Firewalls

Firewalls

1. Firewall

   • hardware and/or software
   • prevents unauthorised access to/from networks
   • creates perimeter defence to protect integrity of network and access to assets

2. firewall functions

   • implement single point security measures
   • security event monitoring through packet analysis
   • network based access control through implementation of a rule set

3. Installation

   • Firewalls are generally installed between a LAN and internet
     • or between different LANs in an internet
     • or on individual hosts
   • should control traffic to and from a protected network
     • ALL traffic has to go through it to be effective

4. Limitations

   • Cant protect against attacks that bypass the firewall
     • dial-out from internal host to an ISP
   • cant protect from internal threats or insider
   • cant protect against the transfer of virus infected programs or files

5. Basic function

   • defend a protected network against parties accessing services that should only be available internally
   • restrict access from inside - outside services: P2P
   • Virtual Private Network VPN:
     • secure connection between two gateways
   • Network address translation
     • hides internal machines with private addresses

6. Placement

   • bastion host
     • topology good for corporate networks used to surf net
     • Not good for hosting web/mail servers
   • multihomed
     • provides DMZ to place publicly accessible servers using a single firewall
   • sceened subnet
     • provides dmz to place publicly accessible servers using single firewall
     • most secure but most expensive

7. Firewall types

   • Packet filters
     • specify which packets are allowed or dropped
     • rules based on source and ip adress
     • rules based on TCP and UDP port numbers
     • possible for in and out traffic
     • can be implemented in a router examining packet headers only
     • rules for filtering
       • policies
         • blacklisting - permissive
           • allow everything except dangerous services
           • whitelisting - restrictive
             • block everything except designated useful services
   • Firewall classification
     • packet filtering firewalls
     • circuit level gateways
     • application gateways
     • dynamic packet filtering firewalls
   • Filtering types
     • packet filtering
       • packets are treated individually
       • no state info is stored or used
     • session filtering or dynamic packet filtering
       • packets are grouped into connections
         • packets in a connection are detected
           • state info is memorised

8. packet filtering

   • applies packet filters based on access rules
   • Defined by following parameters
     • source / destination address
     • application or protocol/ next header
     • source port number
     • destination port number

9. packet filter rules

   • rule execution depend on rules
     • iptables: first rule to match is applied
     • OpenBSD pf: all rules are examined, last match is applied
   • rules organised in chains which are logical sub groups of rules
   • depending on packet type, source and destination different chains can be activated

10. Ip tables

    • linux utility used for implementing packet filtering
    • rules stored as tables for filtering the linux kernel firewall

11. Packet filter issues

    • Good as simple , low cost, fast, transparent to user
    • they cannot prevent attacks that employ specific vulnerabilities or functions because they do not examine upper layer data
    • most packet filter firewalls do not support advanced authentication schemes due to the lack of upper-layer functionality
    • Easy to accidentally configure a packet filtering firewall to allow traffic types, sources and destinations that should be denied based on an organisations policy set

12. Session filtering

    • standard packet filters do not examine higher layer context
    • dynamic packet filtering
      • examines data at all levels of the OSI
      • examine each packet in context
      • much more powerful but computationally expensive
    • mechanisms
      • packet decision made in the context of a connection
      • if packet is a new connection check again the policy
      • if packet is part of an existing connection match it up in the state table and update table
      • connection state table is maintained
        • ACK packets are used to keep track of the session - states the connection is ongoing
    • Dynamic filter (UDP)
      • monitors the state of all data flows
      • transparent to users
      • low CPU overheads
        • for the second and later packets belong to the same connection, no table look up of the policy is done

13. Circuit level gateways

    • slim layer monitoring to determine whether a requested TCP session is legitimate
    • do not permit an end - end TCP connection, do not permit the gateway sets up two TCP connections
      • one between itself and a TCP user on an inner host and between itself and a TCP user on an outside host
    • once the two connections are 547

14. Application gateway

    • firewalling at the application specific level
    • every connection between two networks is made via an application program also termed a proxy
    • connection state is maintained and updated
    • only protocols that have specific proxies configured are allowed through the firewall, all other traffic is rejected
    • if an application gateway is configured to only allow web traffic, it will not permit packets of a different protocol eg ftp or ssh packets
    • very cpu intensive and needs a powerful server to run on

Bilder und Dateien der Mindmap