Firewalls

Firewalls

1. Stateless Firewall

   • No record of previous packets
   • Makes allow/deny decisions based on current packet

2. Stateful Firewall

   • Has history of recently seen packets
   • Makes allow/deny decisions based on context of history
   • Stateful Packet Firewall
     • States
       • NEW
       • ESTABLISHED
       • RELATED
       • INVALID
       • UNTRACKED
   • Uses a lot of rsources

3. Filter

4. Packet Firewalll

   • Makes allow/deny decisions based on IP addresses and TCP/UDP port numbers

5. Application Firewall

   • Makes allow/deny decisions based on re-assembled content from TCP segments

6. Network Firewall

   • Positioned between 2 subnets

7. Host Firewall

   • Positioned between NIC and process on host

8. Netfilter

   • Linux firewall infrastructure
   • Hook points
     • Intercept a packet
     • Make allow/deny decisions
   • Tables of chains
     • Groups of logical decision making hook points
     • Filter
       • FORWARD
         • Packets passing through
       • INPUT
       • OUTPUT
     • NAT (Network Address Transmission)
       • PRE-ROUTING
       • POST-ROUTING
   • Chains
     • Ordered sequence of rules
       • Pattern
         • arrival/departure NIC
           • eth0
           • eth1
         • SRC/DST IP
         • Protocol
           • TCP
           • UDP
           • ICMP
         • SRC/DST Port
       • Target
         • Defines what will happen to packet if it matches pattern
         • ACCEPT
           • Assumes good - lets through unless bad
         • REJECT
         • DROP
           • Assumes bad - only lets through if good
     • End-of-chain policy
       • Applied if packet matches no rules
       • ACCEPT
       • DROP

9. NAT Firewall

   • Private IP4 addresses hidden
   • Source NAT
     • Connection initiated from private IP address, listening server on public IP
     • Changes SRC address to public IP4 of firewall
   • Destination NAT
     • Communication initiated from public IP address, listening server behind NAT box