FIREWALL

’Firewalls’
1
Table of
Contents
2
 INTRODUCTION
 HOW FIREWALL WORKS
 TYPES OF FIREWALLS
 MAKING THE FIREWALL FIT
 TESTING A FIREWALL
CONFIGURATION
 CONCLUSION
 REFERENCES
Introduction
3
 Is hardware, software, or a combination of both
 used to prevent unauthorized programs or Internet

users from accessing a private network and/or a
single computer.
Hardware vs. Software Firewalls
4
Hardware Firewalls
 Protect an entire network
 Implemented on the router level
 Usually more expensive, harder to configure
Software Firewalls
 Protect a single computer
 Usually less expensive, easier to configure
How does a software firewall work?
5
 Inspects each individual “packet” of data as it arrives

at either side of the firewall
 Determines whether it should be allowed to pass

through or if it should be blocked
Firewall Rules
6
 Allow – traffic that flows automatically because it

has been deemed
 Block – traffic that is blocked because it has been

deemed dangerous to your computer
 Ask – asks the user whether or not the traffic is

allowed to pass through
What Can a Firewall
Do?
7
 Focus for security decisions

 Stop hackers from accessing your computer
 Can enforce security policy

 Protects your personal information
 Limits your exposure

 Blocks “pop up” ads and certain cookies
 Can log Internet activity efficiently

 Determines which programs can access the Internet
What Can't a Firewall
Do?
8
 Can't protect you against malicious insiders
 Can't protect you against connections that don't

go through it
 Can't protect against completely new threats
 Can't protect against viruses

Types of
Firewalls
9
 Packet Filtering Firewall
 Application level
Gateway
 Circuit level gateway

Application Firewall
Application firewall (AF) devices perform a stateful protocol

analysis of the application layer.
They support numerous common protocols, such as http, sql, e-mail
service (SMTP, POP3 and IMAP), voip and xml.
Stateful protocol analysis relies on predefined profiles of acceptable
operating modes for the selected protocol, enabling the
identification of potential deviations and irregularities in the
message flow of the protocol through the device.
Problems may arise if there is a conflict between the operating
mode of a specific protocol, which is defined on the AF device, and
the way in which the protocol is implemented in the specific version
of the application or of the operating systems used in the network.
The stateful protocol analysis can:

Determine whether an e-mail message contains a type of attachment that is not
allowed (e.g. Exec files);
Determine whether instant messaging is used via an HTTP port;
Block the connection through which an unwanted command is executed (e.g. An
FTP put command on the FTP server);
Block access to a page with unwanted active content (e.g., Java);
Identify an irregular sequence of commands exchanged in the communication
between two hosts (e.g., An unusually large number of repetitions of the same
command or the use of a command before using the command it depends on);
Enable the verification of individual commands and the minimum and maximum length of
appropriate command-line arguments (e.g., The number of characters used in a username).
An AF device cannot detect attacks that meet the generally acceptable procedures of
operation of a specific protocol, such as DoS (denial of service) attacks caused by the
repetition of a large number of acceptable message sequences in a short time interval.
Due to the complexity of the analysis they perform, and the large number of concurrent
sessions they monitor, the main disadvantage of the method of stateful protocol analysis is
the intensive use of AF devices.
•Two types
- Network based (Web Application Firewall)
- Host based
Web Application Firewall (WAF)
Web application firewalls are built to provide web applications

security by applying a set of rules to an HTTP conversation.
Because applications are online, they have to keep certain ports
open to the internet.
This means attackers can try specific website attacks against the
application and the associated database, such as cross-site scripting
(XSS) and SQL injection.
While proxy firewalls generally protect clients, WAFs protect
servers. Another great feature of WAFs is that they detect
distributed denial of service (DDoS) attacks in their early stages,
absorb the volume of traffic and identify the source of the attack.
Web application firewall
Application Proxy Gateway
Application Proxy Gateway (APG) devices also perform an analysis of the traffic flow
on the application layer.
Compared to AF devices, APG devices provide a higher level of security for
individual applications since they never allow a direct connection between two hosts,
and they can perform an inspection of the content of application-layer messages.
APG devices contain so-called proxy agents or “intermediaries” in the communication
between two end hosts.
Each successful connection between the end hosts consists of two connections – one
between the client and the proxy server and the other between the proxy server and the
destination device.
Based on the filtering rules defined on the APG device, proxy agents decide whether
network traffic will be allowed or not.
Traffic-filtering decisions can also be made based on the information contained in the
header of an application-layer message or even based on the content conveyed by that
message. In addition, proxy agents can require user authentication.
There are also APG devices with the capability of packet decryption, analysis and re-
encryption, before a packet is forwarded to the destination host.
Packets that cannot be decrypted are simply forwarded through the device.
APG ( DEFICIENCIES)
Require more memory and greater utilization of processor time for analyzing and
interpreting each packet passing through the device.
As a result, APG devices are not suitable for filtering applications that are more
demanding in terms of bandwidth or applications that are sensitive to time delays.
Another deficiency - limitation in the number of services that can be filtered through them.
Each type of traffic passing through the device requires a specific proxy agent that acts as
an intermediary in the communication. Consequently, APG devices do not always support
the filtering of new applications or protocols.
Due to their price, APG devices are commonly used for protecting data centres or other
networks containing publicly available servers that are of high importance to an
organization.
In order to reduce the load on APG devices and achieve greater efficiency, modern
networks more frequently use proxy servers (dedicated proxy servers) that are dedicated to
specific services that are not so sensitive to time delays (e.g., Email or web proxy servers).
Making The Firewall
Fit
12
 IP address
 Domain names
 Protocols
 Ports
What It Protects You
From
13
 Remote login
 SMTP session hijacking
 Operating system bugs
 Spam
 E-mail bombs
 Source routing
Security Strategies implemented
14
Default Deny
 Prohibit all communication that is not expressly permitted
Default Permit
 Permit all communication that is not explicitly prohibited
Least Privilege
 reduces the authorization level at which various actions are
performed
Defense in Depth
 security approach whereby each system on the network is secured
to the greatest possible degree
Choke Point
 forces attackers to use a narrow channel to bypass the network
Testing a Firewall
Configuration
15
• A faster and easier method is available with

the Linux firewall
 implementation
• Allows you to manually generate tests
• Suppose our local network is 172.16.1.0
• And we allow only TCP connections

Example
16

# ipchains -C forward -p tcp -s 172.16.1.0 1025 -d 44.136.8.2 80 -i eth0
accepted
source Destination
 # ipchains -C forward -p tcp -s 172.16.2.0 1025 -d 44.136.8.2 80 -i

eth0
denied Wrong
 # ipchains -C forward -p udp -s 172.16.1.0 1025 -d 44.136.8.2 80 -i

eth0 denied
Wrong
 # ipchains -C forward -p tcp -s 172.16.1.0 1025 -d 44.136.8.2 23 -i
eth0
denied Wrong
18
Conclusion

FIREWALL

Uploaded by

Copyright:

Available Formats

FIREWALL

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

FIREWALL

Uploaded by

Copyright:

Available Formats

’Firewalls’

 HOW FIREWALL WORKS

 MAKING THE FIREWALL FIT

 Is hardware, software, or a combination of both

 used to prevent unauthorized programs or Internet

 Inspects each individual “packet” of data as it arrives

 Determines whether it should be allowed to pass

 Allow – traffic that flows automatically because it

 Block – traffic that is blocked because it has been

 Ask – asks the user whether or not the traffic is

 Focus for security decisions

 Can enforce security policy

 Limits your exposure

 Can log Internet activity efficiently

 Can't protect you against malicious insiders

 Can't protect you against connections that don't

 Can't protect against completely new threats

 Can't protect against viruses

 Packet Filtering Firewall

 Circuit level gateway

Application firewall (AF) devices perform a stateful protocol

The stateful protocol analysis can:

Web application firewalls are built to provide web applications

 SMTP session hijacking

 Operating system bugs

• A faster and easier method is available with

• Allows you to manually generate tests

• Suppose our local network is 172.16.1.0

• And we allow only TCP connections

 # ipchains -C forward -p tcp -s 172.16.2.0 1025 -d 44.136.8.2 80 -i

 # ipchains -C forward -p udp -s 172.16.1.0 1025 -d 44.136.8.2 80 -i

You might also like