NETWORK SECURITY USING MIKROTIK ROUTER OPERATING SYSTEM

BY

IDAHOSA PAUL MONDAYPSC0508648

DEPARTMENT OF MATHEMATICS STATISTICS WITH COMPUTER SCIENCE FACULTY OF PHYSICAL

SCIENCES UNIVERSITY OF BENIN, BENIN CITY,EDO STATE. NIGERIA.

MAY, 2012

1

NETWORK SECURITY USING MIKROTIK ROUTER OPERATING SYSTEM

BY

IDAHOSA PAUL MONDAYPSC0508648

BEING A PROJECT SUBMITTED TO THE DEPARTMENT OF MATHEMATICS, FACULTY OF PHYSICAL

SCIENCES, UNIVERSITY OF BENIN, BENIN CITY, EDO STATE, IN PARTIAL FULFILLMENT OF THE

REQUIREMENT FOR THE AWARD OF BACHELOR OF SCIENCE (B.Sc HONS) IN STATISTICS WITH

COMPUTER SCIENCE.

MAY, 2012.

2

CERTIFICATION

It is certified that this work was carried out by Mr. Paul Monday Idahosa of the

Department of Mathematics, University of Benin, Benin City.

-------------------------- ---------------------------ASSO PROF. M.N.O. IKHILE MRS. S. KONYEHAAg. Head of Department Supervisor

DATE:---------------------- DATE: ----------------------

3

DEDICATION

I dedicate this work to God almighty, the creator and sole administrator of the

whole universe who in His infinite mercy sustained and provided for me, may his name

be praised forever. I also dedicate it to my late father Pa Joseph Idahosa, who set the ball

of education rolling in my life before he departed this world may his soul rest in peace.

Amen.

4

ACKNOWLEDGEMENT

First and foremost, I have to acknowledge the wonderful and incomparable

Almighty God who has made me complete my programme successfully, and kept me

alive to acknowledge the people who have joined me in my academic pursuit.

In the multitude of people there is an adornment of a king, but in the lack of

population is the ruin of high official. With this in mind, I am most grateful to these my

lecturers:

I have to show my profound gratitude to my lecturer Dr. J .I. Mbegbu, our daddy

Dr. A. O. Oduwale, and Dr. D. Okuonghae, who have been local parents to me.

My sincere appreciation goes to my able, amiable and dynamic project supervisor

Mrs. S. konyeha whose sound intellectual and constructive suggestions guided me to the

actualization of this project work. I pray God continue to guide her and her family aright

in their entire endeavours.

Also I have to show my profound gratitude to my course adviser Mr. O. Izevbizua

for his lovely advice throughout my years in this great department. Also to my enviable

lecturers; Prof. S.M. Ogbowman, Prof. J. E .Osemwenkhae, Dr. A.A. Osagiede, Dr. N.

Ekhosuehi, and the dynamic Ag. Head of Department, Asso. Prof. M.N Ikhile and many

others, thanks to you all and God bless you.

I wholeheartedly appreciate the unflinching support of my mother Mrs. Mary

Idahosa who has not relented in praying for my success. I have to thank her for her

endless care, patient, financial, spiritual and moral support in my six years of study. And

5

also my late Dad, Pa Joseph Idahosa who set the ball of education rolling in my life

before he departed this world may his gentle soul rest in peace. Amen.

Also to my wonderful siblings; Osaretin, Roselyn, Marian, Faith, Gabriel, Andrew

and especially to my lovely sister Joy who was my heroine, May God bless you all.

I must not fail to appreciate the support of my boss in the office, Mr. E. S.

Omwanghe, for his understandings, my colleagues Mr. O. Eguavoen, Mr. J. Otabor

whose intellectual guidance has brought success to my project work, and my other

colleagues in the office, I thank you all. I also recognized my classmates who contributed

to the success of this project work; Sunny , Osas (aka Don Coleon), Aunty Favour, Ailem

Emwinghare, Dolapo, Ahmed, Victor, Theophilus, Anderson, Eddy, Emma, Ernest,

Frank, Victor, Evelyn, Ese, Shedrach, Douglas, Obi, Wagna, Ochuko, Patience, Dano,

Jonah, Owens, Nelson and my humble class rep Smart. Your efforts are noted.

This section will remain incomplete without recognizing the support of my friend

Amies, who has stood by me to make sure this project work come to a successful end, am

indeed grateful. Also to my lovely friend Paulina for showing great concern, I say thank

you to you all.

Also a special thanks to my friend, Mr. Hector, who first gave me an insight to my

project, and to the entire ICTU team Uniben for their assistance. Lastly, thanks to my

friend Kingsley Odibo.

6

I know I cannot thank you all enough but optimism abounds that God in his

infinite mercy will continue to take care of you individually and collectively in Jesus

name – Amen and Amen.

7

ABSTRACT

Network security has become more important to personal computer users,

organizations, and the military. With the advent of the internet, security became a

major concern and the history of security allows a better understanding of the

emergence of security technology. The internet structure itself allowed for many

security threats to occur. The architecture of the internet, when modified can

reduce the possible attacks that can be sent across the network. Knowing the

attack methods, allows for the appropriate security to emerge. Many businesses

secure themselves from the internet by means of firewalls and encryption

mechanisms. The businesses create an “intranet” to remain connected to the

internet but secured from possible threats.

8

TABLE OF CONTENTS

Title page - - - - - - - - - - i

Certification- - - - - - - - - - ii

Dedication - - - - - - - - - - iii

Acknowledgement - - - - - - - - iv

Table of content - - - - - - - - -

Abstract - - - - - - - - - -

CHAPTER ONE: INTRODUCTION

1.1 Statement of problem

1.2 Significant of Study

1.3 Limitation of Study

1.4 Network

1.5 Some Popular Network

1.5.1 UUCP

1.5.2 Batch-oriented Processing

1.5.3 Network Security concepts

1.6 Mikrotik - - - - - - - - -

1.7 History of network security - - - - - -

9

CHAPTER TWO: LITERATURE REVIEW

2.0 Differentiating data security and security - - - -

2.1 Security in different networks - - - - - -

2.2 Internet - - - - - - - - -

2.3 Security timeline - - - - - - - -

2.4 IPV4 and IPV6 Architectures - - - - - -

2.5 IPV4 Architecture - - - - - - - -

2.6 IPV6 Architecture - - - - - - - -

2.7 Common Internet attack methods

2.7.1 Eavesdropping - - - - - - - -

2.7.2 Viruses - - - - - - - - -

2.7.3 Worms - - - - - - - -

2.7.4 Trojans - - - - - - - -

2.7.5 Phishing - - - - - - - -

2.7.6 IP spoofing attack - - - - - - -

2.7.7 Denial of services - - - - - - -

2.8 Technology for internet security - - - - -

2.8.1 Cryptographic systems - - - - - -

2.8.2 Firewall - - - - - - - -

2.9 The three basic type of firewall - - - - -10

2.11 Difference between IDS, IPS, firewall and Antivirus - -

2.11.1 IDS (Intrusion detection system) - - - -

2.11.2 IPS (Intrusion prevention system) - - - -

2.11.3Antivirus - - - - - - - -

2.11.4Firewall - - - - - - - -

CHAPTER THREE: SYSTEM ANALYSIS AND DESIGN

3.0 Introduction

3.1 Network Design - - - - - - - -

3.1.1 Router OS installation - - - - - - - -

3.1.2 Router configuration - - - - - - -

3.1.3 Router firewall - - - - - - - -

3.1.4 Event Logging - - - - - - - - -

3.1.5 Bandwidth management - - - - - - -

3.1.6 Queues - - - - - - - - -

3.1.7 Torch - - - - - - - - - -

3.1.8 Bandwidth test - - - - - - - -

3.2 Unified modeling language (UML) representation - - - -

3.2.1 Use case diagram - - - - - - - -

11

CHAPTER FOUR: IMPLEMENTATION

4.0 Introduction - - - - - - - - -

4.1 Hardware requirements - - - - - - -

4.2 Software requirements - - - - - - -

4.3 System Implementation - - - - - - -

4.3.1 Choice of router OS - - - - - -

4.4 Implementation - - - - - - - - -

CHAPTER FIVE: SUMMARY, CONCLUSION, AND

RECOMMENDATION

5.1 Summary - - - - - - - - -

5.2 conclusion and recommendation - - - - -

References - - - - - - - - -

Appendix - - - - - - - - -

12

CHAPTER ONE

1.0 INTRODUCTION

Network security consists of the provisions and policies adopted by a

network administrator to monitor and prevent unauthorized access, misuse,

modification, or denial of service on a computer network and network-accessible

resources. Network security involves the authorization of access to data in a

network, which is controlled by the network administrator. Users choose or are

assigned an ID and password or other authenticating information that allows them

access to information and programs within their network. Network security covers

a variety of computer networks, both public and private, which are used daily for

transactions and communications among businesses, government agencies and

individuals. Networks can be private (such as within a company) while others

might be open to public access. Network security is involved in organizations,

enterprises, and other types of institutions. It secures the network, as well as

protecting and overseeing operations being done. The most common and simple

way of protecting a network resource is by assigning it a unique name (Simmonds,

et al., 2004)

The world is becoming more interconnected with the advent of the Internet

and new networking technology. There is a large amount of personal, commercial,

military, and government information on networking infrastructures worldwide. 13

Network security is becoming of great importance because of intellectual property

that can be easily acquired through the internet. There are currently two

fundamentally different networks, data networks and synchronous network

comprised of switches. The internet is considered a data network. Since the current

data network consists of computer‐based routers, information can be obtained by

special programs, such as “Trojan horses,” planted in the routers. The synchronous

network that consists of switches does not buffer data and therefore are not

threatened by attackers. That is why security is emphasized in data networks, such

as the internet, and other networks that link to the internet. Basically Mikrotik

functions as a router, does bandwidth management and has authentication

software.

1.1 MIKROTIK

Mikrotik Ltd., known internationally as MikroTik, is a Latvian manufacturer

of computer networking equipment. It sells wireless products and routers. The

company was founded in 1995, with the intent to sell in the emerging wireless

technology market. As of 2007, the company had more than 70 employees. The

company's products are known as low-priced alternatives for expensive routers and

Ethernet radio relay lines.

14

1.2 STATEMENT OF PROBLEM

With the advancement of technology, a lot of unauthorized persons are now

able to access network and files and cause harm to the files hence the need for

more network security policy through the use of Mikrotik routers

1.3 SIGNIFICANCE OF STUDY

Computer Network security is a complicated subject, historically only

tackled by well-trained and experienced people. However, as more and more

people become ``wired'', an increasing number of people need to understand the

basics of security in a networked world.

1.4 LIMITATION OF STUDY

In the course of study, it was not easy to get funds to procure mikrotik

license, a personal computer with two LAN cards and other hardware components

needed to implement my work. Materials were not readily available because a lot

of people who could make research are yet to be aware of it.

1.5 HISTORY OF NETWORK SECURITY

Recent interest in security was fueled by the crime committed by Kevin

Mitnick (1979). He committed the largest computer‐related crime in U.S. history.

The losses were eighty million dollars in U.S. intellectual property and source code

from a variety of companies. Since then, information security came into the

spotlight. Public networks are being relied upon to deliver financial and personal 15

information. Due to the evolution of information that is made available through the

internet, information security is also required to evolve. Due to Kevin Mitnick’s

offense, companies are emphasizing security for the intellectual property. Internet

has been a driving force for data security improvement. Internet protocols in the

past were not developed to secure themselves. Within the TCP/IP communication

stack, security protocols are not implemented. This leaves the internet open to

attacks. Modern developments in the internet architecture have made

communication more secure.

1.6 COMPUTER NETWORK

A computer network, often simply referred to as a network, is a collection of

hardware components and computers interconnected by communication channels

that allow sharing of resources and information. Where at least one process in one

device is able to send/receive data to/from at least one process residing in a remote

device, then the two devices are said to be in a network.

1.7 SOME POPULAR NETWORKS

Over the last 25 years or so, a number of networks and network protocols

have been defined and used. There are two types of network: Public and private

networks. Anyone can connect to either of these networks, or they can use any of

the networks to connect their own hosts (computers) together, without connecting 16

to the public networks. Each type takes a very different approach to providing

network services.

1.7.1 UUCP

UUCP (Unix-to-Unix CoPy) was originally developed to connect Unix

(surprise!) hosts together. UUCP has since been ported to many different

architectures, including PCs, Macs, Amigas, Apple IIs, VMS hosts, everything else

you can name, and even some things you can't. Additionally, a number of systems

have been developed around the same principles as UUCP.

1.7.2 Batch-oriented processing.

UUCP and similar systems are batch-oriented systems: everything that they

have to do is added to a queue, and then at some specified time, everything in the

queue is processed.

1.8 Network security

Network security starts with authenticating the user, commonly with a

username and a password. Since this requires just one detail authenticating the user

name —i.e. the password, which is something the user 'knows'— this is sometimes

termed one-factor authentication. With two-factor authentication, something the

user 'has' is also used (e.g. a security token or 'dongle', an ATM card, or a mobile

phone); and with three-factor authentication, something the user 'is' is also used

(e.g. a fingerprint or retinal scan).17

Once authenticated, a firewall enforces access policies such as what services

are allowed to be accessed by the network users. Though effective to prevent

unauthorized access, this component may fail to check potentially harmful content

such as computer worms or Trojans being transmitted over the network. Anti-virus

software or an intrusion prevention system (IPS) helps detect and inhibit the action

of such malware. An anomaly-based intrusion detection system may also monitor

the network and traffic for unexpected (i.e. suspicious) content or behavior and

other anomalies to protect resources, e.g. from denial of service attacks or an

employee accessing files at strange times. Individual events occurring on the

network may be logged for audit purposes and for later high-level analysis.

Communication between two hosts using a network may be encrypted to

maintain privacy. Honeypots, essentially decoy network-accessible resources, may

be deployed in a network as surveillance and early-warning tools, as the honeypots

are not normally accessed for legitimate purposes. Techniques used by the

attackers that attempt to compromise these decoy resources are studied during and

after an attack to keep an eye on new exploitation techniques. Such analysis may

be used to further tighten security of the actual network being protected by the

honeypot.

18

CHAPTER TWO

LITERATURE REVIEW

2.0 DIFFERENTIATING DATA SECURITY AND NETWORK SECURITY

Data security is the aspect of security that allows a client’s data to be

transformed into unintelligible data for transmission. Even if this unintelligible

data is intercepted, a key is needed to decode the message. This method of security

is effective to a certain degree. Strong cryptography in the past can be easily

broken today. Cryptographic methods have to continue to advance due to the

advancement of the hackers as well. When transferring ciphertext over a network,

it is helpful to have a secure network. This will allow for the ciphertext to be

protected, so that it is less likely for many people to even attempt to break the

code. A secure network will also prevent someone from inserting unauthorized

messages into the network. Therefore, hard ciphers are needed as well as attack‐

hard networks. Kartalopoulos, S. (2008)

19

Figure 1: Based on the OSI model, data security and network

Kartalopoulos, S. (2008)

2.1 SECURITY IN DIFFERENT NETWORKS

According to Tyson (2011), the businesses today use combinations of

firewalls, encryption, and authentication mechanisms to create “intranets” that are

connected to the internet but protected from it at the same time.

Intranet is a private computer network that uses internet protocols. Intranets differ

from "Extranets" in that the former are generally restricted to employees of the

organization while extranets can generally be accessed by customers, suppliers, or

other approved parties. It does not necessarily have to be any access from the

organization's internal network to the Internet itself. When such access is provided

20

it is usually through a gateway with a firewall log with user authentication,

encryption of messages, and often makes use of virtual private networks (VPNs).

Although intranets can be set up quickly to share data in a controlled environment,

that data is still at risk unless there is tight security. The disadvantage of a closed

intranet is that vital data might not get into the hands of those who need it.

Intranets have a place within agencies. But for broader data sharing, it might be

better to keep the networks open, with these safeguards:

1. Firewalls that detect and report intrusion attempts

2. Sophisticated virus checking at the firewall

3. Enforced rules for employee opening of email attachments

4. Encryption for all connections and data transfers

5. Authentication by synchronized, timed passwords or security certificates.

It was mentioned that if the intranet wanted access to the internet, virtual private

networks are often used. Intranets that exist across multiple locations generally run

over separate leased lines or a newer approach of VPN can be utilized. VPN is a

private network that uses a public network (usually the Internet) to connect remote

sites or users together. Instead of using a dedicated, real‐world connection such as

leased line, a VPN uses "virtual" connections routed through the Internet from the

company's private network to the remote site or employee. Figure 2 is a graphical

representation of an organization and VPN network (Tyson, 2011)21

Figure 2: Organizational VPN Network

Tyson, J. (2011)

Source: http://www.howstuffworks.com/vpn.htm

2.2 INTERNET

The Internet is the world's largest network of networks . When you want to

access the resources offered by the Internet, you don't really connect to the

Internet; you connect to a network that is eventually connected to the Internet

backbone, a network of extremely fast (and incredibly overloaded!) network

components. This is an important point: the Internet is a network of networks  - not

a network of hosts. Curtin, M. (1997)

A simple network can be constructed using the same protocols such

22

that the Internet uses without actually connecting it to anything else. Such a basic

network is shown in figure 3.

Figure 3: A Simple Local Area Network

I might be allowed to put one of my hosts on one of my employer's

networks. We have a number of networks, which are all connected together on a

backbone, which is a network of our networks. Our backbone is then connected to

other networks, one of which is to an Internet Service Provider (ISP) whose

backbone is connected to other networks, one of which is the Internet backbone.

If you have a connection ``to the Internet'' through a local ISP, you are actually

connecting your computer to one of their networks, which is connected to another,

and so on. To use a service from my host, such as a web server, you would tell

your web browser to connect to my host. Underlying services and protocols would

send packets (small datagram) with your query to your ISP's network, and then a

network they're connected to, and so on, until it found a path to my employer's

backbone, and to the exact network my host is on. My host would then respond

appropriately, and the same would happen in reverse: packets would traverse all of

23

the connections until they found their way back to your computer, and you were

looking at my web page. Curtin, M. (1997).

Simmonds, et al. (2004) observed that Security management for networks is

different for all kinds of situations. A home or small office may only require basic

security while large businesses may require high-maintenance and advanced

software and hardware to prevent malicious attacks from hacking and spamming.

2.3 SECURITY TIMELINE

Several key events contributed to the birth and evolution of computer and

network security. The timeline can be started as far back as the 1930s. Polish

cryptographers created an enigma machine in 1918 that converted plain messages

to encrypted text. In 1930, Alan Turing, a brilliant mathematician broke the code

for the Enigma. Securing communications was essential in World War II. In the

1960s, the term “hacker” is coined by a couple of Massachusetts Institute of

Technology (MIT) students. The Department of Defense began the ARPANet,

which gains popularity as a conduit for the electronic exchange of data and

information.(www.redhat.com/docs/manuals/enterprise/RHEL‐4‐Manual/security‐

guide/ch‐sgs‐ov.html). This paves the way for the creation of the carrier network

known today as the Internet. During the 1970s, the Telnet protocol was developed.

This opened the door for public use of data networks that were originally restricted

to government contractors and academic researchers.24

(www.redhat.com/docs/manuals/enterprise/RHEL‐4‐Manual/security‐guide/ch‐

sgs‐ov.html.)

During the 1980s, the hackers and crimes relating to computers were

beginning to emerge. The 414 gang are raided by authorities after a nine‐day

cracking spree where they break into top‐secret systems. The Computer Fraud and

Abuse Act of 1986 was created because of Ian Murphy’s crime of stealing

information from military computers. A graduate student, Robert Morris, was

convicted for unleashing the Morris Worm to over 6,000 vulnerable computers

connected to the Internet. Based on concerns that the Morris Worm ordeal could be

replicated, the Computer Emergency Response Team (CERT) was created to alert

computer users of network security issues. In the 1990s, Internet became public

and the security concerns increased tremendously. Approximately 950 million

people use the internet today worldwide .

(www.redhat.com/docs/manuals/enterprise/RHEL‐4‐Manual/security‐guide/ch‐sgs‐ov.html).

On any day, there are approximately 225 major incidences of a security

breach. These security breaches could also result in monetary losses of a large

degree. Investment in proper security should be a priority for large organizations as

well as common users.

25

2.4 IPV4 AND IPV6 ARCHITECTURES

IPv4 was design in 1980 to replace the NCP protocol on the ARPANET.

The IPv4 displayed many limitations after two decades. The IPv6 protocol was

designed with IPv4’s shortcomings in mind. IPv6 is not a superset of the IPv4

protocol; instead it is a new design. Andress J. (2005)

2.4.1 IPV4 ARCHITECTURE

According to Andress, the protocol contains a couple aspects which caused

problems with its use. These problems do not all relate to security. They are

mentioned to gain a comprehensive understanding of the internet protocol and its

shortcomings. The causes of problems with the protocol are:

1. Address Space

2. Routing

3. Configuration

4. Security

5. Quality of Service

The IPv4 architecture has an address that is 32 bits wide. Andress J. (2005).

According to Satillo, S. (2006) the IPv4 limits the maximum number of computers

that can be connected to the internet. The 32 bit address provides for a maximum

of two billions computers to be connected to the internet. The problem of

26

exceeding that number was not foreseen when the protocol was created. The small

address space of the IPv4 facilitates malicious code distribution.

Routing is a problem for this protocol because the routing tables are

constantly increasing in size. The maximum theoretical size of the global routing

tables was 2.1 million entries. Methods have been adopted to reduce the number of

entries in the routing table. This is helpful for a short period of time, but drastic

change needs to be made to address this problem.

The TCP/IP‐based networking of IPv4 requires that the user supplies some

data in order to configure a network. Some of the information required is the IP

address, routing gateway address, subnet mask, and DNS server. The simplicity of

configuring the network is not evident in the IPv4 protocol. The user can request

appropriate network configuration from a central server. This eases configuration

hassles for the user but not the network’s administrators. Andress, J. (2005).

The lack of embedded security within the IPv4 protocol has led to the many

attacks seen today. Mechanisms to secure IPv4 do exist, but there are no

requirements for their use. IPsec is a specific mechanism used to secure the

protocol. IPsec secures the packet payloads by means of cryptography. IPsec

provides the services of confidentiality, integrity, and authentication.

This form of protection does not account for the skilled hacker who may be able to

break the encryption method and obtain the key. Andress J. (2005). When internet 27

was created, the quality of service (QoS) was standardized according to the

information that was transferred across the network. The original transfer of

information was mostly text‐based. As the internet expanded and technology

evolved, other forms of communication began to be transmitted across the internet.

The quality of service for streaming videos and music are much different than the

standard text. The protocol does not have the functionality of dynamic QoS that

changes based on the type of data being communicated. Andress J. (2005)

2.4.2 IPV6 ARCHITECTURE

When IPv6 was being developed, emphasis was placed on aspects of the

IPv4 protocol that needed to be improved. The development efforts were placed in

the following areas:

1. Routing and addressing

2. Multi‐protocol architecture

3. Security architecture

4. Traffic control

The IPv6 protocol’s address space was extended by supporting 128 bit addresses.

With 128 bit addresses, the protocol can support up to 3.4 *(10) ^38 machines. The

address bits are used less efficiently in this protocol because it simplifies

addressing configuration.

28

The IPv6 routing system is more efficient and enables smaller global routing

tables. The host configuration is also simplified. Hosts can automatically configure

themselves. This new design allows ease of configuration for the user as well as

network administrator.

The security architecture of the IPv6 protocol is of great interest. IPsec is

embedded within the IPv6 protocol. IPsec functionality is the same for IPv4 and

IPv6. The only difference is that IPv6 can utilize the security mechanism along the

entire route the quality of service problem is handled with IPv6. The internet

protocol allows for special handling of certain packets with a higher quality of

service. From a high‐level view, the major benefits of IPv6 are its scalability and

increased security. IPv6 also offers other interesting features that are beyond the

scope of this paper. It must be emphasized that after researching IPv6 and its

security features, it is not necessarily more secure than IPv4. The approach to

security is only slightly better, not a radical improvement. Andress J.(2005)

2.5 COMMON INTERNET ATTACK METHODS

Adeyinka, O. (2008) suggested that Common internet attacks methods are

broken down into categories. Some attacks gain system knowledge or personal

information, such as eavesdropping and phishing. Attacks can also interfere with

the system’s intended function, such as viruses, worms and trojans. The other form

of attack is when the system’s resources are consumes uselessly, these can be 29

caused by denial of service (DoS) attack. Other forms of network intrusions also

exist, such as land attacks, smurf attacks, and teardrop attacks. These attacks are

not as well known as DoS attacks, but they are used in some form or another even

if they aren’t mentioned by name.

2.5.1 EAVESDROPPING

Interception of communications by an unauthorized party is called

eavesdropping. Passive eavesdropping is when the person only secretly listens to

the networked messages. On the other hand, active eavesdropping is when the

intruder listens and inserts something into the communication stream. This can

lead to the messages being distorted. Sensitive information can be stolen this way.

Adeyinka, O. (2008)

2.5.2 VIRUSES

Viruses are self‐replication programs that use files to infect and propagate.

Once a file is opened, the virus will activate within the system. Adeyinka, O.

(2008)

2.5.3 WORMS

A worm is similar to a virus because they both are self‐replicating, but the

worm does not require a file to allow it to propagate. There are two main types of

worms, mass‐mailing worms and networkaware worms. Mass mailing worms use

30

email as a means to infect other computers. Network‐aware worms are a major

problem for the Internet. A network‐aware worm selects a target and once the

worm accesses the target host, it can infect it by means of a Trojan or otherwise.

Adeyinka, O. (2008)

2.5.4 TROJANS

Trojans appear to be benign programs to the user, but will actually have

some malicious purpose. Trojans usually carry some payload such as a virus

Adeyinka, O. (2008)

2.5.5 Phishing

Phishing is an attempt to obtain confidential information from an individual,

group, or Organization. Phishers trick users into disclosing personal data, such as

credit card numbers, online banking credentials, and other sensitive information.

Marin, G.A. (2005)

2.5.6 IP SPOOFING ATTACKS

Spoofing means to have the address of the computer mirror the address of a

trusted computer in order to gain access to other computers. The identity of the

intruder is hidden by different means making detection and prevention difficult.

With the current IP protocol technology, IP spoofed packets cannot be eliminated

Adeyinka, O. (2008).

2.5.6 DENIAL OF SERVICE31

Denial of Service is an attack when the system receiving too many requests

cannot return communication with the requestors. The system then consumes

resources waiting for the handshake to complete. Eventually, the system cannot

respond to any more requests rendering it without service. Marin, G.A. (2005)

2.6 TECHNOLOGY FOR INTERNET SECURITY

Internet threats will continue to be a major issue in the global world as long

as information is accessible and transferred across the Internet. Different defense

and detection mechanisms were developed to deal with these attacks.

2.6.1 CRYPTOGRAPHIC SYSTEMS

Cryptography is a useful and widely used tool in security engineering today.

It involved the use of codes and ciphers to transform information into unintelligible

data.

2.6.2 FIREWALL

A firewall is a typical border control mechanism or perimeter defense. The

purpose of a firewall is to block traffic from the outside, but it could also be used

to block traffic from the inside. A firewall is the front line defense mechanism

against intruders. It is a system designed to prevent unauthorized access to or from

a private network. Firewalls can be implemented in both hardware and software, or

a combination of both Adeyinka, O. (2008)

2.7 There are three basic types of Firewall

32

Method Description Advantages Disadvantages

NAT Network Address Translation (NAT)

places private IP subnetworks behind

one or a small pool of public IP

addresses, masquerading all requests

to one source rather than several. The

Linux kernel has built-in NAT

functionality through the Netfilter

kernel subsystem.

· Can be configured

transparently to

machines on a LAN ·

Protection of many

machines and services

behind one or more

external IP addresses

simplifies administration

duties · Restriction of

user access to and from

the LAN can be

configured by opening

and closing ports on the

NAT firewall/gateway

· Cannot prevent

malicious activity once

users connect to a

service outside of the

firewall

Packet

Filter

A packet filtering firewall reads each

data packet that passes through a

LAN. It can read and process packets

by header information and filters the

packet based on sets of programmable

rules implemented by the firewall

administrator. The Linux kernel has

built-in packet filtering functionality

through the Netfilter kernel

subsystem.

Customizable through

the iptables front-end

utility · Does not require

any customization on the

client side, as all network

activity is filtered at the

router level rather than

the application level ·

Since packets are not

transmitted through a

proxy, network

performance is faster

due to direct connection

from client to remote

host

Cannot filter packets for

content like proxy

firewalls · Processes

packets at the protocol

layer, but cannot filter

packets at an

application layer ·

Complex network

architectures can make

establishing packet

filtering rules difficult,

especially if coupled

with IP masquerading

or local subnets and

DMZ networks

Proxy Proxy firewalls filter all requests of a Gives administrators · Proxies are often

33

certain protocol or type from LAN

clients to a proxy machine, which then

makes those requests to the Internet

on behalf of the local client. A proxy

machine acts as a buffer between

malicious remote users and the

internal network client machines.

control over what

applications and

protocols function

outside of the LAN ·

Some proxy servers can

cache frequently-

accessed data locally

rather than having to use

the Internet connection

to request it. This helps

to reduce bandwidth

consumption · Proxy

services can be logged

and monitored closely,

allowing tighter control

over resource utilization

on the network

application-specific

(HTTP, Telnet, etc.), or

protocol-restricted

(most proxies work with

TCP-connected services

only) · Application

services cannot run

behind a proxy, so your

application servers

must use a separate

form of network

security · Proxies can

become a network

bottleneck, as all

requests and

transmissions are

passed through one

source rather than

directly from a client to

a remote service

Ingham, Kenneth; Forrest, Stephanie (2002)

2.8 The ISO/OSI Reference Model

Curtin, M. (1997) pointed out that the International Standards Organization

(ISO) Open Systems Interconnect (OSI) Reference Model defines seven layers of

communications types, and the interfaces among them. (See Figure 4) Each layer

depends on the services provided by the layer below it, all the way down to the

physical network hardware, such as the computer's network interface card, and the

34

wires that connect the cards together. An easy way to look at this is to compare this

model with something we use daily: the telephone. In order for you and me to talk

when we are out of earshot, we need a device like a telephone. (In the ISO/OSI

model, this is at the application layer.) The telephones, of course, are useless unless

they have the ability to translate the sound into electronic pulses that can be

transferred over wire and back again. (These functions are provided in layers

below the application layer.) Finally, we get down to the physical connection: both

must be plugged into an outlet that is connected to a switch that is part of the

telephone system's network of switches. If I place a call to you, I pick up the

receiver, and dial your number. This number specifies which central office to

which to send my request, and then which phone from that central office to ring.

Once you answer the phone, we begin talking, and our session has begun.

Conceptually, computer networks function exactly the same way.

35

Figure 4: The ISO/OSI Reference Model

2.11 Difference between IDS, IPS, Firewall & Antivirus

2.11.1(Intrusion Detection system) IDS

There are basically 2 types of IDS, Network IDS and Host IDS.

Network IDS will Generally Capture all Traffic on the network. while

Host will Capture Traffic for Individual Host

IDS detects attempted attacks using Signature and Patterns much like an Anti

Virus App will. it's purpose is to analyze the traffic that goes through it and detects

possible intrusions to the system.

2.11.2IPS (Intrusion Prevention System)

IPS solutions are focused on identifying and blocking attack traffic. It can

actually be a Cisco router. When the IPS detects a problem, the IPS itself can

prevent the traffic from entering the network. 

2.11.3 AntiVirus:

They will capture attempted Infections of Files or email. The general

infection will be a Trojan and/or Virus/Malware. It detects the infections in the

system and heals it depending on the updated version.

2.11.4 Firewall:

36

According to Karl, B. (2008), Firewalls can be sophisticated. Firewall will

scan TCP/IP packets based on Source and Destination then check again a list

(ACL) and block/Allow traffic accordingly, some firewalls can provide Layer 7

Traffic Scanning (Deep Packet Inspection) for instance rules can be setup for

Applications. It is a network device that in it's basic form separates the internal

network from the external network. It allows internal users to go out, but prevents

any one from outside the internal network to go in.

Al‐Salqan, Y (1997) stated that the trend towards biometrics could have

taken place a while ago, but it seems that it isn’t being actively pursued. Many

security developments that are taking place are within the same set of security

technology that is being used today with some minor adjustments.

37

CHAPTER THREE

SYSTEM ANALYSIS AND DESIGN

3.0 INTRODUCTION

MikroTik Router OS is a Linux-based operating system Installed on the

MikroTik’s proprietary hardware (Router BOARD), or on standard x86-based

computers (our personal computers), it turns the computer into a network router

and implements various additional features, such as firewalling, virtual private

network (VPN) service and client, bandwidth shaping and quality of service,

wireless access point functions and other commonly used features when

interconnecting networks. The system is also able to serve as a captive-portal-

based hotspot system. The operating system is licensed in increasing service levels,

each releasing more of the available Router OS features. A Microsoft Windows

application called Winbox provides a graphical user interface for the Router OS

configuration and monitoring, but Router OS also allows access via FTP, telnet,

and secure shell (SSH). An application programming interface is available for

direct access from applications for management and monitoring.

38

This Router OS supports many applications used by Internet service providers, for

example OSPF, BGP, Multiprotocol Label Switching (VPLS/MPLS). The Router

OS also supports Internet Protocol Version 4 (IPv4) as well as Internet Protocol

Version 6 (IPv6).

3.1 NETWORK DESIGN

The network implementation for this system is a Local Area Network

(LAN). The layout was designed using Cisco packet tracer 5.2. Users in this

network are assigned IP addresses (Ipv4) which identify them on the layer 3 of the

OSI model. In order to ensure security, the IP addressing is made static as against

DHCP (Dynamic Host Control Protocol) addressing which dynamically allocates

IP addresses. This method could be less secure since the IP addresses cannot be

monitored as to which system uses which address.

The IP addresses used are 192.168.0.0 and 192.168.1.0 which are network

addresses. A network address is used to represent a network by means of a subnet

mask. The subnet mask used in the network is 255.255.255.0 which means all

devices can take IP addresses from this range 192.168.0.1 – 192.168.0.254 in the

case of network 192.168.0.0 and devices can take IP addresses from this range

192.168.0.1 – 192.168.0.254 in the case of network 192.168.1.0. .

The class of address used is class C address and also a private address.

Private addresses are used within a local area network but when the computers are 39

to be represented on the Wide Area Network, a process called Network address

translation is carried out by the internet service provider to represent the hosts with

the public address on the internet.

The cables used in connecting the systems are Ethernet straight through

cables. Straight through cables are used in connecting devices to switches. All the

devices in the LAN are connected to the switch which serves as a network link to

all the devices provided they are all bearing the network address. The other cabling

method is the cross over cable which is used in connecting similar devices together

such as a router and the PC, switch to switch or hub to switch. The cables are

connected to the network interface cards of the devices using RJ45 pin outs. Todd

Lammle, 2008.

40

Fig 3.1 Network Design for the Network Security System

3.1.1 ROUTER OS INSTALLATION

The mikrotik router OS is installed from a compact disk in the CD drive of

the chosen computer. Installing the router OS on the computer automatically makes

it a router. First the computer was booted and setup was entered to configure the

boot options. The computer was set to boot from the CD drive which contained the

41

router OS. On booting, the router OS provided the option of wiping out old

configuration present in the hard disk or leaving it. The option to wipe out old

configuration was chosen giving the router a fresh start. Old data was wiped out

and the packages to be installed were presented. Using the available options, the

desired packages were chosen and installed. The router rebooted and was set to use.

3.1.2 ROUTER CONFIGURATION

To support the network design presented in fig 3.2. The first interface of the

router was configured using the IP address 192.168.0.1 and a subnet mask of

255.255.255.0 (/24) and the second with 192.168.1.1 and a subnet mask of

255.255.255.0. The router was logged into using admin as the user name and an

empty password. Configuring the IP address is the first necessary configuration

before it can be interacted with from another system (the administrator system

using cwinbox.

MiKrotik Login: Admin

Password:

[admin@MikroTik] IP address add

Address: 192.168.0.1/24

Interface: ether1

[admin@MikroTik] IP address print.

[admin@MikroTik] IP address add42

Address: 192.168.1.1/24

Interface: ether2

[admin@MikroTik] IP address print

Ether1 is the interface for accessing the router from the local area network

and all the computers in the network thus follow such addressing pattern. Ether2 is

the interface for connecting the file server. The file server is on another network

subnet which is connected to this Ether2 interface of the router. The very first

computer to be configured other than the router is the administrator’s computer

which takes 192.168.0.2/24. The file server containing the company data takes

192.168.1.254.

The clients are assigned the addresses 192.168.0.3 and 192.168.0.4. . The

addresses 192.168.0.5 -192.168.0.253 are free addresses for other computers in the

LAN.

3.1.3 ROUTER FIREWALL

The Mikrotik router has a firewall resource that enables it act as a firewall

between devices in a network. To ensure this action, the network is designed such

that the router comes in between the file server and the other clients since it has 2

ethernet ports, the file server containing company data is put on Ether2 while the

clients as well as the administrator are put on Ether1.43

Configuring the firewall to restrict access to the file server was achieved using the

following code: [admin@MikroTik] >/IP firewall address-list add list=authorized

address=192.168.0.2/32

[admin@MikroTik] >/IP firewall address-list add list=authorized

address=192.168.0.3/32

[admin@MikroTik] > /IP firewall address-list print

Flags: X - disabled, D - dynamic

# LIST ADDRESS

0 authorized 192.168.0.2

1 authorized 192.168.0.3

Thus the only authorized IP addresses with access to the file server -

192.168.1.254 are 192.168.0.2 and 192.168.0.3.

3.1.4 EVENT LOGGING

Various system events and status information can be logged. Logs can be

saved in local routers file, displayed in console, sent to an email or to a remote

server running a syslog daemon. The log of the firewall activities has to be set to be

taken each time there is an operation. This is done using the following code:

[admin@MikroTik] system logging> add topics=firewall action=memory

[admin@MikroTik] system logging> print

Flags: X - disabled, I - invalid44

# TOPICS ACTION PREFIX

0 info memory

1 error memory

2 warning memory

3 critical echo

4 firewall memory

[admin@MikroTik] system logging

Viewing the Log of operations is the focus of an intrusion detection system.

A log shows details of an event such as the date and time of an event, what the

event is and who performed such an event. The mikrotik router log is viewed as

thus:

To view the local logs:

[admin@MikroTik] > log print

TIME MESSAGE

dec/24/2003 08:20:36 log configuration changed by admin

dec/24/2003 08:20:36 log configuration changed by admin

dec/24/2003 08:20:36 log configuration changed by admin

dec/24/2003 08:20:36 log configuration changed by admin

dec/24/2003 08:20:36 log configuration changed by admin

dec/24/2003 08:20:36 log configuration changed by admin45

-- [Q quit|D dump]

To monitor the system log:

[admin@MikroTik] > log print follow

TIME MESSAGE

apr/30/2012 08:20:36 log configuration changed by admin

apr/30/2012 08:30:34 log configuration changed by admin

apr/30/2012 08:30:51 log configuration changed by admin

apr/30/2012 08:25:59 log configuration changed by admin

apr/30/2012 08:25:59 log configuration changed by admin

apr/30/2012 08:30:05 log configuration changed by admin

apr/30/2012 08:30:05 log configuration changed by admin

apr/30/2012 08:35:56 system started

apr/30/2012 08:35:57 isdn-out1: initializing...

apr/30/2012 08:35:57 isdn-out1: dialing...

apr/30/2012 08:35:58 Prism firmware loading: OK

apr/30/2012 08:37:48 user admin logged in from 10.1.0.60 via telnet

-- Ctrl-C to quit. New entries will appear at bottom showing the current logs for

effective monitoring.

46

In such an intrusion detection system, the log has to be monitored at all times

just as a security camera has to be focused at all times but all events can be logged

for future access in case of a security breach.

3.1.5 Bandwidth Management

3.1.5.1 Queues

This functionality of the router is very important in the management of

Network usage. The Queue option provides a tabular arrangement of all users

accessing the network with their individual bandwidth usage (Measured basically

in bits per second [b/s])

The administrator has the option of setting the maximum and minimum bandwidth

usage for a particular resource. Our version of Mikrotik OS (V.29) has the ability

to allow unlimited download and upload in the network so he could restrict

network usage by setting the uplink and downlink to low values. (See Fig 3.2.5.1

in Appendix)

3.1.5.2 Torch

Like the name implies, torch is used in viewing something closely. If an

administrator want to view in details the network access. It shows the ports of

access. The very common ports of access are 443 for secured sites (https(Secured

hypertext transfer Protocol)), 80 for basic http, 21 for file transfer protocol and 23

for telnet. (See Appendix Fig 3.2.5.2). It also shows the source and destination

47

addresses of access in the network showing the Upload and Download rate. The

administrator can decide to torch to see based on ports, protocol , source or

destination address the network usage and can then know what each user is

accessing only on a protocol, port and address basis.

3.1.5.3 Bandwidth Test

The average performance of the router can be verified using the bandwidth

test option accessed from the winbox. After inputting the authentication, the user is

able to view the average uplink and downlink performance of the router on the

network. From our test we found and average of 459/383 of Uplink and downlink

respectively. This is quite impressive, but depending on the load of the network the

bandwidth is shared among the users just like a wide road getting congested. (see

Fig 3.2.5.3 in Appendix)

3.2 UNIFIED MODELLING LANGUAGE (UML) REPRESENTATION

The Unified Modeling Language (UML) analysis of the proposed system

was done using case diagram

3.2.1 Use Case Diagram

A use case diagram visually represents what happens when an actor interacts

with a system. It captures the functional aspects of a system. More specifically, it

captures the business processes carried out in the system. As you discuss the

functionality and processes of the system, you discover significant characteristics 48

of the system that you model in the use case diagram. Due to the simplicity of use

case diagrams, and more importantly, because they are shorn of all technical

jargon, use case diagrams are a great storyboard tool for user meetings. Use case

diagrams have another important use. Use case diagrams define the requirements of

the system being modeled and hence are used to write test scripts for the modeled

system.

In the intrusion detection system, the main actors are the clients and the

administrator. The client goes through the operations which is logged for the

administrators view.

Use cases: A use case describes a sequence of actions that provide

something of measurable value to an actor and is drawn as a horizontal

ellipse.

Actors: An actor is a person, organization, or external system that

plays a role in one or more interactions with the system.

System boundary boxes (optional): A rectangle is drawn around the

use cases, called the system boundary box, to indicate the scope of

system. Anything within the box represents functionality that is in scope

and anything outside the box is not in scope.

User49

User

Figure 3.2: The use case diagram for the Design of a Network Security System

3.3 HOTSPOT CONFIGURATION

The Mikrotik hotspot provides internet access to subscribers by means of a

login interface. Subscribers could be connected wirelessly or with wires to the

network but to have internet access, they will be required to enter a login name and

password. Setting up a hotspot in a mikrotik router entails the following.

1. Give the mikrotik internet connectivity by connecting one of its interfaces to

your internet source and assigning IP addresses to both ends either by

DHCP( Dynamic Host control Protocol) or statically. 50

Winbox Login/ Network Access

Authentication / Routing by Microtik

Router router

Authorized Access to Router Resource

/Configuration

Router Directs traffic to the

resource /accepts configuration

Log of all events for access by the administrator Administrator

2. The other interface of the router which is directed to client use could be set

up as a DCHP server so as to facilitate automatic assigning of IP addresses

to network hosts.

3. Next the router is configured to hand out DNS server address to the clients

and is the address of the internet connection source.

4. Internet connectivity on the router has to be verified by pinging an address

e.g. 8.8.8.8 which is google.com server.

5. Next the wireless adapter needs to be configured and IP address set. If you

are using a LAN card the IP address will still be set but it will be connected

to a D-link to provide connection to the other wired hosts

6. The next step is to open the hotspot setup page and set the interface to the

WLAN or Ethernet interface you are setting it up on. You can set up hotspot

on more than one interface.

7. Next the Network address for access is set which then generates the pool of

addresses to be assigned to hosts

8. Another step is to decide if SSL certificates will be used or not if they are to

be used, then they must be uploaded at this point of the configuration

9. The SMTP (Simple mail Transfer Protocol) is set

10.The DNS is set to the address of the internet connection end

51

11.The DNS name is set to administrator’s choice as this is what appears on the

web browser on attempt to access the web. E.g. ubtech.com

12.The username and password for the administrator is set. This can be changed

later.

13.The hotspot setup is now complete.

52

CHAPTER FOUR

IMPLEMENTATION, TESTING AND RESULT

4.0 INTRODUCTION

This chapter presents the hardware required for the Network security system

in section 4.1. In section 4.2, software required is presented. Section 4.3 presents

the design and specification and section 4.4 presents the implementation technique

and documentation of the system.

4.1 HARDWARE REQUIREMENTS

a. An Intel compatible Pentium III computer or a higher version.

b. A 256MB or higher of Random Access Memory (RAM). (Determines

speed of the router processing)

c. Network Interface Cards.

d. CD-ROM Drive on proposed router system for Router OS installation.

e. Keyboard, Monitor and Mouse

f. Network cables (Straight through and cross over)

4.2 SOFTWARE REQUIREMENTS

The list of required software is as listed below:

a. Mikrotik Router OS

b. Windows Operating system

c. Windows XP operating system.53

d. Winbox for GUI access to the router

e. Cisco Packet Tracer 5.2

4.3 SYSTEM IMPLEMENTATION

For the implementation of a network security system, the following steps are

needed:

a. Router OS installation: system engineer must install the Router OS

effectively.

b. Hardware and software needed to operate the system must be readily

available.

c. File preparation: The file server needs to be installed and files

into it.

d. System testing and evaluation: The system is tested by using wrong

usernames and passwords and trying access by unauthorized hosts and

then the log is viewed.

4.3.1 CHOICE OF ROUTER OS

The Mikrotik Router OS was chosen as the OS for this setup due to its ease

of use and low cost. It also readily has the features needed to implement network

security. Cisco routers are very costly and would require the physical routers but

mikrotik router OS could simply be installed into the computer and this makes it a

router. 54

4.4 IMPLEMENTATION TECHNIQUE

The Network has been fully configured to enhance a more secured network

by configuring firewalls on the mikrotik router as discussed in chapter three. The

network is now set for implementation. Data files have been kept in the file server

which is on the 192.168.1.0 network separated by the router from the 192.168.0.0

network. The users with access granted to the file server are 192.168.0.2 and

192.168.0.3.

a. Authorized access: A user with a valid username and password logs

into the router from the winbox environment. The user also accesses the file

server across the router and the log is taken. (see Appendix A)

b. Unauthorized access: A user without a valid username and password

is used to attempt login. A user from an IP address not permitted access to

the file server is also used to attempt login and the log is also taken

c. Viewing Log: The administrator has access to viewing the log of both

operations. He logs into the router through the winbox using the username

admin and password assigned. Next he clicks on log and all the operations

with the time of event is displayed. (see Appendix A)

55

SYSTEM TESTING

The system was tested with an authorized user that has been authenticated

with a username and password. He logs into the network at different times to

access the file server which were successful. An unauthorized user also tried to log

into the network but access was denied. The logs of both the authorized and the

unauthorized were taken.

RESULT

The record of logs of both the authorized and the unauthorized was seen by

the administrator who monitors and prevent network intrusion. The system worked

as expected.

56

57

58

CHAPTER 5

SUMMARY

This work has been able to demonstrate network security using mikrotik

routers operating system. Then, clients in the intranet - both authorized and

unauthorized tried to access a file server and logs were taken and seen by the

administrator who has the ability to enable or disable any user.

5.1 CONCLUSION AND RECOMMENDATION

Network security is an important field that is increasingly gaining attention

as the internet expands. The security threats and internet protocol were analyzed to

determine the necessary security technology. The security technology is mostly

software based, but many common hardware devices are used. The current

development in network security is not very impressive.

Originally it was assumed that with the importance of the network security

field, new approaches to security, both hardware and software, would be actively

researched. It was a surprise to see most of the development taking place in the

same technologies being currently used. The embedded security of the new internet

protocol IPv6 may provide many benefits to internet users. Although some security

issues were observed, the IPv6 internet protocol seems to evade many of the

current popular attacks. Combined use of IPv6 and security tools such as firewalls,

intrusion detection, and authentication mechanisms will prove effective in 59

guarding intellectual property for the near future. The network security field may

have to evolve more rapidly to deal with the threats further in the future.

what is going to drive the Internet security is the set of applications more

than anything else. The future will possibly be that the security is similar to an

immune system. The immune system fights off attacks and builds itself to fight

tougher enemies. Similarly, the network security will be able to function as an

immune system.

60

REFERENCES

Adeyinka, O., "Internet Attack Methods and Internet Security Technology," Modeling & Simulation, 2008.AICMS 08. Second Asia International Conference on, vol., no., pp.77‐82, 13‐15 May 2008

Al‐Salqan, Y.Y., "Future trends in Internet security,"Distributed Computing Systems, 1997., Proceedings of the Sixth IEEE Computer Society Workshop on Future Trends of , vol., no., pp.216‐217, 29‐31 Oct 1997.

Andress J., “IPv6: the next internet protocol,”(2005), Available at: www.usenix.com/publications/login/2005‐ 04/pdfs/andress0504.pdf .Accessed (27 April 2012)

Curtin ,M. “Introduction to Network Security”Available at: http://www.interhack.net/pubs/network‐security. Accessed (28 April 2012)

Dr. La Jolla, CA 92093 (858) 534-2230 Copyright ©2012 Regents of the University of California discussed ‘How firewalls work’:

(http://blink.ucsd.edu/technology/security/firewall/) ("Intranet.)" Wikipedia, The Free Encyclopedia. Jun 2008, 10:43 UTC. Wikimedia Foundation, Inc. 2 Jul 2008<http://en.wikipedia.org/w/index.php?title=Intranet&ol did=221174244>.

Improving Security, http://www.cert.org/tech_tips, 2006.

“Internet History Timeline,”www3.baylor.edu/~Sharon_P_Johnson/etg/inthistory.h

J.P. Holbrook, J.K. Reynolds. ``Site Security Handbook.'' RFC 1244.

Jun 2008, 10:43 UTC. Wikimedia Foundation, Inc. July 2008

Kartalopoulos, S. V., "Differentiating Data Security and Network Security," Communications, 2008. ICC '08.IEEE International Conference on, pp.1469‐1473, 19‐23 May 2008.

61

Landwehr, C.E.; Goldschlag, D.M., "Security issues in networks with Internet access," Proceedings of theIEEE, vol.85, no.12, pp.2034‐2051, Dec 1997"Intranet." Wikipedia, The Free Encyclopedia.Manual/security‐guide/ch‐sgs‐ov.html.

Molva, R., Institut Eurecom,“Internet Security Architecture,” in Computer Networks & ISDN SystemsJournal, vol. 31, pp. 787‐804, April 1999.

M. Curtin, ``Snake Oil Warning Signs: Encryption Software to Avoid.'' USENET <sci.crypt> Frequently Asked Questions File. ] Dowd, P.W.; McHenry, J.T., "Network security: it's time to take it seriously," Computer, vol.31, no.9, pp.24‐ Sep 1998

Marin, G.A., "Network security basics," Security &Privacy, IEEE , vol.3, no.6, pp. 68‐72, Nov.‐Dec. 2005.

S.M. Bellovin. Security Problems in the TCP/IP Protocol Suite. Computer Communication Review, Vol. 19, No. 2, pp. 32-48, April 1989.

“Security Overview,”www.redhat.com/docs/manuals/enterprise/RHEL‐4‐

Sotillo, S., East Carolina University, “IPv6 security issues,” August 2006,www.infosecwriters.com/text_resources/pdf/IPv6_SSotillo.pdf.

Tyson, J., ”How Virtual private networks work,” http://www.howstuffworks.com/vpn.htm . Accessed (24-5-2012)

Warfield M., “Security Implications of IPv6,” Internet Security Systems White Paper, documents.iss.net/whitepapers/IPv6.pdf.

Y. Rekhter, R. Moskowitz, D. Karrenberg, G. de Groot, E. Lear, ``Address Allocation for Private Internets.'' RFC 1918.

62

Computer network definition http://en.wikipedia.org/wiki/Computer_network

accessed (24-5-2012)

63

APPENDIX A: INTERFACES

Fig 3.1.2 Configuring Ip address on Client systems

Fig 3.1.3 Unauthorized Login

64

Fig 3.1.4 Winbox Login

User List

65

Fig 3.1.4: Router Firewall

Router Logging

66

Fig 3.1.5.1 Using Queue

67

Fig3.1.5.2 Using Torch

68

Fig.3.3. 1 Setting DHCP on the internet interface of the router

69

Fig 3.3.2 Setting DNS request granting

Fig 3.3.3 Verifying Internet Connectivity on Router

70

Fig 3.3.4 Enabling the WLAN card if its to be used

Fig 3.3.5 Setting the Hotspot

71

Fig 3.3.6 Choosing the Interface for the Hotspot Access

Fig 3.3.7 Setting the Network

72

Fig 3.3.8 Setting the pool of addresses for clients

Fig 3.3.9 Secure Shell Certificate option

73

Fig 3.4.0 SMTP (Simple Mail Transfer Protocol) – none selected

Fig 3.4.1 Domain Name Service Setup

74

Fig 3.4.2 Setting the Dns Name

Fig 3.4.3 Setting the first username and password

75

Fig 3.4.4 Setting DHCP on the internet interface of the router

Fig 3.4.5 Setting DNS request granting

76

Fig 3.4.6 Verifying Internet Connectivity on

Fig 3.4.7 Enabling the WLAN card if its to be used

77

Fig 3.4.8 Setting the Hotspot

Fig 3.4.9 Choosing the Interface for the Hotspot Access

78

Fig 3.5.0 Setting the Network

Fig 3.5.1 Setting the pool of addresses for clients

79

Fig.3.5.2 Secure Shell Certificate option

Fig 3.5.3 SMTP (Simple Mail Transfer Protocol) – none selected

80

Fig 3.5.4 Domain Name Service Setup

Fig 3.5.5 Setting the Dns Name

81

Fig 3.5.6 Setting the first username and password

Fig 3.5.7 Hotspot Completed

82

83