Bài giảng FireWall - Âu Bửu Long

Nội dung text: Bài giảng FireWall - Âu Bửu Long

1. Mạng máy tính nâng cao-V1 1
2. Firewalls & IDS Outline
   Firewalls ◦ Stateless packet filtering ◦ Stateful packet filtering  Access Control Lists ◦ Application Gateways
   Intrusion Detection Systems (IDS) ◦ Denial of Service Attacks 2
3. Firewalls Firewall isolates organization’s internal net from larger Internet, allowing some packets to pass, blocking others. administered public network Internet firewall 3
4. Why Firewalls? prevent denial of service (DoS) attacks: • SYN flooding: attacker establishes many bogus TCP connections, no resources left for “real” connections. prevent illegal modification/access of internal data . • e.g., attacker replaces CIA’s homepage with something else. allow only authorized access to inside network (set of authenticated users/hosts) three types of firewalls: 1. stateless packet filters 2. stateful packet filters 3. application gateways 4
5. Stateless Packet Filtering Should arriving packet be allowed in? Departing packet let out?
   internal network connected to Internet via router firewall.
   router filters packet-by-packet , decision to forward/drop packet based on: ◦ source IP address, destination IP address ◦ TCP/UDP source and destination port numbers ◦ ICMP message type ◦ TCP SYN and ACK bits. 5
6. Stateless Packet Filtering: Example Example 1: Block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23.
   all incoming, outgoing UDP flows and telnet connections are blocked. Example 2: Block inbound TCP segments with ACK=0.
   prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside. 6
7. Stateless Packet Filtering: More Examples Policy Firewall Setting No outside Web access. Drop all outgoing packets to any IP address, port 80 No incoming TCP connections, Drop all incoming TCP SYN packets to except those for institution’s any IP except 130.207.244.203, port public Web server only. 80 Prevent Web-radios from eating Drop all incoming UDP packets - except up the available bandwidth. DNS and router broadcasts. Prevent your network from being Drop all ICMP packets going to a used for a smurf DoS attack. “broadcast” address (eg 130.207.255.255). Prevent your network from being Drop all outgoing ICMP TTL expired tracerouted. traffic 7
8. Access Control Lists ° ACL: table of rules, applied top to bottom to incoming packets: (action, condition) pairs. source dest source dest flag action protocol address address port port bit outside of any allow 222.22/16 TCP > 1023 80 222.22/16 allow outside of 222.22/16 TCP 80 > 1023 ACK 222.22/16 outside of allow 222.22/16 UDP > 1023 53 222.22/16 allow outside of 222.22/16 UDP 53 > 1023 222.22/16 deny all all all all all all 8
9. Stateful Packet Filtering
   stateless packet filter: heavy handed tool ◦ admits packets that “make no sense,” e.g., dest port = 80, ACK bit set, even though no TCP connection established: source dest source dest flag action protocol address address port port bit allow outside of 222.22/16 TCP 80 > 1023 ACK 222.22/16 • stateful packet filter: track status of every TCP connection. o track connection setup (SYN), teardown (FIN): to determine whether incoming, outgoing packets “makes sense”. o timeout inactive connections at firewall: no longer admit packets. Advanced Computer Networks Firewalls and IDS 9
10. Stateful Packet Filtering ACL augmented to indicate need to check connection state table before admitting packet. source dest source dest flag check action proto address address port port bit conxion outside of any allow 222.22/16 TCP > 1023 80 222.22/16 allow outside of 222.22/16 TCP 80 > 1023 ACK x 222.22/16 outside of allow 222.22/16 UDP > 1023 53 222.22/16 allow outside of 222.22/16 x UDP 53 > 1023 222.22/16 deny all all all all all all 10
11. Application Gateways
    Filters packets on application data as well as on IP/TCP/UDP fields. Example: Allow select internal users to telnet outside. gateway -to -remote host telnet session host-to-gateway telnet session application router and filter gateway 11
12. Limitations of Firewalls and Gateways
    IP Spoofing: router
    Filters often use all or can’t know if data nothing policy for UDP. “really” comes from
    Tradeoff : degree of claimed source. communication with
    If multiple app’s. need outside world, level of special treatment, security. each has own app.
    Many highly protected gateway. sites still suffer from
    Client software must attacks. know how to contact gateway. ◦ e.g., must set IP address of proxy in Web browser. 12
13. Intrusion Detection Systems (IDS)
    Packet filtering: ◦ operates on TCP/IP headers only. ◦ no correlation check among sessions. IDS: Intrusion Detection System
    Deep packet inspection: look at packet contents (e.g., check character strings in packet against database of known virus, attack strings).
    Examine correlation among multiple packets:  port scanning  network mapping  DoS attack 13
14. Intrusion Detection Systems
    Multiple IDS’s: employ different types of checking at different locations. application firewall gateway Internet internal network Web IDS server DNS sensors FTP server server demilitarized zone 14
15. Firewalls & IDS Summary
    Firewalls ◦ Stateless packet filtering ◦ Stateful packet filtering  Access Control Lists ◦ Application Gateways
    Intrusion Detection Systems (IDS) ◦ Denial of Service Attacks 15
16. Q&A Mạng máy tính nâng cao-V1 16