Your SlideShare is downloading. ×
0
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
firewall
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

firewall

224

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
224
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
13
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Pertemuan-12 Firewall Jaringan Komputer Teknik Informatika Universitas Yudharta Pasuruan 2012 MOCHAMAD SIRODJUDIN, S.Kom, MM www.sirodjudin.com
  • 2. What is a firewall? A firewall is a device (or software feature) designed to control the flow of traffic into and out-of a network. In general, firewalls are installed to prevent attacks. 12/13/13 2
  • 3. What’s a DMZ? A DMZ is a demilitarized zone. The DMZ is where corporate servers reside, protected from both external and internal attacks. In our case, internal attacks could come from compromised machines. That never happens, does it… 12/13/13 3
  • 4. What is an attack? 1. 2. 3. 4. Attack covers many things: Someone probing a network for computers. Someone attempting to crash services on a computer. Someone attempting to crash a computer (Win nuke). Someone attempting to gain access to a computer to use resources or information. 12/13/13 4
  • 5. Diagram of a firewall on a network. Without a DMZ 12/13/13 5
  • 6. Diagram of a firewall on a network. With a DMZ DMZ 12/13/13 6
  • 7. Edge Firewall An edge firewall is usually software running on a server or workstation. An edge firewall protects a single computer from attacks directed against it. Examples of these firewalls are: ZoneAlarm BlackIce IPFW on OSX 12/13/13 7
  • 8. Firewall Appliance An appliance firewall is a device whose sole function is to act as a firewall. Examples of these firewalls are: Cisco PIX. Netscreen series. 12/13/13 8
  • 9. Network Firewall • Router/Bridge based Firewall – A firewall running on a bridge or a router protects from a group of devices to an entire network. Cisco has firewall feature sets in their IOS operating system. • Computer-based Network Firewall – A network firewall runs on a computer (such as a PC or Unix computer). These firewalls are some of the most flexible. Many free products are available including IPFilter (the first package we tried), PF (the current package we are using found on OpenBSD 3.0 and later) and IPTables (found on Linux). Commercial products include: Checkpoint Firewall-1. Apple OSX includes IPFW (included in an operating system you gotta purchase). 12/13/13 9
  • 10. Why use a firewall? • Protect a wide range of machines from general probes and many attacks. • Provides some protection for machines lacking in security. 12/13/13 10
  • 11. Great first line of defense. • Having a firewall is a necessary evil. It’s like living in a gated community. The gate may stop 99% of unwanted visitors. The locks on your doors stop the remaining 1% (maybe, but you get the idea). • Don’t let the firewall give you a false sense of security. Harden your machines by turning off services you don’t need. 12/13/13 11
  • 12. How does a firewall work? Blocks packets based on: Source IP Address or range of addresses. Source IP Port Destination IP Address or range of addresses. Destination IP Port Some allow higher layers up the OSI model. Other protocols (How would you filter DecNET anyway?). Common ports 80 443 20 & 21 23 22 25 12/13/13 HTTP HTTPS FTP (didn’t know 20 was for FTP, did you?) Telnet SSH SMTP 12
  • 13. Sample firewall rules Protected server: 134.71.1.25 Protected subnet: 134.71.1.0/24 $internal refers to the internal network interface on the firewall. $external refers to the external network interface on the firewall. 12/13/13 13
  • 14. Sample rules: Can you find the problem? (For this example, when a packet matches a rule, rule processing stops.) Pass in on $external from any proto tcp to 134.71.1.25 port = 80 Pass in on $external from any proto tcp to 134.71.1.25 port = 53 Pass in on $external from any proto udp to 134.71.1.25 port = 53 Pass in on $external from any proto tcp to 134.71.1.25 port = 25 Block in log on $external from any to 134.71.1.25 Block in on $external from any to 134.71.1.0/24 Pass in on $external from any proto tcp to 134.71.1.25 port = 22 Pass out on $internal from 134.71.1.0/24 to any keep state 12/13/13 14
  • 15. Sample rules: Can you find the problem? (For this example, when a rules matches a packet, rule processing stops.) Pass in on $external from any proto tcp to 134.71.1.25 port = 80 Pass in on $external from any proto tcp to 134.71.1.25 port = 53 Pass in on $external from any proto udp to 134.71.1.25 port = 53 Pass in on $external from any proto tcp to 134.71.1.25 port = 25 Block in log on $external from any to 134.71.1.25 Block in on $external from any to 134.71.1.0/24 Pass in on $external from any proto tcp to 134.71.1.25 port = 22 Pass out on $internal from 134.71.1.0/24 to any keep state The SSH rule would never have a chance to be evaluated. All traffic to 134.71.1.25 is block with the previous two rules. 12/13/13 15
  • 16. To log or not to log… Logging is both good and bad. If you set your rules to log too much, your logs will not be examined. If you log too little, you won’t see things you need. If you don’t log, you have no information on how your firewall is operating. 12/13/13 16
  • 17. Sample log file Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 11:00:06 11:00:07 11:00:08 11:00:10 11:00:15 11:50:02 11:50:02 11:50:02 11:50:05 11:50:17 11:50:20 11:50:20 11:50:24 11:50:24 11:50:27 11:50:27 11:50:30 11:50:30 11:52:48 11:52:51 11:52:54 11:52:56 11:52:57 11:53:00 12:00:24 12:00:26 12:00:28 12:00:34 12:00:46 12/13/13 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: 11:00:06.786765 11:00:07.366515 11:00:08.526751 11:00:10.856705 11:00:15.515785 11:50:02.619311 11:50:02.629271 11:50:02.642610 11:50:05.633338 11:50:16.882433 11:50:20.401561 11:50:20.414682 11:50:24.127364 11:50:24.144581 11:50:27.761458 11:50:27.778617 11:50:30.771581 11:50:30.772833 11:52:47.511993 11:52:50.501969 11:52:53.501498 11:52:55.703527 11:52:56.500682 11:52:59.500694 12:00:24.220209 12:00:26.040009 12:00:28.794944 12:00:34.302899 12:00:45.284181 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 xl0 @1:10 b 134.71.4.100,50258 -> 134.71.202.57,23 PR tcp len 20 48 -S IN @1:10 b 134.71.4.100,50258 -> 134.71.202.57,23 PR tcp len 20 48 -S IN @1:10 b 134.71.4.100,50258 -> 134.71.202.57,23 PR tcp len 20 48 -S IN @1:10 b 134.71.4.100,50258 -> 134.71.202.57,23 PR tcp len 20 48 -S IN @1:10 b 134.71.4.100,50258 -> 134.71.202.57,23 PR tcp len 20 48 -S IN @0:3 b 213.244.12.136,4588 -> 134.71.202.37,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,4597 -> 134.71.202.44,80 PR tcp len 20 44 -S IN @1:10 b 213.244.12.136,4610 -> 134.71.202.57,80 PR tcp len 20 44 -S IN @1:10 b 213.244.12.136,4610 -> 134.71.202.57,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,1406 -> 134.71.203.35,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,1688 -> 134.71.203.47,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,1701 -> 134.71.203.60,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,1944 -> 134.71.203.103,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,1957 -> 134.71.203.108,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,2243 -> 134.71.203.168,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,2260 -> 134.71.203.185,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,2243 -> 134.71.203.168,80 PR tcp len 20 44 -S IN @0:3 b 213.244.12.136,2260 -> 134.71.203.185,80 PR tcp len 20 44 -S IN @1:10 b 207.45.69.69,1610 -> 134.71.202.57,113 PR tcp len 20 44 -S IN @1:10 b 207.45.69.69,1610 -> 134.71.202.57,113 PR tcp len 20 44 -S IN @1:10 b 207.45.69.69,1610 -> 134.71.202.57,113 PR tcp len 20 44 -S IN @1:10 b 142.163.9.225,6346 -> 134.71.202.57,3343 PR tcp len 20 40 -A IN @1:10 b 207.45.69.69,1610 -> 134.71.202.57,113 PR tcp len 20 44 -S IN @1:10 b 207.45.69.69,1610 -> 134.71.202.57,113 PR tcp len 20 44 -S IN @1:10 b 65.31.146.125,55989 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN @1:10 b 65.31.146.125,55989 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN @1:10 b 65.31.146.125,55989 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN @1:10 b 65.31.146.125,55989 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN @1:10 b 65.31.146.125,55989 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN 17
  • 18. Had enough yet? Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul Jul 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 12:00:58 12:01:01 12:01:01 12:01:03 12:01:03 12:01:05 12:01:05 12:01:06 12:01:07 12:01:07 12:01:08 12:01:08 12:01:09 12:01:09 12:01:12 12:01:14 12:01:14 12:01:28 12:01:29 12:01:36 12:01:39 12:02:02 12:02:05 12:02:10 12:02:11 12:02:13 12:02:14 12:02:20 12:07:59 12:33:33 12/13/13 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 kd2 ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: ipmon[14110]: 12:00:58.200613 12:01:00.236672 12:01:01.192960 12:01:02.868846 12:01:03.161480 12:01:05.010881 12:01:05.282234 12:01:05.796431 12:01:07.240923 12:01:07.251735 12:01:07.963357 12:01:08.229151 12:01:09.209297 12:01:09.212097 12:01:11.704343 12:01:13.969454 12:01:14.230632 12:01:28.256761 12:01:29.105610 12:01:36.257674 12:01:39.338642 12:02:02.588716 12:02:05.555511 12:02:10.610751 12:02:11.565107 12:02:13.530261 12:02:14.729242 12:02:19.529568 12:07:58.606378 12:33:32.920644 xl0 @1:10 b 24.27.2.83,3363 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 61.98.116.133,4510 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 24.27.2.83,3363 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 12.251.174.163,2403 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 61.98.116.133,4510 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 24.166.24.65,3816 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 24.159.69.143,1834 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 12.251.174.163,2403 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 24.27.2.83,3363 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 65.31.146.125,55989 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 24.166.24.65,3816 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 24.159.69.143,1834 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 65.31.146.125,55989 -> 134.71.202.57,10336 PR tcp len 20 65 -R IN xl0 @1:10 b 61.98.116.133,4510 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 12.251.174.163,2403 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 24.166.24.65,3816 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 24.159.69.143,1834 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 166.102.153.16,4886 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 166.102.153.16,4886 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 166.102.153.16,4886 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 134.71.204.115,3792 -> 134.71.202.57,1065 PR udp len 20 36 IN xl0 @1:10 b 66.25.162.252,2868 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 66.25.162.252,2868 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 68.69.142.167,2613 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 66.25.162.252,2868 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 68.69.142.167,2613 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN 2x xl0 @0:3 b 134.71.203.92,138 -> 134.71.203.255,138 PR udp len 20 269 IN xl0 @1:10 b 68.69.142.167,2613 -> 134.71.202.57,10336 PR tcp len 20 48 -S IN xl0 @1:10 b 65.80.163.98,60325 -> 134.71.202.57,9074 PR tcp len 20 48 -S IN xl0 @0:3 b 80.145.78.83,4286 -> 134.71.202.47,80 PR tcp len 20 48 -S IN 18
  • 19. What is a state? When your computer makes a connection with another computer on the network, several things are exchanged including the source and destination ports. In a standard firewall configuration, most inbound ports are blocked. This would normally cause a problem with return traffic since the source port is randomly assigned (different from the destination port). A state is a dynamic rule created by the firewall containing the source-destination port combination, allowing the desired return traffic to pass the firewall. 12/13/13 19
  • 20. How many states can a computer have? A single computer could have hundreds of states depending on the number of established connections. Consider a server supporting POP3, FTP, WWW and Telnet/SSH access. It could have thousands of states. 12/13/13 20
  • 21. What happens without state? Without state, your request for traffic would leave the firewall but the reply would be blocked. 12/13/13 21
  • 22. Sample state table. kd2.ec.csupomona.edu - IP Filter: v3.4.28 Src = 0.0.0.0 Dest = 0.0.0.0 Proto = any Source IP Destination IP 134.71.202.57,4738 64.160.215.222,1677 134.71.202.57,4744 64.160.215.222,1677 134.71.202.57,1039 134.71.204.115,1410 134.71.203.168,138 134.71.203.255,138 134.71.202.57,4727 64.160.215.222,1677 134.71.203.168,137 134.71.203.255,137 134.71.202.57 239.255.255.250 134.71.202.57,137 134.71.203.255,137 134.71.202.57,1028 134.71.4.100,53 134.71.202.57,1038 216.136.175.142,5050 134.71.202.57,138 134.71.203.255,138 134.71.203.168,138 134.71.203.255,138 134.71.203.168,137 134.71.203.255,137 134.71.202.57,1036 239.255.255.250,1900 134.71.202.57 239.255.255.250 134.71.202.57,4727 64.160.215.222,1677 134.71.202.57,1031 134.71.184.58,445 134.71.202.57,1033 134.71.184.58,445 12/13/13 state top Sorted by = # bytes ST PR #pkts #bytes ttl 4/4 tcp 551 368024 119:59:56 4/4 tcp 399 258160 119:59:59 4/4 tcp 33 6872 119:59:16 0/0 udp 2 458 0:06 0/6 tcp 5 200 1:58:03 0/0 udp 2 156 0:13 0/0 igmp 1 32 1:20 0/0 udp 62 5844 1:51 0/0 udp 35 4910 0:11 4/4 tcp 35 4208 119:59:59 0/0 udp 16 3520 1:49 0/0 udp 14 3026 2:00 0/0 udp 16 1536 1:59 0/0 udp 7 1127 1:58 0/0 igmp 10 320 1:54 0/6 tcp 5 200 1:53:26 2/0 tcp 3 128 0:47 2/0 tcp 3 128 0:48 07:50:50 22
  • 23. Where does a firewall fit in the security model? The firewall is the first layer of defense in any security model. It should not be the only layer. A firewall can stop many attacks from reaching target machines. If an attack can’t reach its target, the attack is defeated. 12/13/13 23
  • 24. Ruleset design Two main approaches to designing a ruleset are: 1. Block everything then open holes. 2. Block nothing then close holes. 12/13/13 24
  • 25. Ruleset design – Block Everything Blocking everything provides the strongest security but the most inconvenience. Things break and people complain. The block everything method covers all bases but creates more work in figuring out how to make some applications work then opening holes. 12/13/13 25
  • 26. Ruleset design – Block Nothing Blocking nothing provides minimal security by only closing holes you can identify. Blocking nothing provides the least inconvenience to our users. Blocking nothing means you must spend time figuring out what you want to protect yourself from then closing each hole. 12/13/13 26
  • 27. What is IDS? IDS is an Intrusion Detection System. IDS can identify many attacks and traffic patterns crossing a border device. 12/13/13 27
  • 28. An IDS sounds good. Is it? Yes and no. An IDS can identify port scans, different web attacks, known buffer overflow attacks, etc. An IDS can also produce many false positive hits. AOL Instant Messenger triggers port scan hits because it talks to several AOL Ad servers within a few seconds. An IDS can create more information on a small network than a network administrator can deal with. 12/13/13 28
  • 29. Filtering between VLANs Tired of being scanned and attacked from people on-campus? Join the club. We are working on firewall features on our new routers. Our current routers lack the horsepower to handle the extra load. Designing an inter-VLAN firewall configuration will take a great deal of planning and discussion to ensure desired traffic isn’t blocked. 12/13/13 29
  • 30. Filtering bad traffic (RFC 1918, bad headers, options, etc.) Sending bad traffic or malformed packets is a form of attack easily blocked at a firewall. The firewall inspects every packet and rejects those that are not properly formed or are intentionally malformed, protecting devices that may be succeptible. 12/13/13 30
  • 31. Filtering bad traffic (RFC 1918, bad headers, options, etc.) Private IP address traffic should never be seen on our network. Our network uses a registered, valid, legal block of IP addresses. Private IP address blocks (RFC 1918): – 10.0.0.0 – 10.255.255.255 (255.0.0.0 mask) – 172.16.0.0 – 172.240.0.0 (255.240.0.0 mask) – 192.168.0.0 – 192.168.255.255 (255.255.0.0 mask) 12/13/13 31
  • 32. NAT (a small detour) Some firewalls provide a feature call Network Address Translation (NAT for short). NAT allows the use of an RFC1918 address on the Internet by tunneling the traffic through one or more valid addresses. 12/13/13 32
  • 33. Black hole or Return-RST (or how to respond to things you don’t want.) Should you tell a sending machine that their traffic was blocked or let them wait until they timeout? For some traffic, it’s better to let the sending machine wait. This slows down the rate of attack. For other traffic (such as SMTP) it may be nice to tell the sender that the SMTP port is closed. 12/13/13 33
  • 34. Poking holes How to allow traffic and expose yourself. OK. You’ve decided to block traffic. Do you have to block all traffic? No. You can allow select traffic in. The criteria for allowing traffic are the same as blocking traffic. 12/13/13 34
  • 35. Compromised Machines Just a note about compromised machines: When a machine is compromised, you have no way to determine exactly what was hacked. Cleaning what you think is the problem may not rid yourself of everything. Most instances require a reformat and reinstall of the operating system for proper cleaning. 12/13/13 35
  • 36. Honey Pots A honey pot is a machine sitting on the network for people to hack into. It allows you to watch how a machine can be hacked and (hopefully) learn from the experience. 12/13/13 36
  • 37. Where does the Campus Go from Here? • Campus border firewall. • Inter-VLAN firewall. • E-mail filtering through main campus servers. • Edge firewalls for now. 12/13/13 37
  • 38. PF on OpenBSD Our current firewall is a PC (really high powered) running OpenBSD 3.1. Since OpenBSD 3.0, PF (packet filter) has replaced IPF as the firewall of choice. PF provides stateful filtering of IP packets along with the ability to bridge between interfaces. 12/13/13 38
  • 39. Where can I find more information? • • • • • www.securityfocus.com www.snort.org www.arin.net www.iana.org www.sans.org 12/13/13 39

×