DOCSLIB.ORG

Análise De Usabilidade Da Ferramenta Ipfirewall Para Firewall

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Análise De Usabilidade Da Ferramenta Ipfirewall Para Firewall Furin e Machado Junior (2011). ANÁLISE DE USABILIDADE DA FERRAMENTA IPFIREWALL PARA FIREWALL Marcelo Antonio Ferreira Furin Graduado em Sistemas de Informação pela LIBERTAS Faculdades Integradas. Dorival Moreira Machado Junior Mestra em Sistemas de Informação e professor da LIBERTAS Faculdades Integradas. 1. INTRODUÇÃO A importância do firewall evidencia-se pela expansão da internet e o consequente aumento de usuários, muitas vezes, sem o conhecimento acerca da proteção de sua rede e sua máquina. Com isso, por meio da ferramenta IPFIREWALL, um filtro de pacotes do sistema operacional FreeBSD, será analisado suas funcionalidades nativas. Outro ponto de destaque para a importância do firewall é evitar que o craker (é o termo usado para designar quem pratica a quebra (ou cracking) de um sistema de segurança, de forma ilegal ou sem ética) invadam os arquivos não autorizados. Dentre as razões para se utilizar o firewall é ajudar a proteger à rede ou computador do usuário de acessos maliciosos de hacker (são indivíduos que elaboram e modificam software e hardware de computadores, seja desenvolvendo funcionalidades novas, seja adaptando as antigas). 2. PROBLEMA DE PESQUISA Utilizando a ferramenta IPFIREWALL para firewall, sem usar quaisquer, ferramentas para auxílio, tem-se o ambiente no qual se origina a pergunta de pesquisa que norteará o presente estudo: No que é possível fazer com as funcionalidades nativas do IPFW? 2.1 OBJETIVO GERAL O objetivo deste trabalho é descrever todas as funcionalidades nativas do IPFW, o qual vem como firewall padrão no sistema operacional FreeBSD, e comprovar que é 100 Furin e Machado Junior (2011). possível fazer o mesmo trabalho realizado pelo IPTABLES gerando um script com as regras. 2.2 JUSTIFICATIVA Uma proposta de utilizar a ferramentas IPFW para ser desenvolvido um script utilizando as mesmas regras propostas no Netfilter gerenciado através do Iptables. 3. REFERENCIAL TEÓRICO O objetivo desse referencial teórico é analisar a ferramenta IPFIREWALL com firewall, analisando os conceitos de funcionalidades de portas de comunicação, o uso de protocolos de comunicação, a estrutura de um firewall, os tipos, analisando sua segurança. 3.1. SISTEMA OPERACIONAL FREEBSD O nome FreeBSDé compostopela sigla Free (de software livre) e BSD (BerkeleySoftwareDistribuition, (software de distribuição da universidade Berkeley ),foi desenvolvido a partir d a versão 4.4BSD-Lite do Grupo de Pesquisa em Sistemas Computacionais (CSRG) da Universidade da Califórnia Berkeley. O projeto FreeBSD teve seu nascimento no início de 1993, em parte como uma consequência do conjunto de manutenção não-oficial do 386BSD (Unofficial 386BSD Patchkit) pelos seus 3 últimos coordenadores, O time de responsáveis pelo desenvolvimento deste patchkit, formado por Nate Williams. Rod Grimes e Jordan, da universidade Berkeley na Califórnia, resolveram levá-la ao conhecimento do mantenedor do projeto Bill Jolite e lynneJolitz,desenvolvedores do sistema operacional 386BSD. O nome 386 originou-se pelo motivo de abranger a arquitetura da Intel, que não teve adequada aceitação as intenções dos desenvolvedores. (386bsd). É tem um código fonte disponibilizado pela universidade de Berkeley, disponível para arquitetura x86 (incluindo Intel e Amd), e arquitetura 64 (Amd64 e Intel64). O sistema FreeBSD tem o termo de licença com software Open Source, é um software de utilização livre, para qualquer usuário ou pessoa. E todos podem contribuir com ele, seja no seu desenvolvimento, na correção de erros ou na documentação, desde que a condição de liberdade seja mantida. 101 Furin e Machado Junior (2011). Este paradigma revolucionou a maneira com que softwares são desenvolvidos, baixando os custos de desenvolvimento e aumentando à agilidade, resultando em softwares de excelente qualidade e em constante evolução. Essas restrições não definem regras a respeito de como o código deve ser utilizado, mas de como deve tratar o Projeto FreeBSD ao utilizar código distribuído pelo mesmo. (FreeBSD, 2011). 3.2PROTOCOLOS Protocolo é um padrão de comunicação, para que dois ou mais computadores consigam se comunicar. Ex. a linguagem de comunicação entre duas pessoas e a linguagem em que elas se comunicam, existem vários tipos de protocolos tais como TCP, UDP, ICMP. O protocolo de rede é a linguagem usada para a comunicação entre um computador e outro. Existem vários tipos de protocolos usados para a comunicação de dados, alguns são projetados para pequenas redes (como é o caso do NetBios) outros para redes mundiais (TCP/IP que possui características de roteamento). Dentre os protocolos, o que mais se destaca atualmente é o TCP/IP devido ao seu projeto, velocidade e capacidade de roteamento. (FOCA, 2007). 3.2.1 Protocolo TCP O protocolo TCP (TransmissionControlProtocol), foi desenvolvido para estabelecer uma conexão confiável em uma Inter-rede não confiável e também para se adaptar dinamicamente ás propriedades Inter-redes, e se adaptar a muitas falhas encontradas que pode ocorrer. O TCP foi definido na RFC 793, depois de encontrada erros, foram definidos os erros e correções na RCF 1122, com extensões fornecidas na RCF 1323. (TANENBAUM 2003, p.568). O protocolo TCP é um protocolo confiável, pelo motivo dos pacotes de reconhecimento. Esse protocolo é um pouco mais lento que o UDP,um dos aplicativos que utiliza ele é o FTP. (SCRIMGER, LA SALLE, PARINHAR, GUPTA, 2002, p. 11). O protocolo básico utilizado pelas entidades TCP é o protocolo de janelas deslizante. Quando envia um segmento, o transmissor também dispara um timer, quando o segmento chega ao destino, a entidade TCP receptora retorna um segmento (com ou sem dados, de acordo com as circunstancias) com um numero de confirmação igual ao próximo numero de sequencia que espera que receber. Se o timer do transmissor expirar antes de a confirmação ser recebida, o segmento será retransmitido. (TANENBAUM 2003, p.570) 102 Furin e Machado Junior (2011). 3.2.2 Protocolo UDP Protocolo UDP (UserDatagramProtocol), é um protocolo de transporte sem conexão, fornecendo um meio para as aplicações enviarem datagramas IP encapsuladas sem que seja necessário estabelecer uma conexão, sendo descrito na RFC 768, o UDP é utilizado em situação de cliente servidor, umas das aplicações que utiliza o UDP e o DNS (Domain Name System), sistema de nomes de domínios, sendo responsável por converter o endereço digitado no navegador pelo IP. (TANENBAUM 2003, p.590 - 560). O UDP é um protocolo simples e tem alguns usos específicos, como interação cliente/servidor e multimídia, porém para a maioria das aplicações de internet, é necessária uma entrega confiável e em sequencia. O UDP não pode proporcionar isso, e assim foi preciso criar outro protocolo. (TANENBAUM 2003, p.556). O protocolo UDP, é um protocolo não confiável, apesar de mais rápido que o TCP, pois não possui o protocolo de reconhecimento. Exemplo: um aplicativo que usa esse protocolo é o telefone. O UDP não garante a entrega de pacotes, mas oferece um pacote de integridade. Tanto o TCP como o UDP realizarão verificações de erros no recebimento dos pacotes de dados. Se um pacote tiver erros ele será descartado. O UDP é normalmente mais rápido que o TCP porque o UDP tem alguns overheads mais baixos para a transmissão de dados. Um exemplo de um aplicativo que utiliza o UDP é o serviço de TFTP. (SCRIMGER, SALLE, PARINHAR, GUPTA, P. 11). 3.2.3 Protocolo ICMP O protocolo ICMP (Internet ControlMessageProtocol), ao contrário de outros protocolos como UDP e o TCP, não transmite dado, sendo responsável por enviar relatórios. Um dos principais comandos desse protocolo é o PING (packet internet groper), responsável por verificar a conectividade entre dois hosts de IP e também realizando a função de monitorar e informar erros entre máquinas. As redes devem funcionar adequadamente o tempo todo, mas elas não funcionam. Quando algo está errado na camada Inter-rede, a Internet ControlMessagingProtocol (ICMP) age como um solucionador de problemas. O ICMP é um protocolo de manutenção que informa erros de host para host. O ICMP está documentado na RCF 792. (SCRIMGER, LA SALLE, GUPTA, 2002, p.119). 103 Furin e Machado Junior (2011). 3.3 FIREWALL Firewall é o nome dado ao dispositivo de rede que tem por função regular o tráfego de pacotes entre redes distintas e filtrar os dados entre uma rede e outra, aplicando regras ao tráfego de dados entre um e outro baseado nelas, o firewall decide o que deve ou não passar. É justamente por isso que nenhum firewall é 100% seguro, já que precisa fazer seu trabalho sem prejudicar o computador da rede. (MORIMOTO 2008, p. 396). O firewall não faz a verificação de vírus, ou trojans, ele faz a verificação dos endereços de origem ou destino e portas destinadas. Essa parte de verificação dos conteúdos dos pacotes é designada pelo antivírus. O firewall é um software que contém uma seqüência de regras, que dizem o que ele deve fazer ou não, e os pacotes que não se encaixarem em umas das regras, devem ser aceitos ou recusados de acordo com a política de segurança implantada na empresa. O firewall e implementado em regras, em dispositivos que fazem a separação da rede interna e externa, chamados de estações guardiões os bastion hosts. São máquinas configuradas para desempenhar algum papel crítico na segurança da rede interna. Quando o bastion host cai, a conexão entre a rede interna e externa para de funcionar. Os firewall podem ser classificados como, Stateless e Stateful.(INFOWESTER, 2004). STATELESS: Esse tipo de filtragem define os filtros, cada um dos pacotes, à medida que são transmitidos, e são definidas as regras, indicando os endereços de rede origem e destino, e as portas TCP/IP usadas na transmissão, essa análise é mais rápida e não causa o atraso (delay), na retransmissão dos pacotes, sendo um modo transparente para rede.FirewallsStateless podem observar o tráfego da rede, e restringir ou bloquear pacotes com base em endereços de origem e destino, ou regras configuradas pelo usuário.
Load more

Recommended publications
  • Proceedings of the Bsdcon 2002 Conference
    USENIX Association Proceedings of the BSDCon 2002 Conference San Francisco, California, USA February 11-14, 2002 THE ADVANCED COMPUTING SYSTEMS ASSOCIATION © 2002 by The USENIX Association All Rights Reserved For more information about the USENIX Association: Phone: 1 510 528 8649 FAX: 1 510 548 5738 Email: [email protected] WWW: http://www.usenix.org Rights to individual papers remain with the author or the author's employer. Permission is granted for noncommercial reproduction of the work for educational or research purposes. This copyright notice must be included in the reproduced paper. USENIX acknowledges all trademarks herein. Flexible Packet Filtering: Providing a Rich Toolbox Kurt J. Lidl Deborah G. Lidl Paul R. Borman Zero Millimeter LLC Wind River Systems Wind River Systems Potomac, MD Potomac, MD Mendota Heights, MN [email protected] [email protected] [email protected] Abstract The BSD/OS IPFW packet filtering system is a well engineered, flexible kernel framework for filtering (accepting, rejecting, logging, or modifying) IP packets. IPFW uses the well understood, widely available Berkeley Packet Filter (BPF) system as the basis of its packet matching abilities, and extends BPF in several straightforward areas. Since the first implementation of IPFW, the system has been enhanced several times to support additional functions, such as rate filtering, network address translation (NAT), and traffic flow monitoring. This paper examines the motivation behind IPFW and the design of the system. Comparisons with some contemporary packet filtering systems are provided. Potential future enhancements for the IPFW system are discussed. 1 Packet Filtering: An Overview might choose to copy only this data.
    [Show full text]
  • BSD UNIX Toolbox 1000+ Commands for Freebsd, Openbsd
    76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iii BSD UNIX® TOOLBOX 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD®Power Users Christopher Negus François Caen 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page ii 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page i BSD UNIX® TOOLBOX 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page ii 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iii BSD UNIX® TOOLBOX 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD®Power Users Christopher Negus François Caen 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iv BSD UNIX® Toolbox: 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD® Power Users Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2008 by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-470-37603-4 Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 Library of Congress Cataloging-in-Publication Data is available from the publisher. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permis- sion should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions.
    [Show full text]
  • DN Print Magazine BSD News BSD Mall BSD Support Source Wars Join Us
    Mirrors Primary (US) Issues August 2001 August 2001 Get BSD Contact Us Search BSD FAQ New to BSD? DN Print Magazine BSD News BSD Mall BSD Support Source Wars Join Us T H I S M O N T H ' S F E A T U R E S From the Editor The Effects of Tuning a FreeBSD Box for High Open Packages Reaches Performance Milestone 2 by Gilbert Gong by Chris Coleman Each BSD project has its A stock FreeBSD installation delivers a system which is own 3rd party software designed to meet the needs of most users, and strives to packaging system. They are provide the best balance of safety, reliablity, and all based on the same code, performance in a multi-user environment. It is therefore not yet, each of them have optimized for use as a high performance dedicated network features that make one server. This article investigates the effect of tuning a better than the other. Open FreeBSD for use as a dedicated network server. Read More Packages is a volunteer project to unify that code base and incorporate the best features of each. The NetBSD rc.d system by Will Andrews Get BSD Stuff There's been a lot of hubbub the last few months about NetBSD's new rc.d system being the successor of 4.4BSD's. At the USENIX Annual Technical Conference 2001 in Boston, MA, I had the pleasure of sitting down to listen to Luke Mewburn of Wasabi Systems discuss the new rc system NetBSD introduced in their operating system in the 1.5 release earlier this year.
    [Show full text]
  • How to Accelerate Your Internet
    How To Accelerate Your Internet A practical guide to Bandwidth Management and Optimisation using Open Source Software How To Accelerate Your Internet For more information about this project, visit us online at http://bwmo.net/ Editor: Flickenger R. Associate Editors: Belcher M., Canessa E., Zennaro M. Publishers: INASP/ICTP © 2006, BMO Book Sprint Team First edition: October 2006 ISBN: 0-9778093-1-5 Many designations used by manufacturers and vendors to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the authors were aware of a trademark claim, the designations have been printed in all caps or initial caps. All other trademarks are property of their respective owners. The authors and publisher have taken due care in preparation of this book, but make no expressed or implied warranty of any kind and assume no responsibil- ity for errors or omissions. No liability is assumed for incidental or consequen- tial damages in connection with or arising out of the use of the information con- tained herein. This work is released under the Creative Commons Attribution-ShareAlike 2.5 license. For more details regarding your rights to use and redistribute this work, see http://creativecommons.org/licenses/by-sa/2.5/ Contents Preface ix About This Book xi Introduction 1 Bandwidth, throughput, latency, and speed.............................................................................. 2 Not enough to go around........................................................................................................
    [Show full text]
  • Handling Freebsd's Latest Firewall Semantics and Frameworks
    Handling FreeBSD's latest firewall semantics and frameworks by Adrian PENIS¸OARA˘ ∗ Abstract Despite having a powerful firewall service in its base system since early versions, known as the IPFW facility, FreeBSD has imported over time another popular packet filtering framework, the IPF system, and now has just imported the new kid on the packet filtering block, namely the open PF framework raised on the OpenBSD grounds. Having three packet filtering frameworks at your feet might sound delightful, but actually choosing one of them or making them cooperate might give you the shivers. Each framework has its strengths and weaknesses and often has it's own different idea on how to handle certain aspects. Note: an extended version of this article will appear on the conference's website. 1 Introduction 1.1 The players For quite some time the FreeBSD users have been stuck with the traditional IPFW fire- wall service which had its strengths and weaknesses. The last years though have brought the project two new packet filtering services: Darren Reed's IPFilter and OpenBSD's Packet Filter. The IPFW framework appeared in FreeBSD in the early 2.0 releases and has been extended and reworked over time. The dummynet(4) traffic shaping module has been introduced in FreeBSD 2.2.8 and statefull extensions have been committed around FreeBSD 4.0. In summer 2002 the IPFW engine has seen a major overhaul under the \ipfw2" codename. The IPFilter framework is the work of Darren Reed, a packet filtering service that was designed to be portable across several Unix distributions.
    [Show full text]
  • Automated Policy Enforcement in Software Defined Networking and Network Function Virtualization Environment
    Master of Science in Computer Engineering Master Degree Thesis Automated Policy Enforcement in Software Defined Networking and Network Function Virtualization Environment Supervisors prof. Riccardo Sisto prof. Fulvio Valenza dott. Daniele Bringhenti Candidate Antonio Amoroso Academic Year 2020-2021 This work is subject to the Creative Commons Licence Summary The increasing spreading of the amount of exchanging data and the dynamic de- ployment of applications and services lead to an evolution of the traditional network technology. One possible solution is based on virtualization, in particular, exploit- ing the Network Function Virtualization (NFV) parading. It is an architectural approach which aim is to decouple the network functions and the hardware ap- pliances, making possible the deployment of network service on general-purpose servers, achieving flexibility during the design of a particular service. A problem that arises is the service design that usually is performed manually, and this can lead to errors, especially if the service under analysis is related to security functions, such as firewalls. In order to avoid these errors, an automated approach should be used. In this context, it is possible to use a policy-based model that can be refined and translated. Because of this consideration, this thesis focussed on security inside NFV, in particular, analyzing packet filter behavior and it contributed to the translation from a medium language policy to a low-level configuration taking care of different firewall languages used in different scenarios. Moreover, it contributed tothede- velopment of VEREFOO (VErified REFinement and Optimized Orchestration), a framework that aims to provide a Security Automation approach as a solution to the problem highlighted before.
    [Show full text]
  • Download the Fourth Chapter
    4 Implementation At this point, you should have a clear operational policy that governs how your users may make use of network services. You should also have good network monitoring tools installed and collecting data, so you can tell at a glance pre- cisely how your network is actually being used. With these major components in place, you are now ready to make changes to the network configuration that bring actual utilisation in line with policy. The implementation phase of net- work building closes the feedback loop that allows policy to be consulted upon and revised, and network services to be implemented and changed, based on information provided by the monitoring systems. This chapter will show you the essential technical components that should be in place in virtually every network connected to the Internet. These techniques will allow you to limit, prioritise, and optimise the flow of information between the Internet and your users. While these technical constraints are necessary to maintain the health of the network, there is one management technique that is often overlooked, yet nearly always makes the greatest impact on network utilisation: communica- tion with your users. If your users don't understand that their actions directly impact the performance of the network, how can they be expected to know that the network is overutilised and not "just broken?" When users are frustrated with network performance, and met with indifference (or outright contempt) by network administrators, they tend to try to find ways around the rules in order to "get their work done." More often than not, these workarounds will consume even more bandwidth, causing problems for users and administrators alike.
    [Show full text]
  • IMUNES Manual
    IMUNES Manual 12 November, 2018 Contents 1 Changelog 4 2 Introduction 5 2.1 Document overview . 5 3 User Interface Layout 6 3.1 Toolbox . 6 3.2 Menubar . 8 3.2.1 File Menu . 8 3.2.2 Edit Menu . 9 3.2.3 Canvas Menu . 9 3.2.4 View Menu . 10 3.2.5 Tools Menu . 10 3.2.6 Topogen Menu . 11 3.2.7 Widgets Menu . 12 3.2.8 Events Menu . 12 3.2.9 Experiment Menu . 13 3.2.10 Help Menu . 13 4 Quick Intro 14 4.1 Simple Network Scenario . 14 4.1.1 Building a simple network . 14 4.1.2 Configuring a simple network . 16 4.1.3 Simulating a simple network . 23 4.2 Configuration files management . 26 4.2.1 Saving a virtual network configuration . 26 4.2.2 Opening a virtual network configuration . 27 5 Advanced Usage 28 5.1 Extended Network Scenario . 28 5.1.1 Canvas Management . 28 5.1.2 Attaching an external interface . 31 5.1.3 Attaching to a running experiment . 31 5.2 Additional Configuration . 32 5.2.1 Custom configuration . 32 5.2.2 Physical and logical interfaces . 33 5.3 Additional Tools . 35 1 Contents Contents 5.3.1 Splitting a link . 35 5.3.2 Generating a network topology . 35 5.3.3 IPv4 address pool . 41 5.3.4 IPv6 address pool . 43 5.3.5 Routing protocol defaults . 43 5.4 Customizing Look . 43 5.4.1 Annotations . 43 5.4.2 Canvas background image .
    [Show full text]
  • Freebsd Interception ( Transparent ) Proxy
    FreeBSD Kernel Compilation For Implementing Interception ( Transparent ) Proxy Prepared by ViSolve Squid Team May 21, 2009 FreeBSD Kernel Compilation For Implementing Interception Proxy Disclaimer : The information in this document is believed to be accurate in all respects to the best of ViSolve’s Knowledge at the time of publication and is subject to change without prior notice. ViSolve Inc., is not legally liable for any errors or opinions that appear in this document. Document Version : 1.0 | Created on : May 21, 200 9 FreeBSD Kernel Compilation For Implementing Interception Proxy Introduction | What is FreeBSD? | Why Interception (Transparent) Proxy? FreeBSD & Interception Proxy | Steps to recompile Kernel | Conclusion | About ViSolve Introduction This document describes about the basic compilation procedure of FreeBSD to implement Interception (Transparent) Proxy. This manual should not be treated as a tutorial but only as a reference to begin with. To configure squid as Transparent Proxy, please refer our technical white paper “ Implementing Transparent Caching Using Squid ”. What is FreeBSD? FreeBSD is a member of the Unix family of operating systems that is based on the Berkeley Software Distribution (BSD), which is completely free, and runs on a variety of different types of computers. It runs on processors such as the Pentium that are compatible with Intel's x86 architecture and also on AMD64, Power PC, ARM, IA-64, PC-98 and UltraSPARC processors. FreeBSD is developed as a complete operating system. The same source code revision tracing tree encompasses the kernel, device drivers and all of the userland utilities, such as the shell, whereas in Linux distributions, the kernel, userland utilities and applications are developed separately and packaged together in different ways by others.
    [Show full text]
  • Firewall Implementation at Janet-Connected Organisations
    Published on Jisc community (https://community.jisc.ac.uk) Home > Advisory services > Multi-site Connectivity Advisory Service > Technical guides > Firewall implementation at Janet- connected organisations Firewall implementation at Janet- connected organisations Firewall implementation at Janet-connected organisations Matthew Cook, Loughborough University Authors and Contributors This document was put together by Loughborough University to share knowledge, experience and current trends surrounding firewall implementation with the JANET community. This Technical Guide is complemented by the JANET Training programme which provides courses covering multiple facets of firewall implementation as part of their extensive portfolio. The primary author is Matthew Cook who has been a member of the Computing Services department at Loughborough University since 1999. He has an extensive knowledge of a wide range of operating systems and networking technologies and has spoken at many conferences on various security matters. These presentations, papers and lectures are available at: http://escarpment.net/ [1]. Other contributions and editing came from Gill Chester, Andrew Cormack and Katharine Iles of JANET. Readers are assumed to have a basic knowledge of networking concepts and preventive security awareness. A companion Security Matters [2] guide is available. References to particular products do not imply any recommendation. Scope and Audience The Internet is a double-edged sword: it is an excellent technology for communication and collaboration, but at the same time threats are created by this connectivity. Tools to protect against malicious and otherwise unwanted network traffic began to be developed very early in the history of the Internet. Firewalls to filter traffic are now a key part of any modern day network infrastructure and the concept has extended from a system administration term into everyday vocabulary.
    [Show full text]
  • How to Do NAT + DHCP + IPFW in Freebsd Firewalls Firewalls
    How to do NAT + DHCP + IPFW in FreeBSD Firewalls Firewalls > Firewall – Choke point between secured and unsecured network – Filter incoming and outgoing traffic that flows through your system > How can it be used to do – To protect your system from unwanted traffic coming in from the public Internet • Such as telnet, NetBIOS – To limit or disable access from hosts of the internal network to services of the public Internet • Such as MSN, ssh, ftp – To support NAT (Network Address Translation) 3 Firewall rules > Two ways to create firewall rulesets – Exclusive • Allow all traffic through except for the traffic matching the rulesets – Inclusive • Allow traffic matching the rulesets and blocks everything else • Safer than exclusive one > reduce the risk of allowing unwanted traffic to pass > Increase the risk to block yourself with wrong configuration 4 Firewall Software > FreeBSD – IPFILTER (known as IPF) – IPFIREWALL (known as IPFW) > Solaris – IPF > Linux – ipchains – iptables 5 IPFW on FreeBSD (1) > Enable ipfw in /etc/rc.conf # ipfw options firewall_enable=“YES” firewall_script=“/etc/firewall/rules” > Compile following options into kernel options IPFIREWALL options IPFIREWALL_VERBOSE options IPFIREWALL_DEFAULT_TO_ACCEPT > Rebuild the kernel 65534 deny log ip from any to any 65535 allow ip from any to any 6 IPFW on FreeBSD (2) > ipfw command – Add or delete firewall rule manually while it is running – The ipfw creates a counter for each rule that counts each packet that matches the rule – % ipfw list (list all rules in sequence) – % ipfw
    [Show full text]
  • How to Do NAT + DHCP + IPFW in Freebsd Firewalls Firewalls
    How to do NAT + DHCP + IPFW in FreeBSD Firewalls Firewalls > Firewall – Choke point between secured and unsecured network – Filter incoming and outgoing traffic that flows through your system > How can it be used to do – To protect your system from unwanted traffic coming in from the public Internet • Such as telnet, NetBIOS – To limit or disable access from hosts of the internal network to services of the public Internet • Such as MSN, ssh, ftp – To support NAT (Network Address Translation) 3 Firewall rules > Two ways to create firewall rulesets – Exclusive • Allow all traffic through except for the traffic matching the rulesets – Inclusive • Allow traffic matching the rulesets and blocks everything else • Safer than exclusive one > reduce the risk of allowing unwanted traffic to pass > Increase the risk to block yourself with wrong configuration 4 Firewall Software > FreeBSD – IPFILTER (known as IPF) – IPFIREWALL (known as IPFW) > Solaris – IPF > Linux – ipchains – iptables 5 IPFW on FreeBSD (1) > Enable ipfw in /etc/rc.conf # ipfw options firewall_enable=“YES” firewall_script=“/etc/firewall/rules” > Compile following options into kernel options IPFIREWALL options IPFIREWALL_VERBOSE options IPFIREWALL_DEFAULT_TO_ACCEPT > Rebuild the kernel 65534 deny log ip from any to any 65535 allow ip from any to any 6 IPFW on FreeBSD (2) > ipfw command – Add or delete firewall rule manually while it is running – The ipfw creates a counter for each rule that counts each packet that matches the rule – % ipfw list (list all rules in sequence) – % ipfw
    [Show full text]