FIREWALL & NEED

 A firewall is a network security system.

 It monitors and controls incoming and outgoing

network traffic based on predetermined security rules.
 It establishes a barrier between a trusted
internal network to untrusted external
network, such as the Internet
NEED OF FIREWALL

Internet connectivity is a must for most people and

organizations
 Especially for Developers and Researchers

But a convenient Internet connectivity is an invitation

for Intruders and Hackers
 FIREWALL BASICS
The firewall is inserted between the internal network
and the Internet (a choke point)
1. Establish a controlled link and protect the network from
Internet-based attacks.
➢ keeps unauthorized users away,
➢ imposes restrictions on network services; only authorized traffic is
allowed

2. Location for monitoring security-related events

➢ Auditing, Alarms can be implemented

3. Some firewalls supports IPSec, so VPNs can be

implemented firewall-to-firewall
4. Some firewalls support NAT (not so security related)
FIREWALL CHARACTERISTICS

 Design goals:
 All traffic from inside from/to outside must pass through the
firewall .

 Only authorized traffic (defined by the local security policy)

will be allowed to pass

 The firewall itself should be immune to penetration (use of

trusted system with a secure operating system)
FIREWALL LIMITATIONS

 cannot protect from attacks bypassing it

 typical example: dial-in, dial-out

 cannot protect against internal threats

 e.g. fired sysadmin ☺

 cannot protect against transfer of all virus infected

programs or files

 because of heavy traffic and huge range of O/S &

 TYPES OF FIREWALLS

 Packet-filtering routers
 Application-level
Gateways
 Circuit-level gateways
PACKET FILTER FIREWALL

 Simplest, Faster Firewall

 Foundation of any Firewall system

 Examine Each IP packet address (not context).

 Permit or deny according to rules

 It restrict access to services (Ports)

 Possible default policies

 Discard or Forward
PACKET FILTER –SCREENING POLICY ACTIONS

 Forward – Packet forwarded to the intended recipient

 Drop – Packages are dropped (without notification)
 Reject – Packages are rejected (with notification)
 Log – Packages appearance is logged
 Alarm – Packages appearance triggers an alarm
PACKET FILTERING EXAMPLES

{our hosts}

21
21 {our hosts}
{our hosts} For data traffic in passive mode
ATTACKS ON PACKET FILTERS

 IP Address spoofing
 Fake Source address to be trusted
 Add filters on router to block

 Source routing Attacks

 Attackersets a route other than default
 Block source routed packets

 Tiny Fragment Attacks

 Splitheader info over several tiny packets
 Either discard or reassemble before check
 ADVANTAGE
DISADVANTAGE

 Screening Router can protect  Some policies are difficult to

a whole network enforce
 It is widely available.  It generates extra load for
 Other Features are the router
 Simplicity
 High speed
 Transparency to users

ADVANTAGES & DISADVANTAGES

LIMITATIONS

Traditional Packet Filters do not examine higher

layer context.
 To address this (2 types of Packet filter)
 Stateful packet filter
PACKET FILTER TYPES

 Packet filtering firewalls are divided

into two categories :
 Stateless packet filtering firewalls
 Stateful packet filtering firewalls
STATEFUL PACKET FILTER

 Examine each IP packet in context

 Check Packet validity

 Track of client –server sessions

 Better able to detect bogus packets

 STATEFUL INSPECTION
 Example

>1024 ports need to be opened

 not only due to FTP, all services have such a structure

 <1024 ports are for servers, a client using a service should use a

local port number between 1024 and 16383

 So the firewall should keep track of the currently opened >1024 ports

 A stateful inspection firewall keeps track of outbound TCP connection with

local port numbers in a table and allow inbound traffic for >1024 ports if

there is an entry in that table (see next slide for an example table)
STATEFUL INSPECTION
CIRCUIT LEVEL GATEWAY
CIRCUIT LEVEL GATEWAY

 A circuit-filtering firewall (also called a circuit-

level gateway) works at the transport and
session layers of the OSI model.
 It can examine
 TCP handshake information that is sent between
computers to verify that a session request is
legitimate.
CIRCUIT LEVEL GATEWAY

 It relays two TCP connections

 Once connection allowed, relays the traffic
without examine the content
 It is used by trust internal users

 SOCKS is commonly used

 SOCKS is an Internet protocol that
exchanges network packets between
a client and server through a proxy server
 ADVANTAGES DISADVANTAGES

 It (Proxy) can do intelligent  It cause a Delay

filter  It can require modifications
 It can provide logging and to clients
catching  It require a different server
 It can provide user level for each service
authentication

ADVANTAGES & DISADVANTAGE

APPLICATION-LEVEL GATEWAY
 Application-level Gateway (proxy server)
 Acts as a relay of application-level traffic
 Proxy obtains application specific information from the
user and relays to the server
 Optionally authenticates the users
 Only allowable applications can pass through
 Feature-based processing is possible
 Additional processing overhead on each connection
BASTION HOST

 A system identified by the firewall administrator as

a critical strong point in the network security
 Used in various firewall configuration (we’ll see now)
 The bastion host serves as a platform for an
application-level gateway
 i.e. a proxy
 Potentially exposed to "hostile" elements, hence is
secured to withstand this
 Trusted system
 Carefully configured and maintained
 FIREWALL CONFIGURATIONS
 In addition to the use of simple configuration of a single system (single
packet filtering router or single gateway), more complex
configurations are possible. Such as
 Screened Host Firewall system (Single Homed Bastion Host)

 Dual Homed Bastion Host

 Screened Subnet Firewall

 Host based Firewall

 Personal Firewall
SCREENED HOST FIREWALL SYSTEM (SINGLE-
HOMED BASTION HOST)

 Only packets from and to the bastion host are

allowed to pass through the router
 The bastion host performs authentication and
proxy functions
DUAL-HOMED BASTION HOST
 Good security because of two reasons:
 This configuration implements both packet-level and
application-level filtering
 An intruder must generally penetrate two separate systems
in order to get to the internal network
 This configuration also has flexibility in providing direct
Internet access to a public information server, e.g.
Web server
 by configuring the router
SCREENED-SUBNET FIREWALL SYSTEM
 securer
 creates an isolated sub-network between routers
 Internet and private network have access to this subnet
 Traffic across the subnet is blocked
 This subnet is called DMZ (demilitarized zone)
 Internal network is invisible to the Internet

Outside packet Inside packet

filtering router filtering router

DMZ
HOST-BASED FIREWALLS

 Software module to secure individual hosts

 Filterpacket flows
 Available as add-on for many OSs

 Often used on servers

 Advantages:
 Acts as an additional layer of protection to
organizational firewall
 Tailored filter rules for specific host needs

 Protection from both internal / external attacks

PERSONAL FIREWALL
 controls traffic flow to/from PC/workstation
 for both home or corporate use
 software module on PC
 or in home cable/ADSL router/gateway
 Less complex than standalone firewalls
 Primary role
 To deny unauthorized access
 To monitor/detect/block malware activity
WHAT IS KERBEROS?

 Network authentication protocol

 Developed at MIT in the mid 1980s
 Available as open source or in
supported commercial software
WHY KERBEROS?

 Sending usernames and passwords in the clear

jeopardizes the security of the network.
 Each time a password is sent in the clear, there
is a chance for interception.
FIREWALL VS. KERBEROS?

 Firewalls make a risky assumption:

that attackers are coming from the
outside. In reality, attacks
frequently come from within.
 Kerberos assumes that network
connections (rather than servers
and work stations) are the weak
link in network security.
DESIGN REQUIREMENTS

 Interactions between hosts and clients should

be encrypted.
 Must be convenient for users (or they won’t use
it).
 Protect against intercepted credentials.
 CRYPTOGRAPHY APPROACH
 Private Key: Each party uses the same secret key to
encode and decode messages.
 Uses a trusted third party which can vouch for the
identity of both parties in a transaction. Security of
third party is imperative.
HOW DOES KERBEROS WORK?

 Instead of client sending password to

application server:
 Request Ticket from authentication server
 Ticket and encrypted request sent to
application server
 How to request tickets without repeatedly
sending credentials?
 Ticket granting ticket (TGT)
HOW DOES KERBEROS WORK?: TICKET
GRANTING TICKETS
HOW DOES KERBEROS WORK?: THE TICKET
GRANTING SERVICE
HOW DOES KERBEROS WORK?: THE
APPLICATION SERVER
APPLICATIONS

 Authentication
 Authorization

 Confidentiality

 Within networks and small sets of networks

WEAKNESSES AND SOLUTIONS

If TGT stolen, can be used to Only a problem until

access network services. ticket expires in a few
hours.

Subject to dictionary attack. Timestamps require

hacker to guess in 5
minutes.

Very bad if Authentication Physical protection for

Server compromised. the server.
THE COMPETITION: SSL

SSL Kerberos
Uses public key encryption Uses private key encryption
Is certificate based (asynchronous) Relies on a trusted third party
(synchronous)
Ideal for the WWW Ideal for networked environments
Key revocation requires Revocation Key revocation can be accomplished by
Server to keep track of bad disabling a user at the Authentication
certificates Server
Certificates sit on a users hard drive Passwords reside in users' minds where
(even if they are encrypted) where they are usually not subject to secret
they are subject to being cracked. attack.

Uses patented material, so the Kerberos has always been open source
service is not free. Netscape has a and freely available.
profit motive in wide acceptance of
the standard.
LIMITATION: SCALABILITY

 Recent modifications attempt to address this

problem
 Public key cryptography for Client
Authentication and cross realm authentication
 Issues are not resolved