Firewalls: General Principles & Configuration (In Linux)

Firewalls: General Principles
& Configuration (in Linux)

Bruhadeshwar Bezawada
International Institute of Information
Technology, Hyderabad
Overview
General Principles of Firewalls

Types
Issues in design and deployment
Rules, conflicts and performance issues
Configuration
IPTables
IPChains
Relevant OSI Layers for Firewall

Operation
General Principles of Firewalls
Network firewalls are devices or systems that control the flow of

network traffic between networks employing different security
postures
One usage is to limit/control connectivity to the Internet

Another usage in corporate networks is to restrict connectivity to and
from internal networks servicing more sensitive functions, like
accounting or personnel department
Firewalls operate at different layers in network
Firewalls that can examine information at more than one layer is more
thorough and effective
A firewall that works with layers 2 and 3 does deal with specific users
A firewall at application layer like an application-proxy gateway firewall
can enforce user authentication as well as logging events to specific users.
Add-ons Supported by Firewalls
NAT, DHCP, encryption for VPNs, and application content

filtering
Firewalls support DHCP so as to allocate IP addresses for those

systems that will be the subject of firewall's security control and
to simplify network management
Firewalls can act as VPN gateways, where the gateway is
responsible for encrypting traffic that is leaving its boundary and
destined to other systems in the VPN
Active content filtering, firewall is capable of filtering actual
application data at layer 7
For example, scanning email attachments for viruses, filtering out

active content in technologies like Java, JavaScript, ActiveX
Can filter on content or key words to restrict access to

inappropriate sites or domains.
Types of Firewalls
Packet Filters
Stateful Inspection Firewalls
Application-proxy Gateway Firewalls
Dedicated proxy servers
Hybrid Firewalls
Network Address Translation (NAT)
Packet Filters
Packet Filter Firewalls

Packet filters operate at layer 2/3 of OSI
The basic functionality is designed to provide network access

control based on the information at network layer
source address of packet, the IP address from which the packet

originated
destination address of the packet, i.e., the IP address where it is
going
Type of traffic, i.e., the type of specific network protocol being
used to communicate between source and destination
Source and destination ports
Incoming, outgoing interfaces for the packet
filter type of traffic e.g., ICMP traffic the layer 3 protocol is ICMP
Prevent attacks that exploit weaknesses in TCP/IP suite
The access control functionality of a packet filter is decided by

a set of directives called as a ruleset
Boundary Router
Packet filters also called boundary routers
Packet filter gateways have both speed and flexibility as they

examine a limited amount of data, they can operate very
quickly
The ability to block attacks, filter unwanted protocol, perform
access control, block denial-of-service and related attacks,
makes it ideal to be placed at the outermost boundary with an
un-trusted network.
E.g., the boundary router accepts packets from un-trusted

networks, performs access control according to the policy in place,
say, block SNMP, permit HTTP, block ICMP etc.
The boundary router will pass the packets to a more

powerful firewall that can perform access control and
filtering at higher layers of the OSI stack
Boundary Router
Sample Packet Filter Ruleset
Examining the Rule Set
Some notes on the ruleset
Actions taken are
192.168.1.0 indicates all addresses in the range 102.168.1.0 to 192.168.1.254

(Firewall has interface: 192.168.1.1)
Examines source port, destination port, source address, destination address,
basically all information that is necessary for examining the rules in the ruleset
Accept: firewall passes the packet through the firewall as requested
Deny: drops packet. An error message is returned to the sending system
Discard: drops the packet and does not return an error to the source system
Example
Rule 1 allows any TCP connections from outside

Rule 3 says deny any attempts to connect to firewall from outside
Rule 5, 6 say allow packets going to SMTP (192.168.1.2) and HTTP
(192.168.1.3) servers
Last rule is default, if packets dont match any of the above they are denied
Weaknesses
As they don't examine upper-layer data, they cannot prevent attacks that
employ application specific vulnerabilities or functions
For example, it cannot block specific application commands: if a packet filter

firewall allows a given application, all functions available from that application
will be permitted
Logging functionality is limited as packet firewalls work on a small amount

of data
Most packet filters do not support advanced user authentication schemes
Vulnerable to attacks and exploits that take advantage of problems within
TCP/IP specification and protocol stack, such as IP spoofing
Due to small number of variables used in access control decisions, packet
filter firewalls are susceptible to security breaches caused by improper
configuration
These firewalls are suitable for high-speed environments where logging and
user authentication with network resources are not important
Address some functionalities of the TCP layer

Many clients connect to remote systems from highnumbered ports
E.g., client port is >1023 in most cases

Packet filter firewall must allow all communication to happen
above this port
Allowing so many ports leaves the network vulnerable
Stateful inspection firewall solves this problem by adding

the state information of the relevant TCP connection
Only ports having legitimate TCP connections are allowed

State table is maintained for every connection
Sample State Table
Application-Proxy Gateway Firewalls
Application-proxy Gateway Firewalls
Combine application layer information with lower layer

information for filtering purposes
Application proxies take over the routing task of packets
from inside and outside the network
If it fails no packets can pass through the firewall

All network packets must traverse the firewall under software
control
Each individual application-proxy (proxy agent)

interfaces directly with the firewall access control ruleset
to determine whether a given traffic should be permitted
to transit the firewall
Authentication of each user is possible based on login-password,

source address, bio-metrics etc
Advantages Over Previous Firewalls
They have more extensive logging capabilities as

the entire packet is examined
E.g., malicious commands like su root from outside

can be logged
They allow administrators to enforce the

required authentication based on the security
policy of the organization
IP spoofing can be detected as the attackers need to

know more information such as login and password
Typical Proxy Agents
Disadvantages
Needing to read entire packet makes these

firewalls slow
Not suited for high-bandwidth or real-time

applications
Some work is often offloaded to dedicated proxy
servers
They are not flexible in supporting new network

applications and protocols
They ship with generic support

This can allow malicious traffic to tunnel through
these generic application without check
Dedicated Proxy Servers
Proxy servers are deployed behind traditional firewalls

Main firewall will accept inbound traffic and forward the traffic to
proxy, if that application is handled by proxy
Proxy servers can also accept outbound traffic from internal systems
E.g., email proxy server
Filter or log the traffic accordingly

E.g., HTTP proxy that is behind firewall
Dedicated proxies allow enforcement of user authentication

requirements in addition to filtering and logging
Prevent email viruses

Protect web server updates from internal users
Email and Content Scanning
Java applet or application filtering (based on digital

signature availability)
ActiveX control filtering (same as above)
JavaScript filtering (eliminating cross-site scripting
attacks)
Blocking specific Multipurpose Internet Multimedia
Extensions types
Virus scanning and removal
Application-specific commands like HTTP delete and
User-specific controls, including blocking content types
for certain users
Caching of web pages to reduce incoming traffic
Sample Proxy Configuration
Hybrid Firewall Technologies
Combining basic packet filters with

application-proxy gateway firewalls
Combining stateful inspection firewalls
with application-proxy functionality to
offset weaknesses of existing stateful
inspection firewalls
Network Address Translation
Two reasons for NAT:
Hiding the real IP addresses in the network prevents

many attackers from attacking individual systems
Depletion of IP address space has made NAT
necessary for most organizations
Three techniques
Static Address Translation

Hiding Network Address Translation
Port Address Translation
Static Address Translation
Every internal IP has a different routable

IP (fixed)
Not very frequently used due lack of IPs
Very fast and scalable
Sample Table
Hiding NAT
All Internal IP addresses share the SAME

external IP address
E.g., All systems connecting to Internet

through a proxy
For those addresses that need mapping

from outside will require their external
addresses for efficiency purposes
Port Address Translation
Forward inbound connections based on ports

Client port is used to identify connection, unlike
NAT where IP address is used to identify
connection
Each connection internal connection gets a port from

the firewall based on the connection
When response comes from outside, the firewall looks
up the destination port and identifies the client
Sample PAT Table
Other Firewalls
Host-based firewalls in Linux based systems for

application servers
Server application is protected better

A separate hardware/software is not necessary
Personal Firewalls to protect PCs

Personal Firewall Appliance for protecting small
networks like ISP-client connections etc
Integrates with the following devices, cable modem,

routing modules, DHCP servers, hubs, switches,
SNMP agents, application-proxy agents
DMZ
Created out of a network connecting two

firewalls
Specifically, for nodes that should not be
put in protected internal networks
DMZ

Firewalls: General Principles & Configuration (In Linux)

Uploaded by

Copyright:

Available Formats

Firewalls: General Principles & Configuration (In Linux)

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Firewalls: General Principles & Configuration (In Linux)

Uploaded by

Copyright:

Available Formats

Firewalls: General Principles

& Configuration (in Linux)

General Principles of Firewalls

Rules, conflicts and performance issues

Relevant OSI Layers for Firewall

General Principles of Firewalls

Network firewalls are devices or systems that control the flow of

One usage is to limit/control connectivity to the Internet

Firewalls operate at different layers in network

Add-ons Supported by Firewalls

NAT, DHCP, encryption for VPNs, and application content

Firewalls support DHCP so as to allocate IP addresses for those

For example, scanning email attachments for viruses, filtering out

Can filter on content or key words to restrict access to

Packet Filter Firewalls

The basic functionality is designed to provide network access

source address of packet, the IP address from which the packet

The access control functionality of a packet filter is decided by

Packet filters also called boundary routers

Packet filter gateways have both speed and flexibility as they

E.g., the boundary router accepts packets from un-trusted

The boundary router will pass the packets to a more

Sample Packet Filter Ruleset

Examining the Rule Set

Some notes on the ruleset

Actions taken are

192.168.1.0 indicates all addresses in the range 102.168.1.0 to 192.168.1.254

Rule 1 allows any TCP connections from outside

For example, it cannot block specific application commands: if a packet filter

Logging functionality is limited as packet firewalls work on a small amount

Stateful Inspection Firewalls

Stateful Inspection Firewalls

Address some functionalities of the TCP layer

E.g., client port is >1023 in most cases

Stateful inspection firewall solves this problem by adding

Only ports having legitimate TCP connections are allowed

Sample State Table

Application-Proxy Gateway Firewalls

Application-proxy Gateway Firewalls

Combine application layer information with lower layer

If it fails no packets can pass through the firewall

Each individual application-proxy (proxy agent)

Authentication of each user is possible based on login-password,

Advantages Over Previous Firewalls

They have more extensive logging capabilities as

E.g., malicious commands like su root from outside

They allow administrators to enforce the

IP spoofing can be detected as the attackers need to

Typical Proxy Agents

Needing to read entire packet makes these

Not suited for high-bandwidth or real-time

They are not flexible in supporting new network

They ship with generic support

Dedicated Proxy Servers

Proxy servers are deployed behind traditional firewalls

E.g., email proxy server

Filter or log the traffic accordingly

Dedicated proxies allow enforcement of user authentication