12.10. ORDERED ACCESS CONTROL AND POLICY CONFLICTS

Figure 12.2: IPSec configuration 1.

Using IPSec policy rules, an encrypted tunnel is built between H1 and the secure gateway SG2 in order to protect the traffic. However, the IPSec policy rules on the firewall are set by a different authority, and they can be specified so that encrypted packets can be denied access. If the firewall FW1 has such a rule, either intentionally or unintentionally, then all packets will be dropped and communication will be mysteriously impossible.

Example 21 (IPSec 2). Suppose that H1 is still trying to encrypt traffic to SG2, with the same tunnel rule. Suppose the firewall FW1 now has the rules:

Allow: source=H1, destination=H2

Deny: all others

However, since the encryption tunnel changes the destination to be SG2 in the outer encapsulation header, the firewall will mistakenly drop all traffic from H1 to H2 that should be allowed. Even though the traffic has the correct source and destination addresses, the overlapping rules cause problems.

In the following example, encryption plays a role in fixing a strong ordering of rules that can lead to unfortunate mis-communications.

Example 22. (IPSec 3). Consider two separate sites (figure 12.3), each with their own IPSec gateways (SG1 and SG2). Suppose that the administrator from department D1 who is in charge of SG1 decides that all traffic from D1 to site O2 should be encrypted by a tunnel from SG1 to SG3. In a different building, another administrator who controls SG2 decides that traffic from site O1 to site O2 should be encrypted through a tunnel from SG2 to SG4.

What happens now, when someone in department D1 attempts to send a message to someone in department D2? The traffic between the sites is now governed by two

Figure 12.3: IPSec configuration 2.

A firewall blocks access at the network level. For instance, Cisco IOS rules:

ip access-group 100 in

Modern versions of operating systems can filter IP packets in the kernel too, giving hosts effectively a host-based firewall. For instance, Linux and FreeBSD have IP tables, formerly known as ‘IP chains’:

The CIDR notation 0/0 is the same as 0.0.0.0 255.255.255.255, or any. A default policy for any packets that are not ACCEPTed is set as follows:

iptables -P INPUT DROP iptables -P OUTPUT DROP

Windows 2000 has corresponding ‘IPSec filters’ and the local security policy has an IP filter list.

12.12 Firewalls

A firewall is a network configuration which isolates some machines from the rest of the network. It is a gate-keeper which limits access to and from a network. Our human bodies are relatively immune to attack by bacteria and viruses because we have a barrier: skin. The skin contains layers of various fatty acids in which bacteria and viruses cannot normally survive. If we lose the skin from a part of the body, wounds become quickly infected; indeed, prior to antibiotics, many people died from infected wounds. A firewall is like a skin for a local area network.

The idea is this: if we could make a barrier between our local network and the Internet which is impenetrable, then we would be safe from network attacks. But if there is an impenetrable barrier so that no one can get into the network, then no one can get out either. Why pay for a firewall when we could just pull out the network cable? Think of the body again: we have to put food and air into our bodies and we have to let stuff out, so we need a hole in the skin (preferably several). We do not usually die of the food we eat because the body has filters which screen out and break down dangerous organisms (stomach acid and layers of mucus etc.). These then hand us the ‘input’ by proxy. We do the same thing with computer networks. A firewall is not an impenetrable barrier: it has holes in it with passport checks. We demand that only network data with appropriate credentials should be allowed to pass.

12.12.1A firewall concept

A firewall is a concept. It is not a thing; there is no single firewall solution. The name ‘firewall’ is a collective description for a variety of methods which restrict

to realize that installing a firewall does not give absolute protection and it does not remove the importance of configuring and securing the hosts on the inside of the firewall.

It should also be noted that a firewall is usually a single point of failure for a network. It is vulnerable to Denial of Service attacks.

12.12.2Firewall proxies

Of course we do not want all traffic to stop; some services like E-mail and maybe HTTP should be able to pass through. To allow this, one uses a so-called ‘proxy’ service or a ‘gateway’.5 A common solution is to give the bastion host two network interfaces (one is then connected to the unsafe part of the network and the other is connected to the safe part), though the same effect can be obtained with a single interface. A service is said to be proxied if the bastion host forwards the packets from the unsafe network to the safe one. It only does this for packets which meet the requirements of the security policy. For instance, you might decide that the services you require to cross the firewall are inbound/outbound telnet, inbound/outbound SMTP (mail), DNS, HTTP and FTP but no others.

Principle 66 (Community borders). Proxying is about protecting against breaches to the fundamental principle of communities. A firewall proxy provides us with a buffer against violations of our own community rights from outside, and also provides others with a buffer against what we choose to do in our own home.

Proxying requires some special software, often at the level of the kernel where the validity of connections can be established. For instance, packets with forged addresses can be blocked. Data arriving at ports where there was no registered connection can be discarded. Connections can be discarded if they do not relate to a known user-account.

12.12.3Example: dual-homed bastion host

A simple firewall configuration is shown in figure 12.4.

In this example we have effectively two routers, a DMZ and a protected network. The first packet-filtering router will route packets between the Internet and one of three hosts. FTP is routed directly to a special FTP server. The same applies to HTTP packets. These services are dealt with by separate hosts, so that (if something should go wrong and the machines are broken into) it is no worse than having to restore these single hosts from backup. None of the servers in the DMZ have normal user accounts, so there would be no help to crackers trying to crack password files there, if they managed to break in. The bastion host gets all packets which are not for the other services. The bastion host forwards okay-looking packets to the internal router which is really just a further packet filter (a backup in case of failure of the bastion host). The internal router accepts only packets passing between the safe network and the bastion host, all others are rejected.

5This should not be confused with a WWW caching proxy, which is a kind of cache for frequently used HTML pages.

external Internet

external

ftphost httphost

router

DMZ

BASTION

HOST

internal network

Figure 12.4: A simple firewall with a dual-homed bastion host.

The bastion host proxies all of the appropriate protocols including FTP and HTTP between the safe network and the DMZ.

12.12.4Example: two routers

A second example, in which there is no dual-homed host, is shown in figure 12.5. In this configuration we use two routers to allow increased protection. An exterior router connects the site to the Internet, or the untrusted ‘outside’ network. The interior router protects the internal network from the bastion host and from the DMZ. Although the bastion host does not physically separate the exterior and interior networks, it still separates them through proxy software, by forcing

packets to be routed through the bastion host’s proxy services.

In order to illustrate router filtering tables more explicitly, let us assume that we have a WWW server and FTP server in the DMZ, and an SMTP server on the

external Internet

external

BASTION

router

HOST ftphost httphost

DMZ

internal router

internal network

Figure 12.5: Firewall with no dual-homed host, but two routers.

internal network. The DNS service is split. Data pertaining to the outside network are kept in an authoritative server on the bastion host itself. DNS data about the internal network are not visible to the outside world; they are kept on the internal network, on a separate internal DNS server. Local machines are clients of the internal DNS server, so that DNS data are maximally protected.

The router filtering tables are shown and explained in tables 12.1 and 12.2 (see also ref. [61] for an excellent discussion of filtering and firewalls in general). They are designed to route traffic through the proxy servers on the bastion host, and direct special services (SMTP, HTTP etc.) only to the hosts which need to receive them. The bastion host, as usual, has a stripped down operating system, to remove as many potential exploits from the reach of potential intruders. The filter rules distinguish between traffic which is incoming and traffic which is outgoing. Note that TCP and UDP traffic differs here. Whereas TCP traffic generally involves fixed port addresses on servers and random ports (with port numbers greater than 1023, actually usually much higher than this) on clients, we have to be careful about filtering possible traffic based on port numbers. In practice, 1023 is probably far too low a port number to set here, but it is difficult to make generic rules for random port numbers, so we use this number as a mnemonic. Some spoofing attempts are prevented by requiring the ACK bit to be set on TCP connection requests. The ACK bit is not set on SYN packets which initiate connections, only on replies, so requiring the ACK bit to be set is a way of saying that these rules require traffic to be part of an already established dialogue between legitimate ports. This prevents a remote attacker from using a well-known port externally to attempt to bypass the filter rules to attack a server living at a port number over 1023.6 The corresponding outgoing rule can be considered a service to other sites, which stifles local spoofing attempts.

12.12.5A warning

The foregoing configurations are just examples. In practice we might not have all the hardware we need to separate things as cleanly as shown here. Although there is a public domain firewall toolkit [115], most firewall software is commercial in nature because it needs to live in the kernel and make use of code which is proprietary.

Firewall management is a complex issue. We cannot set up a firewall and then forget about it. Firewalls need constant maintenance and they are susceptible to bugs just like any other software. It is best to build up a firewall system slowly, understanding each step. A good place to start is with packet-filtering routers to eliminate the most offensive or least secure service requests from outside your local network. These include NFS (RPC), IRC, ping, finger etc.

Today, many consider firewalls to be an outdated idea, one that is no substitute for host-based security. Network services are evolving so quickly that it is difficult for any ‘patch it up’ technology to keep up. What is needed is fundamentally secure services. For instance, many services today are implemented via the World

6Attackers are devious. We should not imagine that, simply because a filtering rule was intended for, say, SMTP traffic, it could not be manipulated for some other purpose.

Table 12.2: External router filter table. External connections are forced to go through the bastion host proxies.