Hands-On Network Security: Practical Tools & Methods Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012
Hands-On Network Security Module 6 Firewalls & VPNs
Topics • Firewall Fundamentals • Case study: Linux iptables • Virtual Private Networks (VPNs) 04/12 cja 2012 3
Firewalls 04/12 cja 2012 4
Firewalls 04/12 cja 2012 5
Firewalls • A firewall limits the extent to which hosts on different networks can interact with one another 04/12 cja 2012 6
Types of firewalls • Packet level • Application level • Host-based 04/12 cja 2012 7
Packet level firewalls • Firewall inspects incoming packets • Blocks packets violating policy rules => packets dropped without acknowledgement • Rules allow blocking based on Source and destination IP address Source and destination port Protocol, flags, TOS, … 04/12 cja 2012 8
Statelessness • Traditional packet level firewalls treated every packet independently Stateless firewalling • Problem Doesn ’ t relate packet information to overall packet flow Doesn ’ t remember anything • Results in coarse-grained control Forces overly liberal or conservative policies 04/12 cja 2012 9
Example • H.323 video streaming protocol Initiates two TCP connections and several RTP (real-time transport protocol) streams The RTP streams contain no information relating them to the H.323 application How should a stateless firewall decide if these streams are to be blocked? 04/12 cja 2012 10
Example • IP Fragmentation All but the first fragment don ’ t specify ports 04/12 cja 2012 11
Statefulness • Solution: firewall keeps state about recent packet flows Decides to block packet based on packet contents plus stored state More fine-grained control Obviates application-level firewalls • Problem All that state consumes firewall resources 04/12 cja 2012 12
Canonical firewalled network 04/12 cja 2012 13
Zones Collection of networks with specified security properties • Perimeter • DMZ • Wireless • Intranet 04/12 cja 2012 14
Perimeter zone The outside world Untrusted zone No control over hosts in this zone Internet rules 04/12 cja 2012 15
DMZ Demilitarized zone • Contains an organization ’ s publicly visible services (email, Web, DNS, FTP, …) Hardened hosts Proxies • Semi-trusted zone 04/12 cja 2012 16
Intranet zone • Most trusted zone • Organizational assets placed here • Access blocked from untrusted zones Access via proxies in the DMZ only 04/12 cja 2012 17
Wireless zone A perimeter zone! • Untrusted hosts • Semi-trusted network 04/12 cja 2012 18
Application-level firewalls Application proxy server • Accepts client traffic • Maintains state, validates traffic • Passes validated traffic to server 04/12 cja 2012 19
Application-level firewalls • Firewall worries about security Obviates security-related server changes Hampers defense-in-depth • Firewall must understand application protocol Increased complexity • Stateful packet-level firewalls are an alternative 04/12 cja 2012 20
Host-based firewalls • Firewall run on individual hosts • Placed between incoming packets and the host network stack • Acts like a packet-level firewall 04/12 cja 2012 21
Host-based firewalls • Each host requires policy management Administration headache Simple default policies in distributions • Defense-in-depth 04/12 cja 2012 22
References • The Tao of Network Security Monitoring, Richard Bejtlich, Addison-Wesley, 2005. ISBN 0-321-24677-2 • Information Security Illuminated, Michael G.Solomon and Mike Chapple, Jones and Bartlett, 2005. • http://en.wikipedia.org/wiki/Firewall_(computing) (accessed April 2010) 04/12 cja 2012 23
iptables 04/12 cja 2012 24
IP Tables • Linux packet-level firewall • Successor to IP Chains • NAT/NAPT support • Extended functionality via modules • Stateful filter support • Applications Host based firewall Stateful packet firewall net.ipv4.ip_forward=1 in /etc/sysctl.conf 04/12 cja 2012 25
IP Tables Architecture • Three tables for organization filter, nat, mangle • Each table contains several chains built-in (invoked at fixed points in network layer) user-defined • Each chain contains several rules first rule matched determines action taken • Each rule contains matching criteria and target • Built-in chains have policies specifies default target if no rule in chain matches 04/12 cja 2012 26
Rules • (Standard) matching criteria protocol source IP (address/mask) dest IP (address/mask) port (source/dest/both) interface (input/output) • Target 04/12 cja 2012 27
Rules • Extended matching criteria Implemented via modules • Connection state matching INVALID packet not associated with any connection NEW packet is starting a new connection ESTABLISHED packet is associated with existing connection RELATED packet is starting a new connection, but is associated with an existing connection » FTP DATA, ICMP error • Several other extended matching criteria 04/12 cja 2012 28
Predefined targets • All terminate processing in this chain for this packet ACCEPT accept packet for processing DROP drop packet QUEUE pass packet to userland (not common) RETURN return to calling chain (use policy if no calling chain) 04/12 cja 2012 29
Extended targets • Both terminating and non-terminating targets REJECT (terminating) return packet indicating error LOG (non-terminating) generate log entry … 04/12 cja 2012 30
filter table • Default table • Built-in chains INPUT incoming network packets FORWARD packets being routed by the host OUTPUT locally-generated packets output to network 04/12 cja 2012 31
nat table • For network address translation • Built-in chains PREROUTING (DNAT) alter packets as they arrive OUTPUT alter locally-generated packets before routing POSTROUTING (SNAT) alter packets as they depart 04/12 cja 2012 32
mangle table • For specialized packet changes change TOS/DSCP header set netfilter mark value … • Built-in chains PREROUTING INPUT OUTPUT FORWARDING POSTROUTING 04/12 cja 2012 33
Firewall traversal Prerouting Input Route Local Forward Output Postrouting 04/12 cja 2012 34
Firewall Traversal Rob Mayoff 04/12 cja 2012 35
Some caveats • iptables and ipchains don ’ t mix • rule additions are atomic … rule set additions are not • avoid leaving firewall open while editing … use DROP, DENY, REJECT policies • policy actions do not log • rules are not removed when an interface goes down • raw sockets are unaffected by rules 04/12 cja 2012 36
iptables lab • Examine iptables man page man iptables • Examine existing firewall settings sudo service iptables status sudo iptables –L [-v] [–n] [–-line-numbers] 04/12 cja 2012 37
iptables lab 1. Add firewall rule(s) to allow outbound ssh to pst.merit.edu only 2. Add firewall rules(s) to allow root outbound ssh to anywhere 3. Add firewall rule(s) to limit non-root logins to pst.merit.edu to one at a time 4. Add firewall rule(s) to log all successful and unsuccessful outbound ssh attempts 04/12 cja 2012 38
Virtual Private Networks (VPNs) 04/12 cja 2012 39
Roadmap • Definition • VPN Uses • Types of VPNs • Protocol Details 04/12 cja 2012 40
Definition A VPN is a link over a shared public network, typically the Internet, that simulates the behavior of dedicated WAN links over leased lines. A VPN uses encryption to authenticate the communications endpoints and to secure your data as it travels over an insecure network . 04/12 cja 2012 41
VPN motivators • Confidentiality, Integrity & Authentication Encryption • Bypass blocks Border Local ISP • Extends the office network VoIP Drive mapping • Collaboration • Enabling technology 04/12 cja 2012 42
Some VPNs • Protocol IPSec Standards-based Varied Encryption Levels Flexible SSL Clientless (Web Browser) • Application SSH VPN is not a single solution 04/12 cja 2012 43
IPSec Details IPSec protocol • Internet Standard • Two complementary protocols Authentication Headers (AH) Prevents tampering with packet headers Encapsulating Security Protocol (ESP) Provides confidentiality and integrity of packet contents 04/12 cja 2012 44
Recommend
More recommend
