Firewalls
(March 4, 2015)
© Abdou Illia – Spring 2015
2
Test your Firewall knowledge
Which of the following is true about firewalls?
a) A firewall is a hardware device b) A firewall is a software program c) Firewalls could be hardware or software
Which of the following is true about firewalls?
a) They are used to protect a whole network against attacks b) They are used to protect single computers against attacks c) Both a and b.
3
Test your Firewall knowledge (cont)
Which of the following is true about firewalls?
a) They are configured to monitor inbound traffic and protect against attacks by intruders
b) They are configured to monitor outbound traffic and prevent specific types of messages from leaving the protected network.
c) Both a and b
4
Firewall: definition
Hardware or software tool used to protect a single host
1or an entire network
2by
“sitting” between a trusted network (or a trusted host) and an untrusted network
Applying preconfigured rules and/or traffic knowledge to allow or deny access to incoming and outgoing traffic
1 Host-based or personal firewall 2 network-based firewall Untrusted
network Trusted network
PC with Host- based Firewall
PC with Host- based Firewall
Network-Based Firewall
5
Questions
What is the main advantage of having a host-based firewall in addition to having a network-based one?
Answer:_________________________________________
What kind of security issue could be associated with having host-based firewall on users PCs?
Answer:__________________________________________
Untrusted network Trusted network
PC with Host- based Firewall
PC with Host- based Firewall
Network-Based Firewall
6
Firewall Architecture
Most firms have multiple firewalls. Their arrangement
is called the firm’s firewall architecture
Internet
Main Border Firewall 172.18.9.x Subnet
Marketing Client on 172.18.5.x
Subnet
Accounting Server on 172.18.7.x Subnet
Public Webserver
60.47.3.9
SMTP Application Proxy Server
60.47.3.10
HTTP Application Proxy Server
60.47.3.1 External DNS Server
60.47.3.4 Screening
Router Firewall Internal
Firewall
Host Firewall
Host Firewall
Email Server on 172.18.6.x Subnet Host Firewall
Demilitarized Zone (DMZ)
7
Firewall Architecture
Internet
Main Border Firewall 172.18.9.x Subnet
Marketing Client on 172.18.5.x
Subnet
Accounting Server on 172.18.7.x Subnet
Public Webserver
60.47.3.9
SMTP Application Proxy Server
60.47.3.10
HTTP Application Proxy Server
60.47.3.1 External DNS Server
60.47.3.4 Screening
Router Firewall Internal
Firewall
Host Firewall
Host Firewall
The DMZ is a subnet that includes most vulnerable hosts to attacks; i.e.
hosts that provide services to outside users. Common hosts in DMZ:
Public web servers, Public DNS servers, public FTP servers, Email proxy servers.
Host in DMZ must be heavily protected.
Email Server on 172.18.6.x Subnet Host Firewall
Demilitarized Zone (DMZ)
8
Questions
What is a DMZ?
Why are public web servers usually put in the DMZ?
Why are public DNS servers usually put in the DMZ?
Which of the following may be placed in a DMZ?
a) A SMTP proxy server
b) A server that contains files available for downloading by employees c) An File Transfer Protocol server
d) A SQL (Structured Query Language) database server
What IP addresses should a DNS server in the DMZ be able to find?
a) All company’s IP addresses
b) Only the IP addresses of the computers in the internal subnet c) Only the IP addresses of the computers in the DMZ
You work as the security administrator at King.com. King.com has been receiving a high volume of attacks on the king.com web site. You want to collect information on the attackers so that legal action can be taken. Which of the following can you use to accomplish this?
a) A DMZ (Demilitarized Zone).
b) A honey pot.
c) A firewall.
d) None of the above.
9
Basic Firewall Operation
Attack Packet 1 1. Internet (Not Trusted)
Attacker
Log File Dropped Packet
(Ingress)
Legitimate User Legitimate Packet 1
Attack Packet 1
Internal Corporate Network (Trusted) Border Firewall Passed Legitimate
Packet (Ingress) Legitimate Packet 1
Egress filtering:
filtering packets leaving to external networks Ingress filtering:
filtering packets coming from external networks Legitimate Packet 2
Passed Packet (Egress) Legitimate Packet 2
10
Connection Source IP Destination IP State
Connection 1 123.12.13.4 60.47.3.9:80 TCP opening
Connection 2 213.14.33.56 60.47.3.9:80 Data transfer
…… ………. ………. ………
Types of Firewalls
Static Packet Filtering Firewalls (1
stgeneration)
Inspect TCP, UDP, IP headers to make filtering decisions
Do static filteringof individual packetsbased on configured ruleset (or Access Control List)
Prevent attacks that use IP or port spoofing, etc.
Stateful Packet Filtering Firewalls (2
ndgeneration)
Inspect TCP, UDP, IP headers to make filtering decisions
Do stateful filteringby checking the firewall’s state table for relation of packets to packets already filtered
If packet does not match existing connect, ruleset (static filt.) is used
If packet matches existing connection, it is allowed to pass
Prevent SYN attacks, teardrops, etc.
State Table IP-H
IP-H TCP-H
UDP-H Application Layer Message Application Layer Message
11
Types of Firewalls (cont.)
Application Firewalls (3
rdgeneration)
Also called proxy firewalls
Inspect the Application Layer message (e.g. HTTP requests, emails, etc.
Specialized proxy firewalls more effective than general-purpose
HTTP proxy firewalls for HTTP requests
SMTP proxy firewalls for SMTP emails
FTP proxy firewall for FTP-based file transfer requests
Prevent malware attacks IP-H IP-H
TCP-H
UDP-H Application Layer Message Application Layer Message
HTTP Proxy
Browser Webserver
Application
1. HTTP Request 2. Passed inspected
HTTP Request
3. HTTP Response 4. Passed inspected
HTTP Response Log
File
12
Types of Firewalls (cont.)
Network Address Translation Firewall
Replace IP address in outgoing message by a spoof IP address
Hide internal hosts’ IP address to outsiders
Help prevent IP spoofing attacks using internal IP addresses
Host IP Address Outgoing IP Address Request ID
135.12.23.12 135.12.20.1 120121
135.12.22.2 135.12.20.2 120122
135.12.21.3 135.12.20.3 120123
…….. …….. ………
135.12.20.1 135.12.20.2 135.12.20.3 135.12.23.12
135.12.22.2
135.12.21.3
13
Network Address Translation (Cont)
Server Host Client
192.168.5.7
NAT Firewall 1
Internet 2
Sniffer From 192.168.5.7,
Port 61000 From 60.5.9.8, Port 55380
IP Addr 192.168.5.7
. . . Port 61000
. . . Internal
IP Addr 60.5.9.8 . . .
Port 55380
. . . External
Translation Table
14
Network Address Translation (Cont)
Server Host Client
192.168.5.7
NAT Firewall
3
Internet
4 Sniffer
To 60.5.9.8, Port 55380 To 192.168.5.7,
Port 61000
IP Addr 192.168.5.7
. . . Port 61000
. . . Internal
IP Addr 60.5.9.8 . . .
Port 55380
. . . External
Translation Table
15
Perspective on NAT
NAT/PAT
NAT does more than network (IP) address translation
Also does port number translation
Should be called NAT/PAT, but NAT is the
common term
16
Firewalls configuration
Default configuration (default Rulesets or ACLs)
Pass connections initiated by an internal host
Deny connections initiated by an external host
Can change default configuration with access control lists (ACLs) for ingress and egress filtering
ACLs are sets of IF-THEN rules applied in sequential order
Internet Automatically Pass Connection Attempt
Router
Automatically Deny Connection Attempt
17
Ingress ACL
1 If Source IP Address = 10.*.*.*, DENY [Private IP Address Range]
2 If Source IP Address = 172.16.*.*, DENY [Private IP Address Range]
3 If Source IP Address = 192.168.*.*, DENY [Private IP Address Range]
4 If DestinationIP Address = 60.47.3.9 AND TCP Destination Port = 80 or 443, PASS 5 If DestinationIP Address = 60.47.*.*, DENY
6 If Incoming packet TCP SYN = 1 and ACK= 0, DENY [Attempt to open connection form the outside]
7 If TCP Destination Port = 20, DENY 8 If TCP Destination Port = 135 Trough 139, DENY 9 If UDP Destination Port = 69, DENY
10 DENY ALL
Untrusted network Trusted network
Firewall
60.47.3.1
60.47.3.2
60.47.3.5
60.47.3.9
Port Number Primary Protocol Application
20 TCP FTP Data Traffic
21 TCP FTP Supervisory Connection. Passwords sent in the clear
23 TCP Telnet. Passwords sent in the clear
25 TCP Simple Mail Transfer Protocol (SMTP)
69 UDP Trivial File Transfer Protocol (TFTP). No login necessary
80 TCP Hypertext Transfer Protocol (HTTP)
137-139 TCP NETBIOS service for peer-to-peer file sharing in older versions of Windows
443 TCP HTTP over SSL/TLS
18
Ingress ACL
1 If Source IP Address = 10.*.*.*, DENY [Private IP Address Range]
2 If Source IP Address = 172.16.*.*, DENY [Private IP Address Range]
3 If Source IP Address = 192.168.*.*, DENY [Private IP Address Range]
4 If DestinationIP Address = 60.47.3.9 AND TCP Destination Port = 80 or 443, PASS 5 If DestinationIP Address = 60.47.*.*, DENY
6 If Incoming packet TCP SYN = 1 and ACK= 0, DENY [Attempt to open connection form the outside]
7 If TCP Destination Port = 20, DENY 8 If TCP Destination Port = 135 Trough 139, DENY 9 If UDP Destination Port = 69, DENY
10 DENY ALL
Untrusted network Trusted network
Firewall
60.47.3.1
60.47.3.2
60.47.3.5
60.47.3.9
What kind of messages does Rule 7 block?
Why does Rule 5 have to come afterRule 4?
Why does Rule 6 have to come afterRule 4?
You work as the security administrator for the trusted network. Employees often download files from a FTP (File Transfer Protocol) server located in the untrusted network. What TCP port do you open in the firewall configuration?
a) Open port 69 to all inbound connections.
b) Open port 69 to all outbound connections.
c) Open port 20/21 to all inbound connections.
d) Open port 20/21 to all outbound connections.
19
Typical attacks and firewall config.
Attacks Typical configuration Comments
Ping of death Any packet with Total Length more than maximum allowed is dropped Stateful firewall
IP fragmentation- based attacks (e.g. Teardrop)
The firewall intercepts all fragments for an IP packet and attempts to reassemble them before forwarding to destination. If any problems or errors are found during reassembly, the fragments are dropped.
Stateful firewall
Smurf Attack The firewall drops any ping responses that are not part of an active session.
Stateful firewall
Attacks that send TCP URG packets
Any TCP packets that have the URG flag set are discarded by the firewall.
Land Attack Any packets with the same source and destination IP addresses are discarded.
IP broadcast Packets with a broadcast source or destination IP address are discarded.
TCP SYN/ACK attack
TCP Opening segments that have SYN and ACK flags set AND that are not linked to a TCP SYN request are discarded.
Stateful firewall
Invalid TCP Segment Number
The sequence numbers for every active TCP session are maintained in the firewall session database. If the firewall received a segment with an unexpected (or invalid) sequence number, the packet is dropped.
Stateful firewall
Flag Fields (6 bits)
ACK SYN FIN RST
URG PSH
20
Firewall Principles
Danger of Overload
If a firewall is overloaded and cannot handle the traffic, it drops unprocessed packets
This is the safest choice, because attack packets cannot enter the network
However, this creates a self-inflicted denial- of-service attack
21
Firewall Principles (Continued)
Danger of Overload
So firewalls must have the capacity to handle the traffic
Some can handle normal traffic but cannot handle traffic during heavy attacks
Need to regularly check firewalls logs:
If too much unchecked packets are dropped,
then need to upgrade the firewall.
22
Centralized Firewall Management System
Internet
Home PC Firewall Management Console
Site A Site B
Remote Management is needed to reduce management labor
Dangerous because if an attacker compromises
it, they own the network
Remote PCs must be actively
managed centrally
23
Firewall Management
Firewalls are Ineffective without Planning and Maintenance
Planning
Asset Assessment: identify all assets and their relative sensitivities
Threat Assessment: what threats can attack each asset?
Design a Firewall Policy for Each Asset
Design a Firewall Architecture
24
Firewall Management (Continued)
Implementation
Firewall Operating System Hardening
Firewall appliances are hardened at the factory
Firewall vendors often sell firewalls that are general-purpose computers that have pre- hardened versions of Unix or Windows
If a firm purchases a general purpose
computer and firewall software, strong actions
must be taken to harden the operating system
25
Firewall Management (Continued)
Implementation
Select Implementation Options
e.g., Turn off remote management if not needed
Firewall ACL Rule Configuration
Complex and therefore error-prone
Driven by firewall policies
Vulnerability Testing After Configuration
Must do vulnerability test even after “trivial” changes
Driven by firewall policies
26
Firewall Management (Continued)
Maintenance
Constantly change firewall policies and ACLs to deal with new threats
Document each change carefully!
Read log files daily to understand the current threat environment
Read log files daily to detect problems (the dropping of legitimate traffic, etc.)
Update the firewall software when there are new releases
27
Firewalls, IDSs, and IPSs
Firewalls IDSs IPSs
Drops Packets? Yes No Yes
Logs Packets Yes Yes Yes
Sophistication in Filtering
Medium High High
Creates Alarms? No Yes Sometimes
28
Firewalls, IDSs, and IPSs (Cont)
Sophistication in Filtering
Message stream analysis, not just individual packets
Reassemble fragmented application messages
