Firewall is a ❌ or ❌ of both designed to prevent unauthorized access

Número de NIC`s

bastion - ❌
Screen/DMZ - ❌
Multil - ❌

ROLES OF FIREWALLS IN NETWORK:

❌ todo tráfico ha de pasar por allí
❌ : mirar credenciales (user-pass)
❌: se guardan logs de todo lo que pasa

Firewalls:
filter the network traffic based on source or destination ❌
perform User ❌
Prevent Network from ❌
Perform ❌
Filtering ❌

Firewall Architecture

❌ designed for defending the network against attacks. It acts
as a mediator between inside and outside networks.

❌ is a protected network created with a two- or three-
homed firewall behind a screening firewall, and is a name commonly used to refer to the
❌. When using a three-homed firewall, connect the first interface to the Internet, the
second interface to the DMZ, and the third to the intranet.

The advantage of screening a subnet away from the intranet is that public requests can be
responded to without allowing traffic into the intranet.

❌ A multi-homed firewall is a node with multiple NICs that connects
to two or more networks. Connect each interface to the separate network segments
logically and physically. A multi-homed firewall helps in increasing efficiency and reliability
of an IP network.

1 firewall - ❌
2 o 3 firewall- ❌
multi NIC`s conecting several networks - ❌

filtra por direccion/puertos/interfaces - ❌
mira el 3 HANDSHAKE de TCP - ❌
abre los paquetes y es un proxy - ❌r
hace todo lo demas y además crear reglas automáticas - ❌

BASTION (en un firewall puede haber uno o varios bastiones)

especial diseñado para aguantar ❌
será quizás el ún❌ junto con quizás uno de los routers
configurado con ❌ y solo los extrictamente necesarios.
si el atacante gana acceso al bastion, accede a toda la red
- se configura habitualemente en algunas topologías como cabeza de turco para ganar tiempo en un ataque
- se conoce como perimeter network
- en una DMZ que no tiene data sensible

- packet filtering y proxy services

en entornos cloud se ubica como punto de entrada al cloud y se denomina bastion de salto

PRINCIPIOS BASICOS PARA CREAR UN BASTION
- minimos ❌ y mínimos ❌
- siempre listo para ser ❌
- ubicar entre el ❌
- los admin deben ser ❌ (via mensaje) si algo sucede
- si el bastion cae, los servidores interiores must ❌

AUDITANDO EL BASTION

create a ❌ for performance measurement
❌ can be used to monitor and send alerts
❌ is performed with the baseline to know how the bastions handles situation and how secure it is

TIPOS DE BASTION:

❌
- one interface
- all the traffic is routed throught the bastion

❌
- at least two interfaces
- capable of separating interanl and external networks

❌
- inside internal network
- pueden ser single or multi homed
- the internal interfaces (from host) comunicate with the internal bastion
- los del interior suelen proveer servicios como mail o ftp
- los externos son fundamentalmente de protección

❌
- at least dual home topology
-multiple network interfaces NOT INTERACT WITH EACH OTHER
❌
- para probar apps/servicios que no son del todo conocidadas
❌
- para servicios exclusivos de internet
- visibles para todos (imagina un servidos de pagina que aloja la página de la compañia)
❌
- no hay red de firewall, este host es el único firewall
- se necesita asegurar la absoluta seguridad de este host

qué es un DMZ

is a ❌ (bastion) or ❌ (servidores) inserted as a "neutral zone" betwen company lan and internet
the firewall within the DMZ screened subnet is also know as thress-pronge or ❌
- it is conected to three distinct networks and wit a diferent nic for each network
- the internet
- the DMZ subnet
- the secure lan or intranet

Major beneficts of DMZ
- adds ❌
- exploits if discovered can not ❌
- no ❌ of failure

Formas de crear un DMZ

❌: 3 nics; internet, dmz, lan
- ❌ fire - dmz - firewall -- internet
-- no ideal ya que si cae el priner host(firewall) se compromete la nic que conecta a internet

PROXY SERVERS

- ❌ servers betwen the client and server
- worl as ❌ the lan
---hide IP from users
- --hide lan topology
--- capable of encrypting information
--- increase anonymity in mail
- to send and recive packets from ❌
- ❌ (ACL, BLACKLIST IP, etc )
--- restrictions task
--- prevent malicious content enter the server
--- offers user authentication
- as ❌ for data request repeatedly

Hoy se usan sobre todo para evitar que los usuarios salgan de la lan hacia internet a visitar ciertas IP`s

IMPORTANTE
¿cuál es la diferencia clave entre un proxi que hace filtering y una app que filtra packetes?
-- que el proxy ❌ que envia los paquetes y puede discriminar por esa categoría también.
Proxi servers work at the app layer. if its act as gattewat for packets can be named ❌

¿Como funcionan un proxy?
internal host request
proxy ❌ based in a rule
proxy ❌ the packet with a diferent source ip address
---transmits the packet that conceals the actual end user
if data is returned : examines, reconstructed and ❌

this type of service increase the secirity of the network as ❌ fromthe client to the the destony server

examina data, reestructura el paquete - ❌

allow / block, examina routing (destino, origen etc) - ❌

mira el paquete- ❌
solo mira el header - ❌
reescructura el paquete - ❌
permite o niega el paso - ❌
crea detallados logs dado que pueden ver el paquete - ❌
solo crea logs acerca del IP routing/header - ❌
si fallan la comunicación se detiene - ❌
si fallan puede que se de la circustancia que todo se permita o se niegue - ❌

TYPES OF PROXY SERVERS

NOTA todo proxy que no sea puerto 80 y hhtp es considerado de una forma y otra application proxy

❌.
transparente para el usuario
port 80

❌
requieres configuring
each client program has to be se up to route all request to a single port

❌
works as a proxy server
filters connections for especific services/apps/protocols
a ftp proxy will allow traffic while other services will be blocked
good at logging
reduce load as they are capble of caching
perform user level authenticationa

❌

it is considered as a internet toolkit
allows only TCP-based applications to execute on proxy servers.
it is called because use sockets internally to keep track of the clients individual connections.
request clients and if it valid, bind the request to the information exchange, usually a HTTP

ANONYMOUS

nada que añadir

❌

situated closer to the server
optimize content by compressing in order to speed up loading times
client es unaware
acts as intermediate server, sits betwen client and actual server

LIMIRACIONES PROXY SERVERS
❌ in an event of attack if not properly secured
because data is reroute web pages can ❌
❌ is passed throught external server can be ❌

NAT

❌ IP into two sets and enables LAN to use the ❌fic
m❌ the packets that routers sends and h❌
has the ability to change the address of the packet and make as from valid address

VPN Virtual Private Network
A VPN is an attempt to combine both the ❌ networks

A VPN is a network that provides ❌ through the internet.
Used for connecting wide area networks (WAN).
It employs ❌ protection helping you to use a public network as a private network.
A VPN performs encryption and the decryption outside the packet-filtering perimeter to ❌ coming from other sites.
A VPN ❌ packets sent over the Internet.

VPNs have no relation to firewall technology, but firewalls are convenient for adding VPN features as they help in providing secure remote services.

HONEYPOT

A honeypot is a system that is intended to ❌ who try unauthorized or illicit utilization of the host system.
Whenever there is any interaction with a honeypot, it is most likely to be a ❌

They are a highly flexible tool with many different security applications.
Some honeypots can be used to help pre❌
Others can be used to det❌
While a few honeypots can be used for infor❌

Any existing system can be "honeypot-ized." For example, on WinNT, it is possible to rename
the default administrator account and then create a dummy account called "administrator"
with no password. WinNT allows extensive logging of a person's activities, so this honeypot
tracks users who are attempting to gain administrator access and exploit that access.

TYPES OF HONEYPOTS

Low-intereaction

- ❌ servicies and programs
- if attacker does something unexpected, they ge❌
- catures li❌
- ❌

High-interaction
- entire system of computers , ❌
- let the attacker in, but outbound is tig❌
- captures far ❌: eje: keystrokes
- ❌

FIREWALKING

Firewalking is a method used to ❌s behind firewalls.

Firewalking involves sending TCP or UDP packets into the firewall with ❌ than the targeted firewall.
If the packet makes it through the gateway, the system forwards it to the next hop, where the TTL equals one and prompts an ICMP error message at the point of rejection with a 'ITTL exceeded in transit" message.

Using this method, possible access to the firewall can be determined if successive probe packets are sent.
It has two phases:
a net❌
a sca❌

The scanning phase requires three hosts:

❌ The firewalking host is the system outside the target network

❌: The gateway host is the suspected firewall system on the target network,

❌ The destination host is the target system on the target network to
which the data packets are addressed.

❌

Using this technique, the sender of the packet designates the route that a packet
should take through the network, in such a way that the designated route should bypass the firewall node.
Using this technique, the attacker can evade firewall restrictions.

Source routing takes two approaches:

loose source routing In loose source routing, the sender specifies ❌ the packet must go through
strict source routing, the sender specifies the ❌ through.

BYPASS BLOCKED SITES USING URL
Inted of using the url tyoe its IP
this method fails if the software blocking the web tracks also its IP

BYPASS BLOCKED SITES USING ANONYMOUS WEBSITE SURFING SITES
usar paginas web que nos devuelvel la página que está baneada

BYPASS BLOCKED SITES USING A PROXY
usar el proxy que viene por defecto en los navegadores.
es sumilar a las dos últimas opciones