Network Security CS 192

Transcription

1 Network Security CS 192 Firewall Rules Department of Computer Science George Washington University Jonathan Stanton 1

2 Client Web Auth paper Today s topics Firewall Rules Jonathan Stanton 2

3 Required: Additional Resources FIS Chapter 10 Reference: Lots of examples on the web. Jonathan Stanton 3

4 Firewall Rulesets A Rule defines how a firewall should process a packet and what the final action taken on that packet should be. Potential Actions: Allow Block Filter Log Jonathan Stanton 4

5 Rule Chains To organize groups of rules, many firewalls allow you to define chains that consist of a set of rules in a particular order. The chains can be included in other chains leading to a hierarchical arrangement. Typically there are default chains corresponding to the 3 core paths of packets: INPUT, OUTPUT, FORWARD Chains allow coherent sets of rules to be grouped and shared. For example the rules for a FTP service could be grouped into a chain and then used on several different firewalls to apply the same policy to each. Jonathan Stanton 5

6 Rule structure The core pieces of any rule are: Action Source (IP, port, and state) Destination (IP, prot and state) So our notation will be (action, source, destination) {host net}:port for source or destination The order of rules matters, meaning the first rule that matches a particular packet will be the one that determines it s action (a few exceptions exist). Jonathan Stanton 6

7 Example Network Internet Firewall Corpnet DMZnet Jonathan Stanton 7

8 DNS DNS firewalls are complex because it is a required service that must access untrusted information and is relied on by many other services. Often two classes of DNS names: Internal network names (often trusted) External network names (must never be trusted) Security Modes for DNS: Proxy Split Internal/External DNS servers Jonathan Stanton 8

9 Simple DNS Simple setup (can leak dns info) One shared DNS server provides all information about corpdomain. It is located in the DMZ (dmz-dnsserver) Outgoing DNS Queries (allow, corpnet, any:dns) Incoming DNS requests (allow, any, dmz-dnsserver:dns) (deny, any, corpnet:dns) Jonathan Stanton 9

10 Split DNS Two DNS servers run, one internal with full data (called corp-dnsserver) and one external with minimal data (called dmz-dnsserver). Rules Outgoing DNS Queries (allow, corpnet, corp-dnsserver:dns) (allow, corp-dnsserver, dmz-dnsserver:dns) (deny, corpnet, any:dns) Incoming DNS requests (allow, any, dmz-dnsserver:dns) (allow, dmz-dnsserver, corp-dnsserver:dns) (deny, any, corpnet:dns) Jonathan Stanton 10

11 Split DNS issues More overhead then direct DNS queries Apps that require valid DNS entries for clients will fail without additional work The client will connect from an internal IP address which the external server cannot lookup (because dmz DNS server does not return detailed information about internal machines. Need to create fake entries in dmz DNS for any client. These entries need to match both forward and reverse lookups. * in-addr.arpa IN PTR UNKNOWN.example.com in-addr.arpa IN PTR pseudo example.com Jonathan Stanton 11

12 WWW The core web protocols of HTTP and HTTPS are fairly well-behaved as they use TCP and have a wellstructured client-server model. Basic policy (allow, corpnet, any:http) (allow, any, dmz-webserver:http) (deny, any, any:http) If you use a web proxy you can replace the first rule: (allow, corpnet, corp-wwwproxy:http) (allow, corp-wwwproxy, any:http) (deny, corpnet, any:http) Jonathan Stanton 12

13 NTP NTP uses UDP packets and involves bi-directional communication. Luckily the ports used are constant so a straightforward rule works. If vulnerabilities in NTP client software exist, then firewall protection becomes difficult as unidirectional openings are not possible. Instead of allowing connection to any ntp server, you may restrict it to only a few approved servers by removing the any rules and adding 2 rules for each server you want. Rule: (allow, corpnet, any:ntp) (allow, any, corpnet:ntp) Jonathan Stanton 13

14 SSH Two models: Allow SSH directly to internal clients. Simple; Lets users connect to their machines directly; No additional servers/machines required; (allow, any, corpnet:ssh) Bastion Login gateway Allows centralized controls on external access; More secure as two machines must be broken through; Does not prevent ssh tunneling, but can remove some of ssh s flexibility by controlling how the second ssh connection is initiated. (allow, any, dmz-sshserver:ssh) (allow, dmz-sshserver, corpnet:ssh) (deny, any, any:ssh) Jonathan Stanton 14

15 Information Slide Lecture slides, course updates, and assignments can be obtained at the course web page Jonathan Stanton 15