Network Securit

Chapter 6

Firewall
Bandarlampung, Maret 2020

Jupriyadi, S.Kom. M.T.

[email protected]
0856 91 16 15 14
 Goals

–Gain a better understanding of what a firewall is.

–Understand different firewall types.
–Understand where firewalls fit.
–Firewall implementation using iptables
 What is a firewall?
A firewall is a device (or software feature) designed to
control the flow of traffic into and out-of a network.
In general, firewalls are installed to prevent attacks.
 What is an attack?
Attack covers many things:
1. Someone probing a network for computers.
2. Someone attempting to crash services on a computer.
3. Someone attempting to crash a computer
4. Someone attempting to gain access to a computer to
use resources or information.
 Why use a firewall?
• Protect a wide range of machines from general
probes and many attacks.
• Provides some protection for machines lacking
in security.
 Firewall Type
• Host based firewall
• Network Based Firewall
• Stand-alone Firewall
• Cloud Firewall
 How does a firewall work?
Blocks packets based on:
Source IP Address or range of addresses.
Source IP Port
Destination IP Address or range of addresses.
Destination IP Port
Some allow higher layers up the OSI model.
Other protocols (How would you filter DecNET anyway?).
Common ports
80 HTTP
443 HTTPS
20 & 21 FTP (didn’t know 20 was for FTP, did you?)
23 Telnet
22 SSH
25 SMTP
 Firewall Action
• A piece of software which looks at the header of
packets as they pass through and decides its
fate
– DROP
– ACCEPT
– Or something more complicated.
• Under Linux, packet filtering is built into the
kernel.
 Functions of Firewall
• Control
– Allow only those packets that you are interested to pass
through.
• Security
– Reject packets from malicious outsiders
• Ping of death
• telnet from outside
• Watchfulness
– Log packets to/from outside world
 Firewall under Linux
• 1st generation
– ipfw (from BSD)
• 2nd generation
– ipfwadm (Linux 2.0)
• 3rd generation
– ipchains (Linux 2.2)
• 4th generation
– iptable (Linux 2.4)
– In this lecture, we will concentrate on
iptable.
 Iptables
• Kernel starts with three lists of rules called
(firewall) chains.
– INPUT
– OUTPUT
– FORWARD
• Each rule say “if the packet header looks like
this, then here’s what to do”.
• If the rule doesn’t match the packet, then the
next packet will be consulted.
 Firewall Chains

Routing
Forward
Decision

Input Output

Local Process
Operations to manage whole chains
-N Create a new chain

-X Delete an empty chain

-P Change the policy for a built-in chain

-L List the rules in a chain

-F Flush the rules out of a chain

-Z Zero the packet and byte counters on all rules

in a chain
 Manipulate rules inside a chain
-A Append a new rule to a chain

-I Insert a new rule at some position in a chain

-R Replace a rule at some position in a chain

-D Delete a rule at some position in a chain

-D Delete the first rule that matches in a chain

Example
– Drop all ICMP packets coming from the IP
address 127.0.0.1
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.2 ms

--- 127.0.0.1 ping statistics ---

1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
# iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes

--- 127.0.0.1 ping statistics ---

1 packets transmitted, 0 packets received, 100% packet loss
#
 Filtering Specifications
Specifying Source and Destination IP address
– Source
• -s, --source or –src
– Destination
• -d, --destination or –dst
– IP address can be specified in four ways.
• Full name (e.g. www.cse.cuhk.edu.hk)
• IP address (e.g. 127.0.0.1)
 Filtering Specifications Cont’d
• Group specification (e.g. 199.95.207.0/24)
• Group specification
(e.g. 199.95.207.0/255.255.255.0)
Specifying Inversion
– Many flags, including the ‘–s’ and ‘–d’ flags can have
their arguments preceded by ‘!’ (not).
– Match address NOT equal to the ones given.
– E.g. ‘-s ! localhost’ matches any packet not coming from
localhost.
 Based on Interface
Physical device for packets to come in
• -i, --in-interface
– Physical device for packets to go out
• -o, --out-interface
– Packets traversing the INPUT chain don’t have
an output interface
• Rule using ‘-o’ in this chain will never match.
– Packets traversing the OUPUT chain don’t have
an input interface
• Rule using ‘-i’ in this chain will never match.
 Based on Protocol

– The protocol can be specified with the ‘-p’ flag.

– Protocol can be a number if you know the numeric
protocol values for IP.
– Protocol can be a name for special cases of
• TCP
• UDP
• ICMP
– Case insensitive (e.g. tcp works as well as TCP)
– Can be prefixed by a ‘!’, e.g. ‘–p ! TCP’
 Based on Fragments

– Sometimes a packet is too large

• Divided into fragments
• Sent as multiple packets.
– IP header contains in the first segment only.
– Impossible to look inside the packet for protocol
headers such as TCP, UDP, ICMP.
– This means that the first fragment is treated like any
other packet. Second and further fragments won’t be.
Based on Fragments cont’d
– E.g ‘-p TCP -sport www’ (specifying a source port of
‘www’), will never match a fragment other than the
first fragment.
– You can specify a rule specifically for second and
further fragments, using the ‘-f’
(or –fragment) flag.
– E.g. The following rule will drop any fragments going
to 192.168.1.1
– # iptables -A OUTPUT -f -d 192.168.1.1 -j DROP
 TCP extensions
– Automatically loaded if ‘--protocol tcp’ is specified.
– --tcp-flags
• Allows you to filter on specific TCP flags.
• The first string of flags is the mask
• The second string of flags tells which one(s)
should be set.
• E.g.

# iptables -A INPUT –protocol tcp –tcp-flags ALL SYN,ACK –j DROP

 • Indicates that all flags should be examined
• ALL is synonymous with
‘SYN,ACK,FIN,RST,URG,PSH’
• But only SYN and ACK should be set.
• There is also an argument ‘NONE’ meaning no
flags.
– --syn
• Optionally preceded by a ‘!’.
• Shorthand for --tcp-flags SYN,RST,ACK SYN’.
– --source-port
• Single port or range of ports
• Can be specified by names listed in
/etc/services
– --sport
• Synonymous with ‘--source-port’.
– --destination-port or --dport
• Specify the destination port.
– --tcp-option
• Followed by an optional ‘!’ and a number.
• Matches a packet with a TCP option equaling
that number.
– E.g.

-p TCP –s 192.168.1.1 --syn

– Specify TCP connection attempts from

192.168.1.1
• UDP Extensions
– Loaded if ‘--protocol udp’ is specified.
– Provides the following options
• --source-port
• --sport
• --destination-port
• --dport
• ICMP Extensions
– Loaded if ‘--protocol icmp’ is specified.
– --icmp-type
• Specify ICMP type (numeric type or name)
 Other Match Extension
– Invoked with the ‘-m’ option.
– Mac
• Specified with ‘-m mac’ or –match mac’
• Used for matching incoming packet's source
Ethernet address. (MAC).
• Only one option ‘--mac-source’
• E.g. –mac-source 00:60:08:91:CC:B7
– Limit
• Specified with ‘-m limit’ or --match limit’.
• Restrict the rate of matches, such as for
suppressing log messages.
– Two options
• --limit
– Followed by a number
– Specifies the maximum average number of matches to
allow per second.
– Can specify other unit such as ‘/second’, ‘/minute’, ‘/hour’,
or ‘/day’.
– E.g. --limit 5/second or --limit 5/s
• --limit-burst
– Followed by a number.
– The maximum initial number of packets to match.
– This number gets recharged by one every time the limit
specified above is not reached.
– Often used with the LOG target.
• Default 3 matches per hour, with a burst of 5
• E.g. iptables –A FORWARD –m limit –j LOG
 State Match
– Specifying ‘-m state’ allows an additional
‘--state’ option.
– NEW
• A packet which creates a new connection.
– ESTABLISHED
• A packet which belongs to an existing connection
– RELATED
• A packet which is related to, but not part of, an existing
connection such as ICMP error.
– INVALID
• A packet which could not be identified for some reasons.
 Target Specifications
– Two built-in targets
• DROP
• ACCEPT
– Extensions
• LOG
– --log-level
» Specify the level of log 0 to 7.
– --log-prefix
» Followed by a string up to 14 chars
» Sent at the start of the log
• REJECT
– DROP + send an ICMP port unreachable error message
 User-defined chains

User can create new chains.

– By convention, user-defined chains are lower-case.
– Packet matches rule whose target is a user-defined
chain, the packet begins traversing the rules in that
user-defined chain.
– If that chain doesn’t decide the fate of the packet, then
once traversal of that chain has finished, traversal
resumes on the next rule on the current chain.
 User-defined chains cont’d

INPUT
test
Rule1: -p ICMP –j DROP
Rule1: -s 192.168.1.1
Rule2: -p TCP –j test
Rule2: -d 192.168.1.1
Rule3: -p UDP –j DROP

User-defined chains can jump to other user-defined chains.

Your packets will be dropped if they are found to be in a loop.
What's Next ?
 Bedankt
Thank You 感謝
Kansh
a
TERIMAKASIH