firewall
A system
designed to prevent unauthorized access to or from a
private network.
Firewalls can be implemented in both hardware and software, or a
combination of both. Firewalls are frequently used to prevent unauthorized Internet users from
accessing private networks connected to the Internet, especially intranets. All
messages entering or leaving the intranet pass through the firewall, which
examines each message and blocks those that do not meet the specified security criteria.
There are several types of
firewall techniques:
· Packet
filter: Looks at each packet entering or
leaving the network and accepts or rejects it based on user-defined rules.
Packet filtering is fairly effective and transparent to users, but it is
difficult to configure. In addition, it is susceptible to IP spoofing.
· Application
gateway: Applies security mechanisms to specific
applications, such as FTP
and Telnet servers.
This is very effective, but can impose a performance degradation.
· Circuit-level
gateway: Applies security mechanisms when a TCP or UDP connection is
established. Once the connection has been made, packets can flow between the
hosts without further checking.
· Proxy
server: Intercepts all messages entering and
leaving the network. The proxy server
effectively hides the true network addresses.
History
Firewall
technology emerged in the late 1980s when the Internet was a fairly new
technology in terms of its global use and connectivity. The original idea was
formed in response to a number of major internet security breaches, which
occurred in the late 1980s. In 1988 an employee at the NASA Ames
Research Center in California
|
“
|
We are
currently under attack from an Internet
VIRUS! It has hit Berkeley, UC San Diego, Lawrence
Livermore, Stanford, and NASA Ames.
|
”
|
This virus
known as Morris Worm was carried by e-mail. The Morris Worm was the
first large scale attack on Internet security; the online community was neither
expecting an attack nor prepared to deal with one.
Background and
Firewall Basics
Before being able to understand
a complete discussion of firewalls, it's important to understand the basic
principles that make firewalls work.
What is a network firewall?
A firewall is a system or group
of systems that enforces an access control policy between two or more networks.
The actual means by which this is accomplished varies widely, but in principle,
the firewall can be thought of as a pair of mechanisms: one which exists to
block traffic, and the other which exists to permit traffic. Some firewalls
place a greater emphasis on blocking traffic, while others emphasize permitting
traffic. Probably the most important thing to recognize about a firewall is
that it implements an access control policy. If you don't have a good idea of
what kind of access you want to allow or to deny, a firewall really won't help
you. It's also important to recognize that the firewall's configuration,
because it is a mechanism for enforcing policy, imposes its policy on
everything behind it. Administrators for firewalls managing the connectivity
for a large number of hosts therefore have a heavy responsibility.
Why would I want a
firewall?
The Internet, like any other
society, is plagued with the kind of jerks who enjoy the electronic equivalent
of writing on other people's walls with spray-paint, tearing their mailboxes
off, or just sitting in the street blowing their car horns. Some people try to
get real work done over the Internet, and others have sensitive or proprietary
data they must protect. Usually, a firewall's purpose is to keep the jerks out
of your network while still letting you get your job done.
In a case where a company's
policies dictate how data must be protected, a firewall is very important,
since it is the embodiment of the corporate policy. Frequently, the hardest
part of hooking to the Internet, if you're a large company, is not justifying
the expense or effort, but convincing management that it's safe to do so. A
firewall provides not only real security--it often plays an important role as a
security blanket for management.
What can a firewall protect against?
Some firewalls permit only email
traffic through them, thereby protecting the network against any attacks other
than attacks against the email service. Other firewalls provide less strict
protections, and block services that are known to be problems.
Generally, firewalls are
configured to protect against unauthenticated interactive logins from the
``outside'' world. This, more than anything, helps prevent vandals from logging
into machines on your network. More elaborate firewalls block traffic from the
outside to the inside, but permit users on the inside to communicate freely
with the outside. The firewall can protect you against any type of
network-borne attack if you unplug it.
Design and Implementation Issues
What are some of the basic design decisions
in a firewall?
There are a number of basic
design issues that should be addressed by the lucky person who has been tasked
with the responsibility of designing, specifying, and implementing or
overseeing the installation of a firewall.
The first and most important
decision reflects the policy of how your company or organization wants to
operate the system: is the firewall in place explicitly to deny all services
except those critical to the mission of connecting to the Net, or is the firewall
in place to provide a metered and audited method of ``queuing'' access in a
non-threatening manner? There are degrees of paranoia between these positions;
the final stance of your firewall might be more the result of a political than
an engineering decision.
The second is: what level of
monitoring, redundancy, and control do you want? Having established the
acceptable risk level (i.e., how paranoid you are) by resolving the first
issue, you can form a checklist of what should be monitored, permitted, and
denied. In other words, you start by figuring out your overall objectives, and
then combine a needs analysis with a risk assessment, and sort the almost
always conflicting requirements out into a laundry list that specifies what you
plan to implement.
The third issue is financial. We
can't address this one here in anything but vague terms, but it's important to
try to quantify any proposed solutions in terms of how much it will cost either
to buy or to implement. For example, a complete firewall product may cost
between $100,000 at the high end, and free at the low end. The free option, of
doing some fancy configuring on a Cisco or similar router will cost nothing but
staff time and a few cups of coffee. Implementing a high end firewall from
scratch might cost several man-months, which may equate to $30,000 worth of
staff salary and benefits. The systems management overhead is also a
consideration. Building a home-brew is fine, but it's important to build it so
that it doesn't require constant (and expensive) attention. It's important, in
other words, to evaluate firewalls not only in terms of what they cost now, but
continuing costs such as support.
On the technical side, there are
a couple of decisions to make, based on the fact that for all practical
purposes what we are talking about is a static traffic routing service placed
between the network service provider's router and your internal network. The
traffic routing service may be implemented at an IP level via something like
screening rules in a router, or at an application level via proxy gateways and
services.
The decision to make is whether
to place an exposed stripped-down machine on the outside network to run proxy
services for telnet, FTP, news, etc., or whether to set up a screening router
as a filter, permitting communication with one or more internal machines. There
are benefits and drawbacks to both approaches, with the proxy machine providing
a greater level of audit and, potentially, security in return for increased
cost in configuration and a decrease in the level of service that may be
provided (since a proxy needs to be developed for each desired service). The
old trade-off between ease-of-use and security comes back to haunt us with a
vengeance.
What are the basic types of firewalls?
Conceptually, there are three
types of firewalls:
- Network layer
- Application layer
- Hybrids
Network layer firewalls
These generally make their
decisions based on the source, destination addresses and ports (see
Appendix 6
for a more detailed discussion of ports) in individual IP packets. A simple
router is the ``traditional'' network layer firewall, since it is not able to
make particularly sophisticated decisions about what a packet is actually
talking to or where it actually came from. Modern network layer firewalls have
become increasingly sophisticated, and now maintain internal information about
the state of connections passing through them, the contents of some of the data
streams, and so on. One thing that's an important distinction about many
network layer firewalls is that they route traffic directly though them, so to
use one you either need to have a validly assigned IP address block or to use a
``private internet'' address block [5].
Network layer firewalls tend to be very fast and tend to be very transparent to
users.
In Figure 1,
a network layer firewall called a ``screened host firewall'' is represented. In
a screened host firewall, access to and from a single host is controlled by
means of a router operating at a network layer. The single host is a bastion
host; a highly-defended and secured strong-point that (hopefully) can resist
attack.
Example Network layer
firewall: In Figure 2,
a network layer firewall called a ``screened subnet firewall'' is represented.
In a screened subnet firewall, access to and from a whole network is controlled
by means of a router operating at a network layer. It is similar to a screened
host, except that it is, effectively, a network of screened hosts.
Application layer
firewalls
These generally are hosts
running proxy servers, which permit no traffic directly between networks, and
which perform elaborate logging and auditing of traffic passing through them.
Since the proxy applications are software components running on the firewall,
it is a good place to do lots of logging and access control. Application layer
firewalls can be used as network address translators, since traffic goes in one
``side'' and out the other, after having passed through an application that
effectively masks the origin of the initiating connection. Having an
application in the way in some cases may impact performance and may make the
firewall less transparent. Early application layer firewalls such as those
built using the TIS firewall toolkit, are not particularly transparent to end
users and may require some training. Modern application layer firewalls are
often fully transparent. Application layer firewalls tend to provide more
detailed audit reports and tend to enforce more conservative security models
than network layer firewalls.
Example Application layer
firewall: In Figure 3,
an application layer firewall called a ``dual homed gateway'' is represented. A
dual homed gateway is a highly secured host that runs proxy software. It has
two network interfaces, one on each network, and blocks all traffic passing
through it.
Most firewalls now lie someplace
between network layer firewalls and application layer firewalls. As expected,
network layer firewalls have become increasingly ``aware'' of the information
going through them, and application layer firewalls have become increasingly
``low level'' and transparent. The end result is that now there are fast
packet-screening systems that log and audit data as they pass through the
system. Increasingly, firewalls (network and application layer) incorporate
encryption so that they may protect traffic passing between them over the
Internet. Firewalls with end-to-end encryption can be used by organizations with
multiple points of Internet connectivity to use the Internet as a ``private
backbone'' without worrying about their data or passwords being sniffed.
What are proxy servers and how do they
work?
A proxy server (sometimes
referred to as an application gateway or forwarder) is an application that
mediates traffic between a protected network and the Internet. Proxies are
often used instead of router-based traffic controls, to prevent traffic from
passing directly between networks. Many proxies contain extra logging or
support for user authentication. Since proxies must ``understand'' the
application protocol being used, they can also implement protocol specific
security (e.g., an FTP proxy might be configurable to permit incoming FTP and
block outgoing FTP).
Proxy servers are application
specific. In order to support a new protocol via a proxy, a proxy must be
developed for it. One popular set of proxy servers is the TIS Internet Firewall
Toolkit (``FWTK'') which includes proxies for Telnet, rlogin, FTP, the X Window
System, HTTP/Web, and NNTP/Usenet news. SOCKS is a generic proxy system that
can be compiled into a client-side application to make it work through a
firewall. Its advantage is that it's easy to use, but it doesn't support the
addition of authentication hooks or protocol specific logging.
What are some reasonable filtering rules
for a Cisco?
The example in Figure 4
shows one possible configuration for using the Cisco as filtering router. It is
a sample that shows the implementation of as specific policy. Your policy will
undoubtedly vary.
In this example, a company has
Class C network address 195.55.55.0. Company network is connected to Internet
via IP Service Provider. Company policy is to allow everybody access to
Internet services, so all outgoing connections are accepted. All incoming
connections go through ``mail host''. Mail and DNS are only incoming services.
