firewalls anand sharma austin wellman kingdon barrett
TRANSCRIPT
Firewalls
Anand Sharma
Austin Wellman
Kingdon Barrett
Overview Firewall Knowledge from UNIX Entry-Level Firewalls What is a Firewall? What is an IDS?
IDS implementation methodologies Who needs an IDS?
Firewall or IDS?
What is a Firewall?
How are they used? Where do firewalls live?
On the borders of Network Segments Two-way static routes between mutually trusting
subnets Interdepartmental routing within an organization
How are they used?
NAT configuration for a private/business network
Firewall Interfaces: external (public presence) and internal (gateway address)
whiteruby.rit.edu vs. whiteruby.tuesday.local
Internal Network Addresses: *.tuesday.local
Basic Firewall Operation
Why do you need it?
• Protection against unauthorized connections
• Blocking unnecessary port access
• Preventing malicious and “harmless” software from phoning home
Firewalls fall into four broad categories:
• Packet filters.
• Circuit level gateways.
• Application level gateways.
• Stateful multilayer inspection firewalls.
Packet filtering firewalls work at the network level of the OSI model, or the IP layer of TCP/IP. They
are usually part of a router.
Second Generation - Circuit Level
Application Layer Firewalls work at the top level. They evaluate packet data
according to rules to allow or deny connections.
Stateful Multilayer Inspection Firewalls
Software Firewall
Software Firewall
Pros• Does not require additional
hardware.• Does not require
additional computer wiring.• A good option for single
computers.• They are very easy to
configure
Cons• Since they run on your
computer they require resources (CPU, memory and disk space) from your system.
• They can introduce incompatibilities into your operating system.
• One copy is typically required for each computer.
Hardware Firewall
Hardware Firewall Pros
They tend to provide more complete protection than software firewalls
• A hardware firewall can protect more than one system at a time
• They do not effect system performance since they do not run on your system.
• They are independent of your operating system and applications.
Cons• They tend to be
expensive, although if you have a number of machines to protect it can cost less to purchase one hardware firewall than a number of copies of a software product.
• Since they do not run on your computer, they can be challenging to configure.
Choosing the right firewall:
• The size of your network
• The level of security you’re looking for
• The amount of money your willing to pay
• Compatibility and interoperability
Available Firewalls - Windows Built in
Pros Available on every
Windows computer by default as of SP2
• No configuration needed beyond enabling it for it to work
Cons• Who will police the
police? • Outgoing transmissions
limited very little if at all• Could create a false
sense of security in normal users
Available Firewalls - ISA Server
• Useful for a large business network• Based on a combination of Application
Layer and Packet Filtering technology• Allows restriction of outgoing access by
user, program, destination, and other criteria
• Restricts incoming access as necessary• VPN support
Scriptable Firewall Systems
OpenBSD (pf) http://www.openbsd.org/faq/pf/
FreeBSD (ipf, ipfw) http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipf.html http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipfw.ht
ml
Linux 2.4 and later (iptables) http://www.netfilter.org/
Getting Started with Firewalls
You Need: One (1) computer with two (2) network interfaces Somebody else's network (read: the Internet) Several of your own computers A hub or a switch to connect your own computers
together
Getting Started with Firewalls
Software Firewalls: m0n0wall – http://m0n0.ch/wall/ Smoothwall – http://smoothwall.net/ or
http://smoothwall.org/ (Clever marketing! Check this out, it's two different websites)
Intermission
• Talk amongst yourselves!
What is Intrusion Detection?
Host-based IDS Single tapped network host
Network-based IDS One or more tapped network segments Tapped gateways or firewalls
Circuit-Level Firewalls
TCP Handshaking Authorized connections are counted New traffic is automatically allowed for open
connections Every circuit acts as a data source for IDS-type
analysis or logging “Intelligent” network switches
Paranoia? Watch what you say!
Big Brother IDS
Snort: The De-Facto IDS http://www.snort.org/docs/
Monitor Everything, Log and Classify Build Signatures for:
Legitimate Use Patterns Attacks Patterns
Tap Placement is Everything: http://www.snort.org/docs/iss-placement.pdf
Where to Tap?
Network Gateways Connections from users to the internet
Circuit-level Tap Monitor connections between local network users
Host-based IDS System Logs and user information Decrypted traffic
Conclusions
Is there anybody left in the audience who wants to see a large-scale IDS implemented here at RIT?
Definitely not me! Or across your ISP's network?
Definitely not me! Questions?