty minutes before a packet will be logged from this rule, regardless of how many packets reach it (60 minutes / 3 packets per hour). This value of twenty minutes is because the default limit is 3/hour. Also, every twenty minutes which passes without matching a packet, one of the burst will be regained; if no packets hit the rule for 100 minutes, the burst will be fully recharged to 5 packets (100 minutes / 20mintes per packet); back where we started. Note: you cannot currently create a rule with a recharge time greater than about 59 hours, so if you set an average rate of one per day, then your burst rate must be less than 3. You can also use this module to avoid various denial-of-service attacks (DoS) with a faster rate to increase responsiveness. Syn-flood protection: # iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT Furtive port scanner: 10

11 # iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit - -limit 1/s -j ACCEPT Ping of death: # iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT Network Address Translation (NAT) There are two types of NAT, source NAT and destination NAT. Source NAT is when you alter the source address of the first packet: i.e. you are changing where the connection is coming from. Source NAT is always done post-routing, just before the packet goes out onto the wire. Masquerading is a specialized form of SNAT. A router might do masquerading for packets going from one of its internal machines to an outside connection. In this case it will change the source address of the machine to its own address. The external machine will see the packets coming from the router. Destination NAT is when you alter the destination address of the first packet: i.e. you are changing where the connection is going to. Destination NAT is always done before routing, when the packet first comes off the wire. Port forwarding, load sharing, and transparent proxying are all forms of DNAT. In the router example, the incoming packets intended for the internal machine are routed to it by changing the destination address to the internal address of the machine NAT in the kernel You need to create NAT rules which tell the kernel what connections to change, and how to change them. To do this, we use the very versatile iptables tool, and tell it to alter the NAT table by specifying the `-t nat' option. The table of NAT rules contains three lists called `chains': each rule is examined in order until one matches. The two chains are called PREROUTING (for Destination NAT, as packets first come in), and POSTROUTING (for Source NAT, as packets leave). The third (OUTPUT) will be ignored here. The following diagram illustrates this concept: 11

12 Figure 1-3 NAT routing chains At each of the points above, when a packet passes we look up what connection it is associated with. If it's a new connection, we look up the corresponding chain in the NAT table to see what to do with it. The answer it gives will apply to all future packets on that connection Iptables and NAT Figure 1-4 NAT with Iptables In order to explain the iptables.firewall commands in the next section, (see iptables.firewall in appendix 1-A now) you need the following details: The most important option for the iptables command is the table selection option, `-t'. For all NAT operations, you will want to use `-t nat' for the NAT table. The second most important option to use is `- A' to append a new rule at the end of the chain (e.g. `-A POSTROUTING'), or `-I' to insert one at the beginning (e.g. `-I PREROUTING'). You can specify the source (`-s' or `--source') and destination (`-d' or `--destination') of the packets you want to NAT. These options can be followed by a single IP address (e.g ), a name (e.g. or a network address (e.g /24 or / ). You can specify the incoming (`-i' or `--in-interface') or outgoing (`-o' or `--out-interface') interface to match, but which you can specify depends on which chain you are putting the rule into: at 12

13 PREROUTING you can only select incoming interface, and at POSTROUTING you can only select outgoing interface. If you use the wrong one, iptables will give an error. You want to do Source NAT; change the source address of connections to something different. This is done in the POSTROUTING chain, just before it is finally sent out; this is an important detail, since it means that anything else on the Linux box itself (routing, packet filtering) will see the packet unchanged. It also means that the `-o' (outgoing interface) option can be used. DNAT is done in the PREROUTING chain, just as the packet comes in; this means that anything else on the Linux box itself (routing, packet filtering) will see the packet going to its `real' destination. It also means that the `-i' (incoming interface) option can be used Port Forwarding When running a web server behind your firewall, you want to forward packets destined for that server through the firewall to that box. Example: # Linux 2.4 # Append a rule before routing (-A PREROUTING) to the NAT table (-t nat) that # TCP packets (-p tcp) going to (-d ) port 80 (--dport 80) # have their destination mapped (-j DNAT) to , port 80 # (--to :80). iptables -A PREROUTING -t nat -p tcp -d dport 80 \ -j DNAT --to :80 NOTE: This only changes the destination of the packet, it does not automatically accept it in the forwarding chain. A rule must be made in the forwarding chain also Masquerading There is a specialized case of Source NAT called masquerading: it should only be used for dynamicallyassigned IP addresses, such as standard dialups. You don't need to put in the source address explicitly with masquerading: it will use the source address of the interface the packet is going out from. But more importantly, if the link goes down, the connections (which are now lost anyway) are forgotten, meaning fewer glitches when connection comes back up with a new IP address. ## Masquerade everything out ppp0. # iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE 13

14 6.0 iptables.firewall Script Explanation (See Appendix 1-A) These rules are already contained in our file iptables.firewall. We do not cover the rules in exactly the same order as they appear in your file. Go through these rules and understand what exactly is being done Load the iptables modules and connection tracking for ftp and nat: modprobe ip_tables modprobe iptable_nat modprobe ip_conntrack_ftp modprobe ip_nat_ftp Configure default policies (-P), meaning default rule to apply if no more specific rule below is applicable. These rules apply if a more specific rule below is not applicable. Defaults are to DROP anything sent to firewall or internal network, permit anything going out. iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT Flush (-F) all specific rules: iptables -F INPUT iptables -F FORWARD iptables -F OUTPUT iptables -F -t nat The rest of this file contains specific rules that are applied in the order listed. If none applies, then the above policy rules are used. Forward all packets from vmnet1 (internal network) to vmnet2 (the internet). iptables -A FORWARD -i vmnet1 -o vmnet2 -j ACCEPT Forward all packets that are part of existing and related connections from vmnet2 to vmnet1. iptables -A FORWARD -i vmnet2 -o vmnet1 -m state --state ESTABLISHED,RELATED -j ACCEPT Permit packets in to firewall itself that are part of existing and related connections. iptables -A INPUT -i vmnet2 -m state --state ESTABLISHED,RELATED -j ACCEPT Note, in the above two rules, a connection becomes ESTABLISHED in the iptables PREROUTING chain upon receipt of a SYNACK packet that is a response to a previously sent SYN packet. The SYNACK 14

15 packet itself is considered to be part of the established connection, so no special rule is needed to allow the SYNACK packet itself. Allow all inputs to firewall from the internal network and local interfaces Forwarding iptables -A INPUT -i vmnet1 -s 0/0 -d 0/0 -j ACCEPT iptables -A INPUT -i lo -s 0/0 -d 0/0 -j ACCEPT Forward all http packets (port 80) to the internal VMware machine iptables -A PREROUTING -t nat d p tcp --dport 80 -j DNAT --to :80 iptables A FORWARD i vmnet2 p tcp - dport 80 j ACCEPT Forward all ssh packets (port 22) to the inside machine iptables -A PREROUTING -t nat d p tcp --dport 22 -j DNAT --to :22 iptables A FORWARD i vmnet2 p tcp - dport 22 j ACCEPT Turn on ip forwarding in case it wasn't already enabled echo "1" > /proc/sys/net/ipv4/ip_forward Alternative to SNAT -- MASQUERADE If your firewall has a dynamic IP number (Tech uses static IPs while most cable/dsl providers, such as ATT and Bellsouth, and all dial-up connections only offer dynamic IPs) because it connects to the internet itself via DHCP, then you probably cannot predict what the IP number is of your firewall's interface connected to the internet. In this case, you need a rule like the following that assigns the (an) IP number associated with vmnet2 to outgoing connections without you needing to know in advance (at time of writing this rule) what that IP number is: iptables -A POSTROUTING -t nat -o vmnet2 -j MASQUERADE Deny any packet coming in on the public internet interface vmnet2 which has a spoofed source address from our local networks: iptables -A INPUT -i vmnet2 -s /24 -j DROP iptables -A INPUT -i vmnet2 -s /8 -j DROP If you query a particular remote DNS server, permit UDP responses from it. iptables -A INPUT -p udp -s <remote DNS server IP> --source-port 53 -d 0/0 -j ACCEPT 15

16 6.5 Defending against ICMP Ping Floods ICMP ping floods are commonly used attacks, especially by script kiddies. The attack is really simple, the attacker ping floods you and if he has more upstream than your downstream, you won t be able to access anything. Iptables allows you to specify how many ICMP echo packets you want to reply to. This can be done by adding the following: iptables -A INPUT p icmp -icmp-type echo-request m limit / - limit 30/minute -limit-burst 1 j ACCEPT 30/minute means accept every other packet. An attacker may still ping flood you, but you won t reply to it anyways, and he will give up soon. However, this also allows other people to ping you, just to test the network connection. The burst is set to 1 packet, so this limit will immediately take effect. Our Linux based firewall is already completely setup since the iptables.firewall file is provided for us, and all of the machines behind the firewall are protected from harmful traffic. We will now run some tests to show the results of the firewall installation. Exercise 3 Turn on the firewall rules by typing./iptables.firewall (in the directory where your iptables.firewall is placed) If you have enabled the firewall before, you will need to flush the rules before executing the above command. Now rerun nmap from outside the firewall (BlackHat) on the Linux machine behind the firewall (Protected). Run nmap with these options: SCAN -> SYN Stealth DISCOVER -> Don t Ping OPTIONS -> Don t resolve Fast Scan TIMING -> Max RTT 40ms The command is nmap ss P0 n F max_rtt_timeout 40 <Protected Linux machine IP> We must add this additional timing option because the firewall does not send a reset packet when nmap scans a closed port, it simply drops it. The RTT value specifies that nmap will not wait longer than 40ms for a response on a port. Write down which ports are open after the firewalls installation: 16

17 Exercise 4 What happened differently in the results from exercise three as opposed to exercise one? Can you speculate what firewall rules caused this? Exercise 5 From BlackHat, we are going to ping the firewall to observe the rule which defends against icmp ping floods. The rule specified in this lab has the limit as 30/minute and a burst of 1. This means that every other packet will be denied and this rule will be enabled with the first packet. From your BlackHat, ping the firewall with these options: ping n 20 w 4 Record this output in one window. Now change the rule in the iptables.firewall file to 10/minute and a burst of 5. Restart the firewall with the command /etc/rc.d/init.d/iptables stop./iptables.firewall In another window from BlackHat ping the firewall with these options: ping n 20 w 4 Comment on the differences between the first rule: 17

18 Exercise 6 Now run ethereal on the firewall machine. Run with the options capture packets on any interface, update packets in real time, and automatic scrolling. From the linux machine behind the firewall, ping BlackHat, outside of the firewall, with the command: ping c Record the ethereal output and comment on the number of packets observed and their source and destination addresses. Now, edit iptables.firewall and comment out line 29 which reads: iptables -A FORWARD -i vmnet2 -o vmnet1 -m state --state ESTABLISHED,RELATED -j ACCEPT Restart the firewall with the command /etc/rc.d/init.d/iptables stop./iptables.firewall Repeat the previous ping and record and comment on the differences. Uncomment line 29 and restart the firewall. Explain what you saw and why: 18

19 Exercise 7 Restart ethereal on the firewall machine. Run with the options capture packets on any interface, update packets in real time, and automatic scrolling. From BlackHat, ssh to Record these output in ethereal and comment on what you saw happen: Exercise 8 Now we are going to log any packets attempting to telnet to the firewall using the LOG chain. iptables A INPUT d p tcp --dport 23 j LOG --log-prefix TELNET ATTEMPT: Attempt to telnet from your machine to the firewall. Check /var/log/messages for these telnet attemps and record the output from the messages file. type tail /var/log/messages to see the end of the /var/log/messages file. What did you see: Exercise 9 19

20 Write down three rules that you think might be useful and explain what they do. 7.0 Zone Alarm 7.1 Using Zone Alarm Zone alarm is a firewall for the windows operating system. It is available for all versions of Microsoft Windows including Windows CE. You can read more about it at It might be a very useful for protecting your home computer if you use Windows. Acknowledgement: This lab was originally written by Terri Calderone, Varun Kanotra, Ed Paradise, and Edward Rowe Spring How long did it take you to complete this lab? Was it an appropriate length lab? What corrections and or improvements do you suggest for this lab? Please be very specific and if you add new material give the exact wording and instructions you would give to future students in the new lab handout. You may cross out and edit the text of the lab on previous pages to make corrections/suggestions. Note that part of your lab grade is what improvements you make to this lab. 20

21 Credits 1. Copied and pasted for firewall introduction and explanation Tyson, Jeff, How Firewalls Work 2. Copied and pasted for IP Tables introduction Steams, William Adaptive Firewalls with IP Tables 3. Copied and pasted for iptables chains and certain rules Russell, Rusty, Linux 2.4 Packet Filtering HOWTO 4. Startup script and basis for rules Stephens, James C Designing a DMZ Scott Young March 26,

22 Appendix 1-A iptables.firewall #load the iptables modules and connection tracking for ftp and nat modprobe ip_tables modprobe iptable_nat modprobe ip_conntrack_ftp modprobe ip_nat_ftp # Configure default policies (-P), meaning default rule to apply if no # more specific rule below is applicable. These rules apply if a more specific # rule below is not applicable. Defaults are to DROP anything sent to firewall or # internal network, permit anything going out. iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT # Flush (-F) all specific rules iptables -F INPUT iptables -F FORWARD iptables -F OUTPUT iptables -F -t nat iptables -A INPUT -d p tcp --dport 23 -j LOG --log-prefix 'TELNET ATTEMPT: ' # The rest of this file contains specific rules that are applied in the order # listed. If none applies, then the above policy rules are used. # Forward all packets from vmnet1 (internal network) to vmnet2 (the internet). iptables -A FORWARD -i vmnet1 -o vmnet2 -j ACCEPT # Forward packets that are part of existing and related connections from # vmnet2 to vmnet1. iptables -A FORWARD -i vmnet2 -o vmnet1 -m state --state ESTABLISHED,RELATED -j ACCEPT # Permit packets in to firewall itself that are part of existing and related # connections. iptables -A INPUT -i vmnet2 -m state --state ESTABLISHED,RELATED -j ACCEPT # Note, in the above two rules, a connection becomes ESTABLISHED in the # iptables PREROUTING chain upon receipt of a SYNACK packet that is a # response to a previously sent SYN packet. The SYNACK packet itself is # considered to be part of the established connection, so no special # rule is needed to allow the SYNACK packet itself. # Allow all inputs to firewall from the internal network and local interfaces iptables -A INPUT -i vmnet1 -s 0/0 -d 0/0 -j ACCEPT iptables -A INPUT -i lo -s 0/0 -d 0/0 -j ACCEPT 22

23 # Alternative to SNAT -- MASQUERADE # # If your firewall has a dynamic IP number because it connects to the # internet itself via DHCP, then you probably cannot predict what the IP # number is of your firewall's interface connected to the internet. In # this case, you need a rule like the following that assigns the (an) IP # number associated with vmnet2 to outgoing connections without you needing # to know in advance (at time of writing this rule) what that IP number is: # iptables -A POSTROUTING -t nat -o vmnet2 -j MASQUERADE # Deny any packet coming in on the public internet interface vmnet2 # which has a spoofed source address from our local networks: iptables -A INPUT -i vmnet2 -s /24 -j DROP iptables -A INPUT -i vmnet2 -s /8 -j DROP # If you query a particular remote DNS server, permit UDP responses from it #iptables -A INPUT -p udp -s <remote DNS server IP> --source-port 53 -d 0/0 - j ACCEPT #prevent DoS by icmp flood iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 30/minute --limit-burst 1 -j ACCEPT #prevent DoS by tcp syn flood iptables -A INPUT -p tcp --syn -m limit --limit 1/s --limit-burst 1 -j ACCEPT #forward all http packets (port 80) to internal linux machine iptables -A PREROUTING -t nat -d 0/0 -p tcp --dport 80 -j DNAT --to :80 iptables -A FORWARD -i vmnet2 -p tcp --dport 80 -j ACCEPT #forward all ssh packets (port 22) to internal linux machine iptables -t nat -A PREROUTING -d p tcp --dport 22 -j DNAT --to :22 iptables -A FORWARD -i vmnet2 -p tcp --dport 22 -j ACCEPT # turn on ip forwarding in case it wasn't already enabled echo "1" > /proc/sys/net/ipv4/ip_forward 23

24 Appendix 1-B Troubleshooting installation. Getting rid of ipchains: If your iptables script won t correctly execute, and it gives an error about the device being busy then follow these steps. In order for iptables to work, ipchains must be turned off. First of all you will need to turn off the ipchains modules so it won't start in the future. To do this, you will need to change some filenames in the /etc/rc.d/ directory-structure. The following command should do it: chkconfig --level ipchains off To turn the service off immediately however, type the following: service ipchains stop 24