Homework

Cyber Security
Tunisia Polytechnic School – Master in Advanced Engineering: IoT and Data Processing
Lecturer: Slim Rekhis

Part 1
1. What are the advantages of placing public servers on a DMZ network?
2. We consider the network architecture provided by the following Figure, showing the use of a stateful packet filtering
Firewall.
Stateful Packet
Filtering Firewall
Router

Internet
Internal network
[Link]/24
Application Proxy Firewall

Web Server

Given the following traffic filtering policy used on the corporate information system:

a. All remote accesses from Internet to the web server deployed on the DMZ should go over the Application Proxy
Firewall.
b. No connection can be initiated from the web server.
c. All connections from the internal machines should go over the Application Proxy Firewall. Only HTTP and DNS
services are provided
d. Machine [Link] is denied to connect to any external server, including servers on the DMZ
e. The network [Link]/16 is untrusted; no connection from/to it is allowed.
Write the ACL rules considering the « default=Deny » policy. Use the following format:

Action | Direction | Protocol | IP Src address | IP Dst address | Dst Port | (complete any required field)

3. Represent each allowed traffic flow on the figure, showing its direction, source, destination, ports, and used protocol.
4. Configure the stateful packet filtering firewall deployed in the Figure by writing the suitable filtering rules to satisfy the
aforementioned requirements.
5. Suppose the stateful firewall allows the delivery of non-handshake packets only on established connections. For that
reason, it creates a “SYN-received / SYN-ACK sent datagrams” queue until it sees a responding “ACK.”
a. How can an attacker induce the firewall to run out of queue space?
b. What will happen if, when the firewall runs out of queue space, it blocks further SYN packets?
c. What will happen if, when the firewall runs out of queue space, it stops enforcing the restriction on non-
handshake packets?
d. Explain why an ACK time-out strategy to let the firewall delete old incomplete handshakes will not efficiently
solve this problem?
6. How can you argument the use of two Firewalls (the packet filtering and the proxy firewalls) to protect the network?
7. Propose a technique by which machine [Link] can bypass the firewall and connect to Internet
8. How can a machine in the internal network connect to the HTTP Server [Link]?
Part 2: Practice Lab

The aim of this Lab is to:

- Implement a security policy for accessing to/from a server connected to the network, by creating firewall rules.
- Create scenarios for testing the correctness of the firewall configuration.
Iptables will be the stateful packet filtering firewall to configure in this lab. It represents a standard part of all modern Linux
distributions.

Packet Processing in Iptables

All packets inspected by iptables pass through a sequence of built-in tables (queues) for processing. Each of these queues is
dedicated to a particular type of packet activity and is controlled by an associated packet transformation/filtering chain.
The filter table in iptables has three chains (sets of rules). The INPUT chain is used for any packet coming into the system. The
OUTPUT chain is for any packet leaving the system, and the FORWARD chain is for packets that are forwarded (routed)
through the system.

Iptables command:
#iptables -t <table type><action><direction><conditions> -j <what to do>

-t --table
<table type> Filter (default)
<action> -A: append //add rule to iptables chain
-D: delete //delete rule that matching
-L: list // list all rules
-F: Flush // delete all rules
-P: policy //modify default policy
<direction> Filter: INPUT//is for packets destined FOR the host
OUTPUT// is for packets destined FROM the host
FORWARD// is for packets passing THROUGH the host
<conditions> -s <ip> (source IP address) -s [Link]/24
-d <ip> (destination IP address) -d [Link]/24
-i <eth> input network interface -i eth0
-o <eth> out interface -o eth0
-p tcp --dport <num> -p tcp --dport 22
-p tcp --sport <num> -p tcp --sport 22
-p udp --dport <num> -p udp --dport 22
-p udp --sport <num> -p udp --sport 22
-p icmp --icmp-type echo-request// icmp type 8 packet
-p icmp --icmp-type echo-reply // icmp type 0 packet
-p icmp --icmp-type destination-unreachable // icmp type 3 packet
-m // module
<what to do> Filter: ACCEPT // The packet is accepted on the incoming interface
DROP // The packet is blocked. No error message is sent back
REJECT // The packet is blocked. An error message is sent back
LOG // The packet information is sent to the syslog daemon for logging and
iptables continues processing with the next rule in the table

Examples:
# iptables -P INPUT DROP
• Change the default filtering policy of the firewall in the INPUT chain to DROP
# iptables -P OUTPUT ACCEPT
• Change the default filtering policy of the firewall in the OUTPUT chain to ACCEPT
# iptables -A INPUT -p tcp -m tcp --dport 80 -j DROP
 • Block the incoming TCP connections to port 80
# iptables -A OUTPUT -p tcp -m tcp --sport 80 -j DROP
• block the outgoing TCP connections from port 80
# iptables -A INPUT -i eth0 –p tcp --dport 22 -m state --state NEW, ESTABLISHED -j ACCEPT
• Accept the input traffic representing a new SSH connection and an acknowledgment of an already established SSH
connection
# iptables -A OUTPUT–o eth0 –p tcp --sport 22 –m state --state ESTABLISHED –j ACCEPT
• Accept the output traffic representing an acknowledgment of an established SSH connection
# iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -i eth0 –j ACCEPT
• Restricts ICMP echo requests to no more than one packet per second.

Saving iptables scripts

If you reboot the machine, the iptables configuration would disappear. To save the configuration, and have it start up
automatically, the two commands iptables-save and iptables-restore can be used.
# iptables-save > /etc/[Link]
# iptables-restore < /etc/[Link]

Troubleshooting iptables
One of the best methods is to log all dropped packets to /var/log/syslog file using the LOG target. Note that the LOG target:
− Logs all traffic that matches the iptables rule in which it is located.
− Automatically writes an entry to the /var/log/syslog file and then executes the next rule.
If it is needed to log only unwanted traffic, therefore, it becomes necessarily to add a matching rule with a DROP target
immediately after the LOG rule. This example logs a summary of failed outgoing packets to the file /var/log/messages.
# iptables -A OUTPUT -j LOG
Here is an example of a record appended by iptables to /var/log/messages file:

May 22 02:39:19 osboxes kernel: IN= OUT=eth0 SRC=[Link] DST=[Link] LEN=60 TOS=0x00 PREC=0x00 TTL=64
ID=45280 PROTO=ICMP TYPE=0 CODE=0 ID=1 SEQ=6

Your tasks
1- Install the iptables-service package, and configure it to start automatically at system startup
# yum install iptables-services
# systemctl start iptables
# systemctl enable iptables
2- Verify that iptables is configured as a service on your system and is running.
# systemctl status iptables
3- Display the filtering rules applied on your firewall. What is the default filtering policy that is currently implemented for
input traffic (Chain INPUT)?
4- Check that SSH server and client are installed, start the SSH service, and check its status:
# yum install openssh-server openssh-clients
# systemctl start sshd
# sudo systemctl status sshd
5- Check that telnet server and client are installed, start the telnet service, check its status, and configure it to start
automatically at system startup
# yum install telnet
# yum install telnet-server
# systemctl start [Link]
# sudo systemctl status sshd
# systemctl enable [Link]
6- Delete all rules in your iptables firewall
7- Make sure that Telnet and SSH connections from the main host to the virtual machine is possible, using Putty software.
8- Check that ftp and pop3 services are not running on the virtual machine. You can check this by executing the following
command to verify that no service is running on ports 21 and 110.
9- Implement the following access policy in your iptables Firewall, considering a default=DROP policy.
- All TCP connections from the main host to the virtual machine are allowed, excepting SSH and FTP connections (No
error message should be sent to notify the sender).
- The virtual machine should not respond to any ICMP message, excepting the echo-request (such a message should
be logged, while letting iptables prefixing the log messages with the string “echo request forwarded”).
- The virtual machine is allowed to connect to the web site [Link], while HTTP connections to all other
websites are denied.
- The virtual machine should be able to generate “destination-unreachable” icmp messages.
Indication
- Use the command “iptables -p icmp -h » to display the icmp message types.
- Use the command “tail -f /var/log/messages” to view the last entries appended to the log file
- Use text-based web browser lynx to test http connections
10- Test the correctness of your firewall configuration. You are asked to describe all the test cases you have performed.
You can check the log file, and/or use a network traffic analyzer such as Wireshark or tcpdump.
11- Save your firewall rules to the file “lab-rules”.