8: network management1 firewalls. 8: network management2 firewalls two firewall types: m packet...

8: Network Management 1

Firewalls


Firewalls

Two firewall types: packet filter application

gateways

To prevent denial of service attacks: SYN flooding: attacker

establishes many bogus TCP connections. Attacked host alloc’s TCP buffers for bogus connections, none left for “real” connections.

To prevent illegal modification of internal data. e.g., attacker replaces

CIA’s homepage with something else

To prevent intruders from obtaining secret info.

isolates organization’s internal net from larger Internet, allowing some packets to pass, blocking others.

firewall


Packet Filtering

Internal network is connected to Internet through a router.

Router manufacturer provides options for filtering packets, based on: source IP address destination IP address TCP/UDP source and

destination port numbers

ICMP message type TCP SYN and ACK bits

Example 1: block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23. All incoming and outgoing

UDP flows and telnet connections are blocked.

Example 2: Block inbound TCP segments with ACK=0. Prevents external clients

from making TCP connections with internal clients, but allows internal clients to connect to outside.


Application gateways

Filters packets on application data as well as on IP/TCP/UDP fields.

Example: allow select internal users to telnet outside.

host-to-gatewaytelnet session

gateway-to-remote host telnet session

applicationgateway

router and filter

1. Require all telnet users to telnet through gateway.2. For authorized users, gateway sets up telnet

connection to dest host. Gateway relays data between 2 connections

3. Router filter blocks all telnet connections not originating from gateway.


Limitations of firewalls and gateways

IP spoofing: router can’t know if data “really” comes from claimed source

If multiple app’s. need special treatment, each has own app. gateway.

Client software must know how to contact gateway. e.g., must set IP address

of proxy in Web browser

Filters often use all or nothing policy for UDP.

Tradeoff: degree of communication with outside world, level of security

Many highly protected sites still suffer from attacks.


참고자료 : Firewalls


Acknowledgements

Professor Insup Lee

Department of Computer and Information Science

University of Pennsylvania [email protected] www.cis.upenn.edu/~lee

mailto:[email protected]







Why do we need firewalls?


BEFORE AFTER (your results may vary)


What is a firewall?

Two goals: To provide the people in your organization with

access to the WWW without allowing the entire world to peak in;

To erect a barrier between an untrusted piece of software, your organization’s public Web server, and the sensitive information that resides on your private network.

Basic idea: Impose a specifically configured gateway machine

between the outside world and the site’s inner network.

All traffic must first go to the gateway, where software decide whether to allow or reject.


What is a firewall

A firewall is a system of hardware and software components designed to restrict access between or among networks, most often between the Internet and a private Internet.

The firewall is part of an overall security policy that creates a perimeter defense designed to protect the information resources of the organization.


Firewalls DO

Implement security policies at a single point Monitor security-related events (audit, log) Provide strong authentication Allow virtual private networks Have a specially hardened/secured operating

system


Firewalls DON’T

Protect against attacks that bypass the firewall Dial-out from internal host to an ISP

Protect against internal threats disgruntled employee Insider cooperates with and external attacker

Protect against the transfer of virus-infected programs or files


Types of Firewalls

Packet-Filtering Router Application-Level Gateway Circuit-Level Gateway Hybrid Firewalls


Packet Filtering Routers

• Forward or discard IP packet according a set of rules

• Filtering rules are based on fields in the IP and transport header


What information is used for filtering decision?

Source IP address (IP header) Destination IP address (IP header) Protocol Type Source port (TCP or UDP header) Destination port (TCP or UDP header) ACK. bit


Web Access Through a Packet Filter Firewall

[Stein]


Packet Filtering Routerspros and cons Advantages:

Simple Low cost Transparent to user

Disadvantages: Hard to configure filtering rules Hard to test filtering rules Don’t hide network topology(due to transparency) May not be able to provide enough control over traffic Throughput of a router decreases as the number of filters

increases


Application Level Gateways (Proxy Server)


A Telnet Proxy


A sample telnet session


Application Level Gateways (Proxy Server) Advantages:

complete control over each service (FTP/HTTP…) complete control over which services are permitted Strong user authentication (Smart Cards etc.) Easy to log and audit at the application level Filtering rules are easy to configure and test

Disadvantages: A separate proxy must be installed for each

application-level service Not transparent to users


Circuit Level Gateways


Circuit Level Gateways (2)

Often used for outgoing connections where the system administrator trusts the internal users

The chief advantage is that a firewall can be configured as a hybrid gateway supporting application-level/proxy services for inbound connections and circuit-level functions for outbound connections


Hybrid Firewalls

In practice, many of today's commercial firewalls use a combination of these techniques.

Examples: A product that originated as a packet-

filtering firewall may since have been enhanced with smart filtering at the application level.

Application proxies in established areas such as FTP may augment an inspection-based filtering scheme.


Firewall Configurations

Bastion host a system identified by firewall administrator as a

critical strong point in the network’s security typically serves as a platform for an application-level or

circuit-level gateway extra secure O/S, tougher to break into

Dual homed gateway Two network interface cards: one to the outer network

and the other to the inner A proxy selectively forwards packets

Screened host firewall system Uses a network router to forward all traffic from the

outer and inner networks to the gateway machine Screened-subnet firewall system


Dual-homed gateway


Screened-host gateway


Screened Host Firewall


Screened Subnet Firewall


Screened subnet gateway


Selecting a firewall system

Operating system Protocols handled Filter types Logging Administration Simplicity Tunneling


Commercial Firewall Systems

0%5%

10%15%20%25%30%35%40%45%

Chec

k

Poin

t

Cis

co

Axen

t

Net

wor

k

Ass

ocia

tes

Cyb

er

Gua

rd

Oth

ers


Widely used commercial firewalls AltaVista BorderWare (Secure Computing

Corporation) CyberGurad Firewall (CyberGuard

Corporation) Eagle (Raptor Systems) Firewall-1 (Checkpoint Software

Technologies) Gauntlet (Trusted Information Systems) ON Guard (ON Technology Corporation)


Firewall’s security policy

Embodied in the filters that allow or deny passages to network traffic

Filters are implemented as proxy programs. Application-level proxies

• one for particular communication protocol• E.g., HTTP, FTP, SM• Can also filter based on IP addresses

Circuit-level proxies• Lower-level, general purpose programs that treat

packets as black boxes to be forward or not• Only looks at header information• Advantages: speed and generality• One proxy can handle many protocols


Configure a Firewall (1)

Outgoing Web Access Outgoing connections through a packet

filter firewall Outgoing connections through an

application-level proxy Outgoing connections through a circuit

proxy


Firewall Proxy

Configuring Netscape to use a firewall proxy involves enteringthe address and port number for each proxied service. [Stein]


Configure a Firewall (2)

Incoming Web Access The “Judas” server The “Sacrificial Lamb” The “Private Affair” server The doubly fortified server


The “Judas” Server (not recommended)

[Stein]


The “sacrificial lamb”

[Stein]


The “private affair” server

[Stein]


Internal Firewall

An Internal Firewall protects the Web server from insider threats.

[Stein]


Placing the sacrificial lamb in

the demilitarized zone.

[Stein]


Poking holes in the firewall

If you need to support a public Web server, but no place to put other than inside the firewall.

Problem: if the server is compromised, then you are cooked.


Simplified Screened-Host Firewall Filter Rules

[Stein]


Filter Rule Exceptions for Incoming Web Services

[Stein]


Screened subnetwork

Placing the Web server on its own screened subnetwork insulatesit from your organization while granting the outside world limitedaccess to it. [Stein]


Filter Rules for a Screened Public Web Server

[Stein]

8: network management1 firewalls. 8: network management2 firewalls two firewall types: m packet...

Documents

telnet connections

telnet users

gateway relays data

bogus tcp connections

bogus connections

internal clients

internal users

private internet