Access Control
For most of us our gateway router is also our firewall.
Now a firewall by definition is software that's designed to protect our system from
the evils of the Internet.
So we really have two kinds of firewalls to deal with.
There are stateless firewalls and there are stateful firewalls stateless firewalls
are firewalls that you pretty much just turn on.
They're designed to actually look at whatever packets are coming in and then make
decisions on it.
For example if it sees one ICMP packet coming in it's probably going to ignore it
but if it sees a lot that's going to tell it that something bad is happening.
So that's why it's called stateless a stateful firewall is looking at the state of
every packet it's looking for an IP address or a port something to block or
something to allow.
So on this particular router I've got right here we can actually do both stateful
and stateless.
Let me show both to you.
All right.
To set up the firewall on this particular router it's got this firewall tab.
Now what I want to look at first are more the stateless type settings on this
particular router it's got basically a firewall.
Turn it off turn it off.
And this is the default statelets firewall that Cisco sells with a lot of their
SOHO routers and it works really well there's nothing wrong with it.
Now the settings are going to see in here differ a lot from router to router but
you're going to see a lot of similarities.
For example Denial of Service protection what is doing is if it starts to see too
many ICMP packets coming in for example that will shut down acceptance of ICMP
things like that block when requests this is another real common one which is put
in if anybody initiate the conversation from outside the internet into our router.
It's just going to block those we have remote management multicast pass through if
you want to do video presentations you can turn that on Sip application layer
gateway for this particular one sip is a protocol that's used for voice over IP and
a lot of times if you're using voip you have to enable that and you can even do
things like blocking Java and cookies and Active-X turning these on will simply
make users scream at you so they're rarely a good idea.
Now that's the stateless part and it's usually fairly straightforward where things
get a bit more interesting is when we get stateful.
Now this particular router has two settings one is called IP based access control
list and the other one is called Internet access policy.
So let's kind of look at both of these that every router does is different but they
all kind of do the same thing.
So what I'm going to do is I'm going to create a rule in my Access Control List and
one very common rule you'll see some people do is this one deny all services to any
interface and you set it up so that it's running 24/7 you see that right there.
The idea behind this is if we actually put this in I'm going to go and put that in
whip's
once a little more information there.
Here we go.
If we actually put this in what we have done is we've turned off anything coming in
or out of the router.
So then what you have to start doing is turning things back on and that can be a
little bit tricky.
So what a lot of people do is instead of doing this where you turn everything off
and then start slowly opening things up instead they'll begin to pick individual
ports to shut down because they have a problem with it so I'm going to disable this
one right now and I'm going to add a new rule in this case.
I'm going to deny now they have a bunch of built in services that you can use but
they rarely have the ones that I want.
So for example if I wanted to set it up so that nobody can play on their steam
server
I could actually turn off because I know these ports
and what I've done is I've shut off a certain set of ports.
Now I'm going to save this as a service.
Now that's plugged in.
Now once I get the service I got to come back here and see just how this guy works
at a new rule.
All right.
It automatically puts the steam in for me and I can set it up so that I can allow
steam for certain.
I'm sorry.
There we go.
I can deny steam for the entire local area network if I wanted to.
I could do it for a range of computers.
I could do it.
Anyway I wanted the idea here is that I want to stop people from playing steam.
Now I'm not a total jerk.
So what I'm going to do I go any to any.
So basically I'm denying everybody to have steam and now schedule when I want to
deny them so I'm going to deny them on not every day.
And if they actually are coming in on Saturdays and Sundays I'll let them play
steam and then I'll set it.
In this case how does one do it during working hours.
So from 9 to 5 You can't play steam.
So in this particular case I've just set up a rule that says nobody can play steam
from 9 to 5 during the workday.
So that's that's a very very typical type of access control list entry we could put
in.
Now this particular router separates them although a lot of routers just put this
is one big ACL list this router uses what it calls Internet access policy.
Notice on the previous one that was really based on particular services that I was
blocking here that's good enable and we're going to call it timmy because I always
call my temporary stuff Timmy.
And what I can do is I can block access to the Internet for all kinds of different
things.
In this particular I can block time of day day of the week.
I can lock type in any forbidden domains I don't want people to go to.
I can block by keyword on this particular one which by the way doesn't work very
well.
I've discovered the hard way that there's a lot of phrases that are perfectly
legitimate in certain cases but the important thing to appreciate here is that I
can be very very granular in how I allow and disallow things in fact I can even go
so far as look at this list of PCs so I can literally allow or deny based on the
Mac address of the computer by the IP address or a range of IP addresses.
On some routers we can even base it on computer name and stuff like that.
So there's a lot of variance in terms of what your firewall settings are for
different types of routers but they all tend to boil down to the same thing.
There's going to be certain services certain computers based on mac address or
based on IP Address that are going to be added to the Access Control list to
determine what they can do and what they can't do.
The downside to all this is that well it's hard work.
You're going to have to go in and mess with this stuff all the time.
But it's worth it because it really gives you control and understanding of what's
going in and out of your computer.
Fired up a copy of Wireshark to see what's going in and out of your network and
then using Access Control lists to filter the type of services that you're wanting
to let in or out will really make you understand what really really goes on inside
that router of yours.
Access control is an importatnt part of network security
Stateless firewalls use pattern analysys and heuristics
to decide which packets should be blocked
Stateful firewalls examine each packet to decide which packets should be blocked