Cryptography and Network SecurityChapter 20 Firewalls.ppt

* Firewalls and Malware Should preferably control both ingoing and outgoing traffic Windows XP firewall controls only ingoing traffic Trojans can start up servers on the inside Firewall should preferable inspect packets on the application layer Network layer based packet filters do not provide adequate protection * Firewalls and Malware New worms/viruses often tries to kill firewall and anti virus processes “Tunneled Worms” Tunnel IP packet within other IP packet to hide real IP header Tunneling program can be built in in Trojans Tunneled IP packet * IP- Tables IP Tables is the standard kernel firewall system for Linux since Kernel 2.4.x Packet Filtering and NAT for linux * Rule -t table Nat (PREROUTING, POSTROUTING) Mangle (PREROUTING, POSTROUTING) Filter (default) (FORWARD, INPUT, OUTPUT) iptables [-t table] command [match] [traget/jump] * Rule Command -P, --policy -A, --append -D, --delete -R, --replace -L, --list ... iptables [-t table] command [match] [traget/jump] * Rule Match (generic) -p, --protocoll (TCP, UDP, ICMP) -s, --source (IP Adresse/port) -d, --destination (IP Adresse/port) -i, --in-interface (eth0, eth1, ppp1) -o, --out-interface (eth0, eth1, ppp1) -m, --match (special commands) iptables [-t table] command [match] [traget/jump] * Rule Target/jump -j ACCEPT -j DROP -j LOG -j MAQUERADE ... iptables [-t table] command [match] [traget/jump] * Example Rules iptable –P FORWARD DROP Introduce the general policy to drop all packages Iptable –t nat –P PREROUTING ACCEPT Accept prerouting nat traffic iptable –A FORWARD -i eth1 –p TCP–d 84 -–dport 80 –j ACCEPT Accept all tcp connections to port 80 coming in at my second network interface to my ip iptables –A FORWARD –m limit –-limit 3/minutes –j LOG Log all refused connections but max. 3 per minute * Additional Literature Building Internet FirewallsZwicky, CooperISBN 1565928717; O‘Reilly iptables Tutorial 1.1.16Oskar Andreasson/iptables-tutorial.html * Lecture slides by Lawrie Brown f