1. 6.6 Firewalls Packet Filter (=filtering router)
Passes/blocks packets, based on IP address and/or port number of source/destination
Application gateway (=proxy)
All requests/response of certain application must go through its proxy in intranet. Direct access to Internet is forbidden
Need gateway for each type of application (telnet, ftp, http, X-window, etc).
2018/9/21

2. Telnet example
In client machine, telnet is configured to use application gateway (software).
When user invokes telnet, request is sent to local telnet gateway, which prompts user for destination. Application gateway works as intermediary (proxy) throughout telnet session.
2018/9/21

3. Firewall location Internet Intranet Intranet Packet filter and/or
- Application gateway
2018/9/21

4. Typical configurations
DMZ
2018/9/21

5. (a) Filtering router Mail server (port=25) Filtering router Internet
Intranet
2018/9/21

6. Filtering router implementation
- Blocks all incoming packets, except those with certain
destination IP addresses and/or port numbers (25, 80)
- It may also block outgoing packets, depending on source
and/or destination.
Action
Our host
Port
Their host
Block *
SPIGOT
Allow
Our-MailServ 25
Our-WebServ 80
2018/9/21

7. (b) Filtering router and Bastion host
Internet
Protected
Intranet
Router only permits
traffic to/from bastion
host
2018/9/21

8. Bastion Host Runs special, secured OS. Can communicate with
Machines in Internet
Machines in protected network whose addresses are not externally visible.
2018/9/21

9. (c) Demilitarized Zone (DMZ)
Modem access
Bastion
host
Protected
intranet
inside router
Internet
outside router
Web server
DMZ
2018/9/21

10. DMZ Routers only permit traffic to/from DMZ network
IP addresses in protected net not made public
Unlike configuration (b), intranet is not affected by excessive attacking traffic from Internet to Bastion.
It is also safe if Web server is compromised.
2018/9/21

11. More on proxy server (application gateway)
Can deny requests from certain internal users
IP addresses of internal machines never appear in Internet
Can also function as caching proxy
All packets can be logged with address of requesting machines
May run on Bastion host, intranet or in DMZ
Disadvantages= extra delay
2018/9/21

12. HTTP proxy
2018/9/21

13. Local HTTP proxy Proxy Server Internet (B) HTTP (A) Proxy HTTP
Client
is configured to use proxy HTTP via (B).
(B) Sends GET page.html to
on behalf of (A).
2018/9/21

14. HTTP proxy = application gateway
Works in application level.
Can check if requested URL is allowed for this user.
Can search, e.g., for “CAFEBABE” (written in hex) in first 4 bytes of payload to block java bytecode being transferred.
2018/9/21

15. RMI thru firewall HTTP server Internet RMI server client_stub port
POST “data” to
java-rmi.cgi?forward=<rmiServerPort>
2018/9/21

16. Intrusion detection system
DMZ may contain Intrusion Detection System (IDS)
It inspects all inbound and outbound network activity and identifies suspicious patterns that may indicate network or system attack from someone attempting to break into or compromise system.
2018/9/21

17. IDS vs. firewall
IDS differs from firewall in that firewall looks out for intrusions in order to stop them from happening. Firewall limits access between networks in order to prevent intrusion and does not signal attack from inside network.
IDS evaluates suspected intrusion once it has taken place and signals an alarm. IDS also watches for attacks that originate from within system.
2018/9/21

18. Private network
2018/9/21

19. Hybrid network
2018/9/21

20. Virtual private network
2018/9/21

21. Addressing in a VPN
2018/9/21

22. Tunneling
2018/9/21

23. Virtual Private Network (VPN)
Internet
Intranet B
Intranet A
Tunneling
Router RA
Router RB RB
Data
Station 200
Station 100
encrypted
2018/9/21

24. Reverse proxy Controls inbound requests (accept/reject)
May be placed in DMZ or outside firewall
If request is accepted, it communicates securely with the server in the intranet
Some web pages may be made accessible to only to remote company employees
Company net
Firewall W eb
server
Random
external
user
Remote
company
Internet
Reverse proxy
2018/9/21

25. Filtering router
2018/9/21

26. Bastion host
2018/9/21

27. Web server directly accessible
Web server invasion doesn’t
endanger intranet.
2018/9/21

28. Intranet protected from compromised web server
penetration detected and some actions will be taken
2018/9/21