Proxy firewalls
Content
Proxy Firewalls
How Proxy Firewalls Work Forward / Reverse Proxies Application-Level Proxies
Gateways (Circuit-Level Proxies)
How proxy firewalls work
Proxy acts on behalf of both the inside client and the
outside server
How proxy firewalls work
Proxy interacts with its internal address on behalf of
the external server as listener
Proxy interacts with ist external address on behalf of
the internal client as initiator
Client and server never interact directly with each
other
Forwarding is disabled on the proxy server
Intransparent
Proxy firewall - example
1.
User requests an HTTP resource
3.
Client software forwards the request to proxy
5.
Proxy makes connection and acts as client by
requesting the HTTP resource from the server
7.
All ongoing traffic being routed between internal
Bastion hosts
Since the proxy server is visible from the outside
network it has to be hardened against attacks
Proxy servers are usually dual-homed (two network
interfaces)
No direct connection - IP forwarding is disabled
Internal structure of the network remains veiled for any
outside party
Passive fingerprinting impossible (OS detection by studying default settings of packets, such as TTL, window size, TCP options)
Forward / reverse proxy
Forward proxy:
Dominant form of proxies
Connection initiated by internal client
Reverse proxy:
Connection initiated by external client
Application-level proxy
Implemented for each service
Policies permit particular traffic, such as
Particular users (impossible with transparent firewalls) Particular addresses
Circuit-level proxy
Packet filtering inside the proxy is based on more
specific rules
Content will be examined
Catchwords Size Viruses Data type Image detection Passwords
Advantages
Internal structure / topology is shielded from the
external world
Traffic can be easily monitored
User-based security is possible / authentication can be
implemented
Disadvantages
Performance reduction
Single point of failure
Application specific proxies have to be developed
Software has to be adapted
Proxy firewalls and encrypted traffic
IPSec
End-to-end encryption impossible - packets are changed at the proxy Obviously impossible to examine payload
Authentication causes problems
SSL / TLS
Payload is encrypted
Proxy cannot change payload until it is decrypted
SOCKS
Socks is a proxy toolkit
Enables applications to be „proxied“ without specific client-software SOCKS server performs client authentication and authorization
Applications are „socksified“ - modifications are necessary to communicate with the SOCKS server
SOCKS protocol
Client
Sends request to proxy server containing its own identity and required destination address (outbound connections) or required port (inbound connections)
Server
Checks whether request should be granted
SOCKS protocol
SOCKS v.4
Defines message formats to support TCP connections
SOCKS proxy grants access based on TCP header information (see other slides)
ident authentication (RFC1413) also possible - identd returns owner of a connection (pair of TCP ports)
6193, 23 : USERID : UNIX : stjohns 6195, 24 : ERROR : NO-USER
No strong authentication
SOCKS
connect
Client wants to connect to an external service Request
+----+----+----+----+----+----+----+----+----+----+....+----+ | VN | CD | DSTPORT | DSTIP | USERID |NULL| +----+----+----+----+----+----+----+----+----+----+....+----+ 1 1 2 4 variable 1 VN - version CD - command Reply +----+----+----+----+----+----+----+----+ | VN | CD | DSTPORT | DSTIP | +----+----+----+----+----+----+----+----+ 1 1 2 4 90: request granted
91: request rejected or failed
92: request rejected becasue SOCKS server cannot connect to identd on the client
SOCKS
bind
Client offers a socket for inbound connections
+----+----+----+----+----+----+----+----+----+----+....+----+ | VN | CD | DSTPORT | DSTIP | USERID |NULL| +----+----+----+----+----+----+----+----+----+----+....+----+ 1 1 2 4 variable 1 VN - version
SOCKS
SOCKS v.5
RFC1928
Strong authentication
Support for address resolution (DNS) proxy Provides additional support for UDP
SOCKS
The SOCKS v.5 request is formed as follows:
+----+---+---+---+---+---+ |VER | CMD | RSV | ATYP | DST.ADDR | DST.PORT | +----+---+---+---+---+---+ | 1 | 1 | X'00' | 1 | Variable | 2 | +----+---+---+---+---+---+ o VER protocol version: X'05'
o CMD
o CONNECT X'01' o BIND X'02'
o UDP ASSOCIATE X'03' o RSV RESERVED
o ATYP address type of following address o IP V4 address: X'01'
o DOMAINNAME: X'03' o IP V6 address: X'04'
o DST.ADDR desired destination address
Portus
Proxy system with
Strong user authentication
Smartcard based authentication / smart tokens
Access can be allowed or denied on different criteria
Time
Addresses / ports User
