ITECH2108 Topic 10

Firewalls

Advanced Network Services

Topic 10 - Firewalls

17:24 ( 1 of 24)

What is a firewall?
It is not a virus scanner
Although it might include that

It is not a secure communication system

A firewall regulates network traffic
At some network boundary
In and out of your home computer
Through your broadband router
Through a computer configured as router
Advanced Network Services

Topic 10 - Firewalls

Classes of firewall
Network layer

- our focus

Inspect each packet at the network & transport layer

Accept/reject according to rules

Application layer
Particular to an application
Eg ftp, telnet

Filter on content

Stateless/Stateful
Keeps a check on responses relative to requests
Advanced Network Services

Topic 10 - Firewalls

Stateful example
Consider user accessing Web site
Stateless firewall will need to say:
All outbound port 80 traffic OK
All inbound non-SYN traffic OK

Stateful firewall can say:

All outbound port 80 traffic OK
Inbound traffic for open connections OK
Advanced Network Services

Topic 10 - Firewalls

What kind of attacks?

Denial of Service (DOS)
Anything that ties up server resources
Why?
To slow things down
To distract for some other attack

TCP connect to listening port

Once connected attempt to break in
Buffer overflow might allow attackers code to execute

Many, many others

Advanced Network Services

Topic 10 - Firewalls

Packet-level operations
A network layer firewall involves
inspection of each packet
Where does this occur?
In the OS kernel
Privileged operation
Requires root/Administrator login

In User Space
More relaxed
Advanced Network Services

Topic 10 - Firewalls

How its done on Windows

User

Networking Application

W2K packet
filtering interface

winsock
Transport Driver Interface
Kernel

TCPIP driver

Application
layer firewall

Network layer
firewall

NDIS Driver

Advanced Network Services

Topic 10 - Firewalls

How its done on Linux

Same User/Kernel split
Kernel includes netfilter hooks
Kernel filtering controlled by user space
programs
ipfw
ipchains
iptables
This is what we will study
Advanced Network Services

Topic 10 - Firewalls

ipfw
The earliest framework for configuring
netfilter
Still used in BSD Unix
Cant handle non-IP rules

Simple rule format

add 1000 allow all from any to any
allow,
Rule number
deny,
lowest number
reset,
that fits is
count
followed
Advanced Network Services

Type
eg tcp,
icmp..

Source
& Dest

Topic 10 - Firewalls

ipchains netfilter architecture

Packets move through the kernel and can
have rules from a chain applied
input

To be
routed?

Process
Advanced Network Services

forward

output
Topic 10 - Firewalls

ipchains why not?

The main disadvantages of ipchains
Excessive activity for the input chain rules
Because they are applied before the routing decision

Only stateless rules can be defined

Not extensible
What about completely new criteria?
No way to add them

Note lower case chain names

Advanced Network Services

Topic 10 - Firewalls

iptables netfilter architecture

An improved flowchart for packets allows
less use of the INPUT chain
To be
routed?

INPUT
Advanced Network Services

FORWARD

Process

OUTPUT
Topic 10 - Firewalls

Adding two more steps

The extra steps are places that we could
apply rules like NAT
PREROUTING

To be
routed?

INPUT

Advanced Network Services

POSTROUTING

FORWARD

Process

Topic 10 - Firewalls

OUTPUT

So what are the tables?

In iptables tables are a collection of chains
There are 3 built-in tables:
filter
INPUT, OUTPUT and FORWARD chains

nat
PREROUTING, POSTROUTING and OUTPUT
chains

mangle (other changes in packets eg QoS

options)
All the chains!
Advanced Network Services

Topic 10 - Firewalls

iptables rule format

[command-type] [pattern-match-options] -j [target]

Add, delete, list

etc on a
specified chain
Advanced Network Services

Protocol, port,
interface and
many other
options

DROP, REJECT,
ACCEPT,
LOG

Topic 10 - Firewalls

iptables command types

-L <chain>
List rules in chain

-F <chain>
Flush all rules from the chan

-P <chain>
Set policy for chain (eg ACCEPT, REJECT)
Compare with ipfw approach

-A <chain>
Add (append) a rule to the chain (insert I and replace R also)

-D <chain> <rule number>

Delete a rule from the chain

-N <chain name>
Create a new chain
Advanced Network Services

Topic 10 - Firewalls

iptables pattern match options

Unbounded given the extensibility but.
-p [protocol]
tcp, udp or icmp.

-d [address / mask], -s [address / mask]

Destination/source address

--dport [port], --sport [port]

Destination/source port

-i [interface], -o [interface]

eth0, wlan0 a standard Linux interface in or out

-m state --state state_type

For tcp: NEW, ESTABLISHED For icmp: RELATED

-icmp-type [typename]

Such as ECHO, REPLY

Advanced Network Services

Topic 10 - Firewalls

iptables targets
ACCEPT
Stop processing let the packet through

DROP
Stop processing - silently

LOG
Make an entry in the log

REJECT
Stop processing and try to reply with an appropriate message

DNAT
Modify packet with specified dest address for Destination NAT

SNAT
Modify packet with specified source address for Source NAT

MASQUERADE
Modify packet with dynamically assigned source address
Advanced Network Services

Topic 10 - Firewalls

Saving the rules

The rules you have created can be saved to
/etc/sysconfig/iptables
Use:
service iptables save

These rules will be re-established at startup

Advanced Network Services

Topic 10 - Firewalls

Reading some rules

# Allow all loopback (lo0) traffic
-A INPUT -i lo -j ACCEPT
# Accept all established connections
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow all outbound traffic
-A OUTPUT -j ACCEPT
# Accept all SSH and Web server connections
-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
# Reject and log all other inbound
-A INPUT -j LOG
-A INPUT -j REJECT
-A FORWARD -j LOG
-A FORWARD -j REJECT
Advanced Network Services

Topic 10 - Firewalls

The nat table

iptables -t nat -A POSTROUTING
-o ppp0 -j MASQUERADE
This single entry does it

nat table
append rule
POSTROUTING chain
Dial up interface
MASQUERADE
The right kind of mangling

Advanced Network Services

Topic 10 - Firewalls

Easing rule writing

iptables rules are quite hard to write!
Firewall Builder
On ADIOS and can be downloaded for
Windows it creates rules in a generalised
XML format and then compiles them into rules
for a specific platform (eg iptables on Linux)
Although the tool is available for Windows too
the actual firewall will always be on Linux
Advanced Network Services

Topic 10 - Firewalls

The lab
Build a test environment
NAT
Router
A
(Linux)
Public
address

Client
(Linux or
Windows)

192.168.a.1
192.168.a.2

Apply Linux firewalls

Advanced Network Services

Topic 10 - Firewalls

Virtual machines to the rescue

User Mode Linux (UML)

Advanced Network Services

Topic 10 - Firewalls