Firewalls Anand Sharma Austin Wellman Kingdon Barrett

Overview Firewall Knowledge from UNIX Entry-Level Firewalls What is a Firewall? What is an IDS? –IDS implementation methodologies –Who needs an IDS? Firewall or IDS?

What is a Firewall?

How are they used?  Where do firewalls live?  On the borders of Network Segments  Two-way static routes between mutually trusting subnets  Interdepartmental routing within an organization

How are they used?  NAT configuration for a private/business network  Firewall Interfaces: external (public presence) and internal (gateway address)  whiteruby.rit.edu vs. whiteruby.tuesday.local  Internal Network Addresses: *.tuesday.local

Basic Firewall Operation

Why do you need it? Protection against unauthorized connections Blocking unnecessary port access Preventing malicious and “harmless” software from phoning home

Firewalls fall into four broad categories: Packet filters. Circuit level gateways. Application level gateways. Stateful multilayer inspection firewalls.

Packet filtering firewalls work at the network level of the OSI model, or the IP layer of TCP/IP. They are usually part of a router.

Second Generation - Circuit Level

Application Layer Firewalls work at the top level. They evaluate packet data according to rules to allow or deny connections.

Stateful Multilayer Inspection Firewalls

Software Firewall

Pros Does not require additional hardware. Does not require additional computer wiring. A good option for single computers. They are very easy to configure Cons Since they run on your computer they require resources (CPU, memory and disk space) from your system. They can introduce incompatibilities into your operating system. One copy is typically required for each computer.

Hardware Firewall

Pros  They tend to provide more complete protection than software firewalls A hardware firewall can protect more than one system at a time They do not effect system performance since they do not run on your system. They are independent of your operating system and applications. Cons They tend to be expensive, although if you have a number of machines to protect it can cost less to purchase one hardware firewall than a number of copies of a software product. Since they do not run on your computer, they can be challenging to configure.

Choosing the right firewall: The size of your network The level of security you’re looking for The amount of money your willing to pay Compatibility and interoperability

Available Firewalls - Windows Built in Pros  Available on every Windows computer by default as of SP2 No configuration needed beyond enabling it for it to work Cons Who will police the police? Outgoing transmissions limited very little if at all Could create a false sense of security in normal users

Available Firewalls - ISA Server Useful for a large business network Based on a combination of Application Layer and Packet Filtering technology Allows restriction of outgoing access by user, program, destination, and other criteria Restricts incoming access as necessary VPN support

Scriptable Firewall Systems  OpenBSD (pf)   FreeBSD (ipf, ipfw)   ipfw.html ipfw.html  Linux 2.4 and later (iptables) 

Getting Started with Firewalls  You Need:  One (1) computer with two (2) network interfaces  Somebody else's network (read: the Internet)  Several of your own computers  A hub or a switch to connect your own computers together

Getting Started with Firewalls  Software Firewalls:  m0n0wall –  Smoothwall – or (Clever marketing! Check this out, it's two different websites)

Intermission Talk amongst yourselves!

What is Intrusion Detection?  Host-based IDS  Single tapped network host  Network-based IDS  One or more tapped network segments  Tapped gateways or firewalls

Circuit-Level Firewalls  TCP Handshaking  Authorized connections are counted  New traffic is automatically allowed for open connections  Every circuit acts as a data source for IDS-type analysis or logging  “Intelligent” network switches  Paranoia? Watch what you say!

Big Brother IDS  Snort: The De-Facto IDS   Monitor Everything, Log and Classify  Build Signatures for:  Legitimate Use Patterns  Attacks Patterns  Tap Placement is Everything: 

Where to Tap?  Network Gateways  Connections from users to the internet  Circuit-level Tap  Monitor connections between local network users  Host-based IDS  System Logs and user information  Decrypted traffic

Conclusions  Is there anybody left in the audience who wants to see a large-scale IDS implemented here at RIT?  Definitely not me!  Or across your ISP's network?  Definitely not me!  Questions?