6.6 Firewalls Packet Filter (=filtering router) Passes/blocks packets, based on IP address and/or port number of source/destination Application gateway (=proxy) All requests/response of certain application must go through its proxy in intranet. Direct access to Internet is forbidden Need gateway for each type of application (telnet, ftp, http, X-window, etc). 2018/9/21

Telnet example In client machine, telnet is configured to use application gateway (software). When user invokes telnet, request is sent to local telnet gateway, which prompts user for destination. Application gateway works as intermediary (proxy) throughout telnet session. 2018/9/21

Firewall location Internet Intranet Intranet Packet filter and/or - Application gateway 2018/9/21

Typical configurations DMZ 2018/9/21

(a) Filtering router Mail server (port=25) Filtering router Internet Intranet 2018/9/21

Filtering router implementation - Blocks all incoming packets, except those with certain destination IP addresses and/or port numbers (25, 80) - It may also block outgoing packets, depending on source and/or destination. Action Our host Port Their host Block * SPIGOT Allow Our-MailServ 25 Our-WebServ 80 2018/9/21

(b) Filtering router and Bastion host Internet Protected Intranet Router only permits traffic to/from bastion host 2018/9/21

Bastion Host Runs special, secured OS. Can communicate with Machines in Internet Machines in protected network whose addresses are not externally visible. 2018/9/21

(c) Demilitarized Zone (DMZ) Modem access Bastion host Protected intranet inside router Internet outside router Web server DMZ 2018/9/21

DMZ Routers only permit traffic to/from DMZ network IP addresses in protected net not made public Unlike configuration (b), intranet is not affected by excessive attacking traffic from Internet to Bastion. It is also safe if Web server is compromised. 2018/9/21

More on proxy server (application gateway) Can deny requests from certain internal users IP addresses of internal machines never appear in Internet Can also function as caching proxy All packets can be logged with address of requesting machines May run on Bastion host, intranet or in DMZ Disadvantages= extra delay 2018/9/21

HTTP proxy 2018/9/21

Local HTTP proxy Proxy Server Internet (B) HTTP (A) Proxy HTTP www.company.com:80 Client is configured to use proxy HTTP via (B). (B) Sends GET page.html to http://www.company.com/ on behalf of (A). 2018/9/21

HTTP proxy = application gateway Works in application level. Can check if requested URL is allowed for this user. Can search, e.g., for “CAFEBABE” (written in hex) in first 4 bytes of payload to block java bytecode being transferred. 2018/9/21

RMI thru firewall HTTP server Internet RMI server client_stub port POST “data” to www.company.com:80/cgi-bin/ java-rmi.cgi?forward=<rmiServerPort> 2018/9/21

Intrusion detection system DMZ may contain Intrusion Detection System (IDS) It inspects all inbound and outbound network activity and identifies suspicious patterns that may indicate network or system attack from someone attempting to break into or compromise system. 2018/9/21

IDS vs. firewall IDS differs from firewall in that firewall looks out for intrusions in order to stop them from happening. Firewall limits access between networks in order to prevent intrusion and does not signal attack from inside network. IDS evaluates suspected intrusion once it has taken place and signals an alarm. IDS also watches for attacks that originate from within system. 2018/9/21

Private network 2018/9/21

Hybrid network 2018/9/21

Virtual private network 2018/9/21

Addressing in a VPN 2018/9/21

Tunneling 2018/9/21

Virtual Private Network (VPN) Internet Intranet B Intranet A Tunneling Router RA Router RB RB 200 Data Station 200 Station 100 encrypted 2018/9/21

Reverse proxy Controls inbound requests (accept/reject) May be placed in DMZ or outside firewall If request is accepted, it communicates securely with the server in the intranet Some web pages may be made accessible to only to remote company employees Company net Firewall W eb server Random external user Remote company Internet Reverse proxy 2018/9/21

Filtering router 2018/9/21

Bastion host 2018/9/21

Web server directly accessible Web server invasion doesn’t endanger intranet. 2018/9/21

Intranet protected from compromised web server penetration detected and some actions will be taken 2018/9/21