Network Firewalls CSCI 5931 Web Security Spring 2003

Network Firewalls CSCI 5931 - Web Security Spring 2003 Presented By Yasir Zahur 1

Agenda • Reference Monitor • Introduction • Types of Firewalls • • • Screening Routers Proxy Gateways Guard • Sample Configurations 2

Reference Monitor • Kernel is the heart of operating system • Security Kernel is responsible for enforcing security mechanisms of entire operating system • Portion of security kernel that controls accesses to objects is called reference monitor • Reference Monitor must be • • • Tamperproof Always invoked Small and simple enough for rigorous analysis 3

Reference Monitor (…cont) 4

First Line of Defense: The Firewall • Special form of reference monitor • Primary means of securing a private network against penetration from a public network • An access control device, performing perimeter security by deciding which packets are allowed or denied, and which must be modified before passing • Core of enterprise’s comprehensive security policy • Can monitor all traffic entering and leaving the private network, and alert the IT staff to any attempts to circumvent security or patterns of inappropriate use 5

Network Firewall Concept Violations Firewall System Legitimate Activity Your Domain 6

Types of Firewalls • Screening Routers (Packet Level Filters) • Proxy Gateways (Bastion Host) • Guards 7

Screening Routers • Simplest and in some cases most effective type of firewall. Most simple form includes Access control Lists (ACLs) and Network Address Translation (NAT) • Also called Packet Filter since filtering mechanism does not keep a record of interaction or a history of previous datagrams • A manager can list any combination of source IP address, destination IP address, protocol, source protocol port number, destination port protocol number as packet filter specification 8

Routers Screening Outside Addresses 9

Security Policy in Packet Filtering • A packet filter that allows a manager to specify which datagrams to block • • • Requires continuous monitoring and updates as number of well known ports are large and rapidly growing in number Certain services can assign port numbers dynamically e. g. RPC (Remote Procedure Call) Listing ports of well-known services leaves the firewall vulnerable to tunneling • The answer • Block all datagrams except those explicitly specified 10

Consequence Of Restricted Access For Clients • Each server operates at a well known port, a client • • does not A client attempts to communicate with a server outside the organization. Each outgoing datagram has client’s protocol port as source port and server’s protocol port as destination port. Firewall will not block such datagrams as they leave However, when response reaches back to firewall from outside, (with destination port now being client’s port) it will be blocked by the firewall since destination port is not approved 11

Proxy Gateway • A firewall that simulates the effects of an application • • by running “pseudo-applications” Because the firewall computer must be strongly fortified to serve as a secure communication channel, it is also called BASTION HOST To the inside it implements part of the application protocol to make itself look as if it is the outside connection To the outside it implements part of the application protocol to act just like the inside process would It also examines the contents, not just the header of the packet 12

Proxy Gateway Example. 1 • Consider Web access from an inside host • User cannot use a browser for direst access since firewall prevents user’s computer from receiving incoming datagrams • However organization uses web proxy server on Bastion Host • Browser on each host is configured to use proxy • Thus whenever user requests a URL, browser contacts proxy which in turn contacts outside server, obtains the page and delivers it to the inside host 13

Proxy Gateway Example. 2 • Consider a site that blocks all incoming TELNET and FTP • • connections using a packet filtering router. The router allows TELNET and FTP packets to go to one host only, the TELNET/FTP application gateway. An outside user first telnets to the application gateway and enters the name of an internal host, Gateway checks the user's source IP address and accepts or rejects it according to any access criteria in place, User may need to authenticate The proxy service creates a TELNET connection between the gateway and the internal host, The proxy service then passes bytes between the two connections, and The application gateway logs the connection 14

Proxy Gateway - Advantages • proxy services allow only those services through for which there • • is a proxy protocol can be filtered. Some firewalls, for example, can filter FTP connections and deny use of the FTP put command information hiding, in which the names of internal systems need not necessarily be made known via DNS to outside systems, only application gateway’s name must be known cost-effectiveness, because third-party software or hardware for authentication or logging need be located only at the application gateway application traffic can be pre-authenticated before it reaches internal hosts and can be logged more effectively than if logged with standard host logging 15

Guard • More “sophisticated” and “complex” proxy • • firewall Since it is more complex, code is more prone to error Can examine and interpret the contents of a packet Usually implements and enforces certain business policies E. g. enforcing email quota on proxy etc 16

Firewall Configuration. . 1 17

Firewall Configuration. . 2 18

References • Firewalls • • http: //www. cyber. ust. hk/fw-report 1/index. html Security In Computing, 2 nd Ed By Charles P. Pfleeger. Prentice Hall Internetworking with TCP/IP, Vol: 1 By Douglas E. Comer. Prentice Hall Network Security Presentation Slides By Andrew Yang http: //nas/yang/teaching/csci 5233 fall 02/index. htm#topics. Notes Presentation on Firewalls by Tom Longstaff Cert Coordination Center - Carnegie Mellon University http: //www. andrew. cmu. edu/course/95750/yihudoc/Lecture 6. ppt 19