Building Firewalls With OpenBSD And PF, 2nd Edition (2003)

pockets can afford to employ well-paid professional staff who provide better protection for their networks than organizations with tiny or nonexistent IT security budgets. This is not always the case, but exceptions to this rule should not be used to justify cuts in spending on IT security.

An unfortunate result of low supply and high demand is the migration of highly skilled personnel to clients who can meet their salary requirements. This leaves a lot of small and underfunded networks in the hands of less experienced administrators, who might not know how to design, conŒgure, and monitor these networks' safety mechanisms leaving them vulnerable to attacks from unscrupulous people looking for inside information, free warez storage, zombie hosts for DDoS attacks, or systems they can simply make inoperable for the sheer fun of doing it.

But even a fat wad of cash does not always solve all problems for large companies. Restricted by commercial licenses and limited by the size of their security budgets, even the giants of IT often cannot afford as high levels of protection as they would like to have. Fortunately, many good security products are now available for free and can be implemented using commodity hardware components and commodity free open source software (the word free is important here, as not all open source software is free of licensing traps).

Using free open source software makes more sense today than ever, not only because there are plenty of high-quality open source IT security tools, but because those who learn them now, will be sought after tomorrow. The world is entering the era of software commoditization. It will bring the cost of purchase of many tools to $0.00 and raise the salaries of people who know how to use these tools. The funds saved in that way can be moved to training, purchases of specialist books (like this one), and better hardware, which too can be built using commodity, off-the-shelf components, instead of expensive commercial black boxes that often run modiŒed versions of free software anyway.

With so much high-quality free open source software available now and even more coming in the future, the race between commercial and free open source Œrewall software will soon be over, just as it happened in the Œelds of HTTP servers (Apache), electronic mail distribution (sendmail, postŒx, qmail, and zmailer), server-side scripting (PHP, Perl, Python, Tcl), databases (MySQL, PostgreSQL), and many other segments of the market.

As Christopher Koch wrote in his recent CIO magazine article, `Any CIO without an open source strategy in 2003 will be paying too much for IT in 2004.' The full text of his article is available at the following address:

http://www.cio.com/archive/031503/opensource.html

Open source has another advantage: it levels the playing Œeld, because everybody is using the same tools, and in the case of security, it gives everyone the same high level of protection. Although it might seem to be against the interests of the big players, giving the same tools to the little guys is actually good for both sides. It makes sense when you think about it on a different level of selŒshness. When the small guys can deploy topquality software to better protect their networks they will be less likely used as launch pads for attacks against the rich guys' networks.

1.4 Why OpenBSD and pf

Why should you use OpenBSD and pf to protect your network? There are many reasons legal, Œnancial, and technical.

As for the technical reasons, the Œrst one is quite obvious; if you want to use Daniel Hartmeier's pf packet Œlter, you need to install OpenBSD, because it is closely integrated with that particular operating system. This will soon cease to be the only option, as ports to FreeBSD and NetBSD are already in the works, though it will be some time before they are fully integrated with those other operating systems.

The next technical reason is the maturity of the BSD code base. There's over 25 years of development stored in that code since BSD was born in 1976. That's a lot of experience in operating systems design stored in those CVS archive, all available for free. As the BSD source code matures, it becomes more stable thanks to the system development model, which for all free BSD systems is less dynamic than the development model of other free operating system like Linux. You always know who is responsible for what, and new code, although always welcome, is never accepted into the CVS tree without thorough review.

Then, there is the obsession with security that the OpenBSD team is famous for. Every new release of OpenBSD, published at regular 6-month interval, delivers important security enhancements, which later Œnd their way into

other operating systems. The source code undergoes periodic audits and the project constantly develops and integrates new security and cryptography tools, often well ahead of other free and commercial operating system developers. For example, the OpenBSD team was the Œrst to ship a working implementation of IPSec. Recent additions of propolice, systrace, W^X, and a non-executable stack greatly improve the overall security of the system. The coming full PROT_ implementation will make it even more secure. If you are not sure OpenBSD is a good choice, just for the fun of watching their reactions, ask your operating system vendor's representatives about these features.

The OpenBSD project is also closely afŒliated with the OpenSSH project, which develops a free and open source implementation of the SSH1 and SSH2 protocols that you may have already used. While many other free and commercial operating systems often include similar security tools, the ease of use, the compactness, and the close integration of every component make OpenBSD a much better choice for security applications than FreeBSD, NetBSD, or Linux.

As for the pf packet Œlter, it is a modern, solid piece of security software that grows in functionality every month. It offers many features unavailable on commercial Œrewalls. IPv4 and IPv6 packet Œltering, NAT, stateful Œltering, packet normalization, dynamic rulesets, bandwidth shaping (integrated ALTQ), load balancing, packet logging, spam Œltering, and support for user authentication on the Œrewall are only a few items on the list of its standard features. If there is something one would want a Œrewall to do, it is probably already implemented in pf, or it will be there in the next release. Over the last two years, pf has earned excellent reputation for its ease of administration, richness of options, stability, and performance. And, since pf is running on top of a secure operating system, you can create your own custom solutions not possible with commercial hardware or software Œrewalls. You can be sure that the next months and years will bring many useful add-ons for pf.

Another good reason for choosing OpenBSD and pf is the freedom to conŒgure them as you like. You are no longer restricted by limited functionality, complex licensing schemes, or fees. No less useful will be the availability of OpenBSD and pf for many hardware platforms, including i386, Sparc, Sparc Ultra, Alpha, and others. And, if you would like to have OpenBSD or pf ported to another hardware platform, all you have to do is

download the code and get to work, or hire the OpenBSD developers to do it for you. (It's a win-win situation. You will get they tools you want, and the OpenBSD developers will get funds they need to keep on doing their great work for the world wide community.)

As for the legal reasons for using OpenBSD and pf, you should read the BSD license. Unlike 99.999% of licenses, this one is a pleasure to read. It makes OpenBSD truly free software, because it is not yet another GPLstyle viral licensing, but a business-friendly set of rules that anyone can understand in 15 seconds. (This is not to say that GPL is useless, but some businesses cannot use software licensed under its terms.)

The following is not intended as a legal advice, but if you need to convince your boss or company lawyer to use OpenBSD, try to bring to their attention the fact that the BSD license lets anyone use the sources of the software licensed under its terms for any purpose, including making money with it. Such code can be merged with software licensed under any terms, free or commercial, as long as you acknowledge the copyright of the author(s) who created that code. It means that you can safely integrate OpenBSD and pf into your existing network without fear of violating some obscure licensing term. You can even package OpenBSD and pf and sell it or embed it in your expensive black box hardware. Also, because OpenBSD and pf are free (as in freedom and as in beer), you can install and use them on as many machines as you like. This will surely impress your accountants, lawyers, and bank managers.

1.5 Cryptography and Law

OpenBSD ships with strong free open source cryptographic software. Before you download or export it in any way, always check appropriate local and foreign cryptographic laws. You can start your search with the Crypto Law Survey page maintained by Bert Jaap-Koops:

When in any doubt, always consult lawyers with expertise in crypto import/export laws. Some countries consider cryptography a weapon and punish people and companies using it as if they were smuggling weapons, when it is done without the approval of appropriate bodies.

1.6 How This Book Is Organized

The main text of this book is divided into sixteen chapters and four appendices.

Chapter 1, Introduction is this introduction, which tries to explain why we need to protect the computers and the networks we're in charge of, why we should use OpenBSD and pf, and how to keep in touch with the OpenBSD project, developers, and the author of this book.

Chapter 2, Firewall Designs presents popular Œrewall conŒgurations and discusses their uses, pros and cons. Every design is illustrated with a diagram, and some less obvious designs are discussed as well.

Chapter 3, Installing OpenBSD discusses basic hardware and software requirements that must be met to let OpenBSD and pf do their job. Also discussed are factors that affect Œrewall performance and ways to improve it.

Chapter 4, ConŒguring OpenBSD explains how to conŒgure IP networking, routing, kernel, and system startup scripts. The readers will also learn about user management, system hardening, patching, and installing additional software,

Chapter 5, /etc/pf.conf introduces the reader to the structure of the pf conŒguration Œle, pf.conf and explains the use of macros in pf rules. Of additional interest are sections on tools for editing pf.conf and a short course in CVS.

Chapter 6, Packet Normalization explains why it is a good security practice to normalize fragmented packets, how it is done with pf, and how it helps improve the accuracy of reports generated by Network Intrusion Detection Systems (NIDS).

Chapter 7, Packet Redirection shows when and how packet redirection is used in Network Address Translation, Virtual Private Networks, network administration and some of the Œrewall designs discussed in Chapter 2,

Firewall Designs.

Chapter 8, Packet Filtering dives deep into the subject of packet Œltering.

Rules, options, •ags, shortcuts, and everything else that has to do with packet Œltering is covered there.

Chapter 9, Dynamic Rulesets discusses two important recent additions to pf: tables and anchors, and their use in creating dynamic rulesets.

Chapter 10, Bandwidth Shaping and Load Balancing walks the reader through the maze of the Alternative Queuing system (ALTQ), which was recently integrated with pf. You will Œnd there tips for deŒning ALTQ queues and load balancing rules. Read this chapter if you want to keep MP3 downloaders at bay or when you need to implement load balancing on your servers or external connections to the Internet.

Chapter 11, Logging and Log Analysis is a description of various approaches to packet logging and analysis that can be implemented using pf and other free open source tools.

Chapter 12, Using authpf describes the authpf authenticating gateway user shell. This part of the pf package provides an additional level of security, especially handy when you are working with wireless networks.

Chapter 13, Using spamd explains how spamd can be used with pf to make spammers' ways less proŒtable.

Chapter 14, Ruleset Optimization explores various methods of ruleset optimization, from brute force to more streamlined rulesets.

Chapter 15, Testing Your Firewall walks the reader through the process of Œrewall testing and ruleset debugging.

Chapter 16, Firewall Management discusses the many facets of Œrewall management and tools that help.

Appendix A, Manual Pages contains a list of manual pages related to pf with short descriptions of their contents. Also included are tips on using the system manual.

Appendix B, Rules for Popular (and Less Popular) Services, a quick reference for ruleset writers.

(publishers of books for the OpenBSD community)

1.9 Getting in Touch with the Author

Important updates, corrections, and announcements related to this book are posted on the Web at the following address:

http://www.devguide.net/books/openbsdfw-02-ed/

If you would like to be kept updated on what Jacek's doing, be the Œrst to hear about updates or new editions of this book, subscribe to the jacek-obsd mailing list:

http://www.artymiak.com/mailman/listinfo/jacek-obsd

Bug reports, questions, and comments about this book should be sent to:

openbsdpf-ed-02@devguide.net

If you like this book, let others know about it!

16