Instructor: Nasibullah Rashed

Nasibullahrashed@[Link]

Nasibullah Rashed

Nasib Rashed

+93 744 05 30 34
Module 6 - Firewall

3
A Network without Firewall

4
 Router: yes I have this network !!
Now I will forward this packet to destination IP

Attacker

Ping [Link]
----------------------
SRC: any
Destination: [Link]
Now attacker will send thousand of packet at one second
for example by using HPING3 SOFTWARE sending ICMP..

Attacker
 Attacker

This Type of attack is called DOS attack

Denial-Of-Service attack
A Network with Firewall

8
Firewall

❑ A network security device that protects internal network from outside (e.g. the Internet)

9
 Attacker

How about internet services ?

 [Link]

Response

Connection table or State table

Source IP Destination IP
[Link] [Link]

( http//:[Link]) -- SRC: [Link] Destination: [Link]

Stateful & Stateless Firewall

12
Stateful & Stateless Firewall
❑ Stateful Firewall:

• A stateful firewall monitors active connections and maintains a state table to track the state of each

connection. Just like before example.

❑ Stateless Firewall:

• A stateless firewall filters packets based solely on predefined rules without tracking

connection states.
❑ Note:MikroTik routers use a stateful firewall.

❑ Note-2: A firewall can be implemented as either hardware or software. 13

Router Board as Firewall

❑ RouterOS firewall rules are managed in Filter and NAT sections

❑ Based on rules which are analyzed sequentially until first match is found

15
Firewall Chains ( Filtering Mechanism )

There are three default chains or Filtering Mechanism

❑Input (to the router)

➢ Src= any, Dst= Mikrotik

❑Output (form the router)

➢ Src= Mikrotik, Dst= any

❑Forward (through the router)

➢ Src= any, Dst= any
Note: Mikrotik firewall Work on If-Then principle
16
17
18
Protocol Full form Port number Usage
HTTP Hyper Text Transfer Protocol 80 Access Webpage (Clear text)
HTTPS Hyper Text Transfer Protocol Secure 443 Access Webpage ( Encrypted or cipher text )
, uploading , downloading , chats
DNS Domain Name System 53 Find IP trough its name

DHCP Dynamic Host Configuration Protocol 67,68 Achieve automatic IP

FTP File Transfer Protocol 20,21 File Sharing via Network
TFTP Trivial File Transfer Protocol 69 Backup and Restore network devices

IRC Internet Relay Chat 6667 Chat

SIP Session Initiation Protocol 5060,5061 Voice and Video calls.
Telnet Teletype Network 23 Remote access network devices
SSH Secure Shell 22 Remote access network devices
SMTP Simple Mail Transfer Protocol 25 Sending Email
IMAP-4 Internet Message Access Protocol 143,993 Receiving Email
POP-3 Post office Protocol 110,995 Receiving Email
Connection States

20
Connection States types:

In the Mikrotik router, it considers a connection state for each packet that enters the
router:

1. NEW: Indicates a new connection request that is not yet established.

2. ESTABLISHED: Represents packets that are part of an already established
connection.
3. RELATED: Pertains to traffic that is related to an existing connection (e.g., an FTP
data connection established after an FTP control connection).
4. INVALID: Traffic that does not match any known connection and cannot be
identified as valid.
5. Untrack: Refers to a connection that is not being tracked by the connection
tracking system.
21
Step by Step

Task: Block all unwanted traffic from outside to inside:

Deny outside traffics to Inside:

• Chain: forward
• Interface: connected to ISP
• Connection State: invalid,related,new,untrack
• Action: drop

22
Input Chain

23
Input Chain

• Usually use to protect router itself

• This protection can from inside users or from internet

24
Step by Step

❑ Task-1: Block ICMP

IF:
❑ IP – Firewall – Firewall Rules – add – General:

• Chain – Input

• Src – IP address of the PC

• Protocol – ICMP

Then:
❑ IP – Firewall – Firewall Rules – add – reject -- Ok

25
 Step by Step
❑ Task-2: Only PC-1 can have access to RB via Winbox not other PCs

Step-1:
IF:
❑ IP – Firewall – Firewall Rules – add – General:

• Chain – Input

• Src – [Link]

• Protocol – TCP

• Dest port – 8291

Then:
❑ IP – Firewall – Firewall Rules – add – Action – accept -- Ok
26
 Step by Step
❑ Task-2: Only PC-1 can have access to RB via Winbox not other PCs

Step-2:
IF:
❑ IP – Firewall – Firewall Rules – add – General:

• Chain – Input

• Src – blank

• Protocol – TCP

• Dest port –8291

Then:
❑ IP – Firewall – Firewall Rules – add – Action – drop -- Ok
Note: Now except [Link] all others will be blocked 27
Forward Chain

28
Forward Chain

• Contain rules that control packet going through the router

• by default traffic between the internal network and the internet is not restricted cause
our device is a RB not firewall

29
Step by Step

Task-1: Block a user to ping the Google IP [Link]

30
Step by Step

Task-2: Block access “[Link]” Web page:

▪ Block using URL name:

• IP – Firewall – Layer 7 Protocol– add – ^.+([Link]).*$
• IP -- Firewall Rule -- add – General – chain:forward
• IP -- Firewall Rule -- add -- Advance – layer 7 protocol
• Action : drop

▪ Block using IP address:

• IP – Firewall – Firewall Rules – add – General:
• IP: PC IP address
• Protocol TCP or UDP
• Action : drop
31
Step by Step

Task-3: Block Google and Youtube:

1:
• IP – Firewall – Firewall Rules – add – advance – Content – [Link]
• IP – Firewall – Firewall Rules – action – add dest to address list

2:
• IP – firewall – Firewall Rules – Add – chain – forward chain
• IP – firewall – Firewall Rules – action – add to detination address-list – “internet block”
• IP – Firewall – Firewall Rules – action – drop

32
Youtube

4
1

5
3

6
33
Address List

34
Address List

❑ Address list can contain:

• One IP address
• IP range
• Whole Subnet
• DNS Name

❑ Use to apply a Rule on multiple address at once

35
Address List Practice

Task-1: Allow just [Link]-10 to be able access router via Winbox ( Through IP address )

❑ Log: to generate logs the at Log Tab with Sentence User-A any time user-A try to access router via winbox

Task-2: lock [Link] for addresses [Link]-60

36
Connection Tracking

37
Connection Tracking:

❑ Keep track and information about all active connections

❑ Has to be enabled for NAT and Filter to work

❑ Step by Step:

❑ Check connection Tracking:

• IP – Firewall – Connections

38
Fast Track

39
FastTrack

❑ A method to accelerate packet flow through the router

❑ An established or related connection can be marked for fast track connection

❑ Bypasses:
• Firewall Rules (Established, Related)
• Connection tracking
• Simple queue and other features

❑ Currently supports only TCP and UDP protocols

40
Step by Step

Enable fast track for user [Link]

IP-Firewall-Firewall rules- add -

• Chain: forward
• Connection State: establish and related
• Action: fast track connection

41
Source NAT

42
Source NAT

❑ Source NAT (SNAT) is a networking technique used to modify the source IP address of packets as they

traverse a router or firewall. It allows multiple devices on a private network to access the internet using

a single public IP address, effectively enabling address conservation and providing a layer of security.

❑ Action src-nat is meant for rewriting source IP address and/or port

43
Destination NAT

44
Destination NAT

❑ Destination NAT is usually used to allow access from an external network to a

resource (e.g. web server) on an internal network

❑ Action dst-nat is meant for rewriting destination IP address

❑Reason of using Dst NAT:

• Publish a Server for internet users
• Limited number of Public IP Addresses
• Security level for my published server
45
Step by Step

46
Redirect

47
Redirect

❑ Redirect refers to a process in which incoming network traffic is modified to be

rerouted to the router itself,

48
Step by Step

IP-Firewall-NAT- add -
• Chain: dstnat
• Destination IP: [Link]
• Protocol: TCP
• Destination port: 80
• Action: redirect

49
The End Of Module 6

50