Firewalls. Network Security. Firewalls Defined. Firewalls

Transcription

1 Network Security Firewalls Firewalls Types of Firewalls Screening router firewalls Computer-based firewalls Firewall appliances Host firewalls (firewalls on clients and servers) Inspection Methods Firewall Architecture Configuring, Testing, and Maintenance 2 Firewalls Defined Separate outside network and inside network Selectively forward packets from one network to another Keep the badguy's packets out Let the goodguy's packets in Let everybody's packets get out Prevent network mapping (NAT) 1

2 Firewall Local Network Firewall Internet 4 Border (ingress) Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Hardened Server Dropped Packet (Ingress) Log File Internet Border Firewall Internet (Not Trusted) Internal Corporate Network (Trusted) Attacker 5 Proxy Function Store Filter Forward 2

3 Two Generic Filter Categories 1.Circuit Filters Work at the Data Link and Network OSI layers 2.Application Gateways Transport and Application layers 7 Filtering Packets Some get through, some don't How do you pick? Depends on: What information is available? What you want to protect against? 8 Types of Firewall Inspection Packet Inspection Examines IP, TCP,UDP, and ICMP header contents Static packet filtering looks at individual packets in isolation. Stateful inspection inspects packets in the context of the packet s role in an ongoing or incipient conversation Stateful inspection is the preferred packet inspection method today 9 3

4 What Information Is Available at the IP level? Always available Source and Destination Addresses Filter traffic from or to IP addresses or ranges of addresses Packet size Can filter out large packets Port requested Can filter out ICMP or FTP, etc. 10 finger (79) telnet (23) Ports to Block rlogin (513) ftp (21) X Windows (177) mail (25) http (80) ICMP (RFC 792) ping redirect traceroute 11 Using Port Information If TCP port is requested, a TCPaware filter can use TCP info If ICMP is requested and allowed, can filter by ICMP type, e.g. allow ping, but disallow traceroute What if SSL port is selected? 12 4

5 Circuit Gateways State-ful filters Who originated? When? Where did the last packet come from/go to (route)? 13 Info at the Application Layer Attachment Format File type Viruses Access to text in the payload Porn Sex Smack Weed 14 Pros and Cons Circuit Filters AdvantageSimplicity DisadvantageLimited scope Application Filters AdvantageWide Scope Disadvantages Complexity Performance 15 5

6 Some Commercial Firewalls 1. Altavista (DEC) 2. Borderware (Secure Computing Corp) 3. Cyberguard (Cyberguard Corp) 4. Eagle (Raptor Systems) 5. Firewall-1 (Checkpoint Software) 6. Gauntlet (Trusted Info Systems) 7. ON Guard (ON Technology Corp) Firewalls Cannot: Be perfect. Bad stuff will get in/out Good stuff will get filtered Protect against insiders 17 Firewall Hardware and Software Screening Router Firewalls Add firewall software to router Usually provide light filtering only Expensive for the processing power usually must upgrade hardware, too Screens out incoming noise of simple scanning attacks to make the detection of serious attacks easier Good location for egress filtering can eliminate 18 scanning responses, even from the router 6

7 Software Firewalls Add firewall software to server with an existing operating systemwindows or UNIX Can be purchased with power to handle any load Easy to use because known operating system 19 Special Purpose Computer Bundle software with hardened hardware and operating system software General-purpose operating systems may result in: Slower processing Excess functionality Wasted space Unnecessary vulnerabilities Etc. 20 Host Firewalls Installed on hosts themselves (servers and clients) May use host-specific knowledge For example, filter out everything but webserver transmissions on a webserver Client firewalls typically must be configured by users Might misconfigure or reject the firewall Need to centrally manage remote employee computers 21 7

8 Drivers of Performance RequirementsTraffic Volume and Complexity of Filtering Complexity of Filtering: Number of Filtering Rules, Complexity Of rules, etc. Performance Requirements Traffic Volume (Packets per Second) 22 Static IP Packet Filter Firewall Corporate Network The Internet Permit (Pass) IP-H TCP-H Application Message IP-H UDP-H Application Message Deny (Drop) IP-H ICMP Message Log File Static Packet Filter Firewall Arriving Packets Examined One at a Time, in Isolation Only IP, TCP, UDP and ICMP Headers Examined 23 Ingress Filtering Prevent attack packets from entering the protected network Rules are applied in order See Figure 5.6 for generic rule format 24 8

9 Ingress Filtering Deny Known Fallacious Source Addresses Private addresses 10.*.*.* *.* to *.*, *.* Internal Address Ranges Other obvious or known common addresses , , , etc. 25 Ingress Filtering Deny Known TCP Vulnerabilities Syn flood (TCP SYN=1 AND FIN=1) FTP (TCP destination port = 20) Supervisory control connection (TCP destination port = 21) Telnet (TCP destination port = 23) NetBIOS (TCP destination port = 135 through 139) UNIX rlogin (TCP destination port = 513) UNIX rsh launch shell without login (TCP port 514) 26 Ingress Filtering 1. If UDP destination port=69, DENY [Trivial File Transfer Protocol; no login necessary] 2. If ICMP Type = 0, PASS [allow incoming echo reply messages] 3. DENY ALL 27 9

10 Egress Filtering Deny Destinations private IP address range = 10.*.*.* *.* to *.* *.* not in internal address range *.* 28 Egress Filtering Allow ICMP Type = 8, PASS [outgoing echo messages] Deny Protocol=ICMP [all other outgoing ICMP] Deny TCP RST=1[outgoing resets; used in host scanning] 29 Egress Filtering Deny Connections to Well-known ports TCP source port=0 through UDP source port=0 through Allow Outgoing Client Connections UDP source port = ,536 TCP source port =49152 through 65,

11 Firewalls Types of Firewalls Inspection Methods Static Packet Inspection Stateful Packet Inspection NAT Application Firewalls Firewall Architecture Configuring, Testing, and Maintenance 31 Stateful Inspection Firewalls State of Connection Open or Closed State Order of packet within a dialog Often simply whether the packet is 32 part of an open connection Stateful Inspection Firewalls By default, permit connections openings from internal clients to external servers By default, deny connection openings from the outside to inside servers Default behaviors can be changed with ACLs Accept future packets between hosts and ports in open connections with little or no more inspection 33 11

12 Stateful Inspection Firewalls Can prevent Syn flood Port switching Session hijacking Etc. 34 Questions? 35 12