Download Firewalls - Lab 8 - Internetwork Security | ECE 4883 and more Lab Reports Electrical and Electronics Engineering in PDF only on Docsity!
Group Number: _________
Member Names: ___________________ _______________________
ECE4883 Lab 8 Fall 2003
Firewalls
Version: March 1, 2004
Date Issued: March 2, 2004
Due Date: March 16, 2004
This lab is divided into two major portions. The first part explores the Linux firewall implementation in the form of the iptables program. In part two, you will configure a Cisco PIX 15E firewall for a particular network structure. Both portions of the lab are substantial and it will take a good amount of time to complete this lab. Therefore it is recommended that you start early.
Note: Both portions of the lab require you to reserve a slot to use the equipment. The signup sheets will be posted on the lab door. Since the two portions are separate from each other, you can do either part first.
Part 1 – Linux Firewalls
In this section of the lab you will explore the Linux firewall iptables. The initial sections give an overview of basic firewall concepts with exercises and examples. In the later sections, you will implement all the rules in the iptables.firewall file available from the Lab8 directory on the NAS server. The effects of these rules are to be examined.
Lab Setup
A couple of Firewall stations have been setup for you in the lab. The virtual machine network structure on these stations is shown below. Basically, the virtual machines have been setup with host only networking. So any traffic they send or receive goes through the Host machine, which also acts like the Firewall. This network structure mimics the network structures of the real world where a firewall sits between the inside and the outside networks. Since we are only trying to show you the capabilities of the ipchains program, only two machines are sufficient.
Figure 1-1. Network structure on the Firewall machines
System Setup
Protected: A normal Linux virtual machine with IP 192.168.0.10, netmask 255.255.255.0, and gateway 192.168.0.1. The gateway is a virtual interface on the host machine which acts like a router and firewall. This is the machine that is on the inside network and needs to be protected with the firewall.
Linux Firewall: RedHat 8.0 base system that is configured to act like a router and runs a firewall with ipchains. It forwards packets received on its two virtual interfaces (vmnet1 and vmnet2) to the intended destinations. You will make firewall rules on this machine to protect the inside network.
BlackHat: Same configuration as the Protected machine. IP address is 131.210.231.55 and gateway is 131.210.231.1, which is the virtual interface vmnet2 on the host machine. This is the machine where you will try to attack the protected machine from.
Note: All the root passwords for these machines have been set to “password”.
Setting up routing and iptables Some of the information given in this section will be only be clear and useful later on when you actually use iptables.
The executable binary for the iptables application is the /sbin/iptables file. So when execute iptables this is the file that is executed. RedHat also has an executable script in the /etc/init.d/iptables file so that it can start its default firewall at startup. An easy way to reset the firewall rules is to use this script as /etc/rc.d/init.d/iptables stop This flushes all the rules in memory and gives you a clean start.
- Stateful inspection - A newer method that doesn't examine the contents of each packet but instead compares certain key parts of the packet to a database of trusted information. Information traveling from inside the firewall to the outside is monitored for specific defining characteristics, then incoming information is compared to these characteristics. If the comparison yields a reasonable match, the information is allowed through. Otherwise it is discarded.
Exercise 1 No firewall functionality running
From the BlackHat machine, use nmap to scan the Linux Machine behind the firewall. You can use the graphical interface for nmap with these options:
SCAN -> SYN Stealth DISCOVER -> Don’t Ping OPTIONS -> Don’t resolve Fast Scan You can also use the command line with nmap –sS –P0 –n –F
Write down which ports are open:
1.2 - Firewall Configuration
Firewalls are customizable. This means that you can add or remove filters based on several conditions. Some of these are:
- IP addresses
- Domain names
- Protocols - ! IP (Internet Protocol) - the main delivery system for information over the Internet ! TCP (Transport Control Protocol) - used to break apart and rebuild information that travels over the Internet ! HTTP (Hyper Text Transfer Protocol) - used for Web pages ! FTP (File Transfer Protocol) - used to download and upload files ! UDP (User Datagram Protocol) - used for information that requires no response, such as streaming audio and video ! ICMP (Internet Control Message Protocol) - used by a router to exchange the information with other routers ! SMTP (Simple Mail Transport Protocol) - used to send text-based information (e-mail)
! SNMP (Simple Network Management Protocol) - used to collect system information from a remote computer ! Telnet - used to perform commands on a remote computer
- Ports
- Specific words and phrases - This can be anything. The firewall will sniff (search through) each packet of information for an exact match of the text listed in the filter. For example, you could instruct the firewall to block any packet with the word "X-rated" in it. The key here is that it has to be an exact match. The "X-rated" filter would not catch "X rated" (no hyphen). But you can include as many words, phrases and variations of them as you need.
A software firewall, such as ZoneAlarm, can be installed on the computer in your home that has an Internet connection. This computer is considered a gateway because it provides the only point of access between your home network and the Internet.
With a hardware firewall, the firewall unit itself is normally the gateway. A good example is the Linksys Cable/DSL router. It has a built-in Ethernet card and hub. Computers in your home network connect to the router, which in turn is connected to either a cable or DSL modem. You configure the router via a Web-based interface that you reach through the browser on your computer. You can then set any filters or additional information.
Hardware firewalls are incredibly secure and not very expensive. Home versions that include a router, firewall, and Ethernet hub for broadband connections can be found for well under $100.
1.3 - What It Protects You From:
There are many creative ways that unscrupulous people use to access or abuse unprotected computers. The level of security you establish will determine how many of these threats can be stopped by your firewall. The highest level of security would be to simply block everything. Obviously that defeats the purpose of having an Internet connection. But a common rule of thumb is to block everything, and then begin to select what types of traffic you will allow. You can also restrict traffic that travels through the firewall so that only certain types of information, such as e-mail, can get through. This is a good rule for businesses that have an experienced network administrator that understands what the needs are and knows exactly what traffic to allow through. For most of us, it is probably better to work with the defaults provided by the firewall developer unless there is a specific reason to change it.
One of the best things about a firewall from a security standpoint is that it stops anyone on the outside from logging onto a computer in your private network. While this is a big deal for businesses, most home networks will probably not be threatened in this manner. Still, putting a firewall in place provides some peace of mind.
1.4 – Demilitarized Zone:
DMZ stands for Demilitarized Zone. A DMZ is your frontline when protecting valuables from direct exposure to an untrusted environment. SI Security defines a DMZ as, "A network added between a protected network and an external network in order to provide an additional layer of security." A DMZ is sometimes called a "Perimeter network" or a "Three-homed perimeter network."
A DMZ is a step towards defense in depth because it adds an extra layer of security beyond that of a single perimeter. A DMZ separates an external network from directly referencing an internal network. It does this by isolating the machine that is being directly accessed from all other machines. Most of the
2.2 - Iptables modules:
The firewall code in the current Linux kernel ( http://www.netfilter.org/ ) is called iptables or
netfilter (while there is a technical distinction, they're equivalent names for this discussion). The
crucial feature of this firewall is its modular design. You have the ability to add new types of
tests to perform on a packet and actions to take on it. These tests and action modules can be
added to a running kernel.
3.1 - What’s going on in the kernel?
(taken from netfilter HOWTO by Rusty Russell)
The kernel starts with three lists of rules in the ‘filter’ table; these lists are called firewall chains or just chains. The three chains are called INPUT , OUTPUT and FORWARD.
The chains are arranged like so: (Note: this is a very different arrangement from the 2.0 and 2. kernels!)
Figure 1-2 – Routing chains
The three circles represent the three chains mentioned above. When a packet reaches a circle in the diagram, that chain is examined to decide the fate of the packet. If the chain says to DROP the packet, it is killed there, but if the chain says to ACCEPT the packet, it continues traversing the diagram.
A chain is a checklist of rules. Each rule says ‘if the packet header looks like this, then here’s what to do with the packet’. If the rule doesn’t match the packet, then the next rule in the chain is consulted. Finally, if there are no more rules to consult, then the kernel looks at the chain policy to decide what to do. In a security-conscious system, this policy usually tells the kernel to DROP the packet.
- When a packet comes in (say, through the Ethernet card) the kernel first looks at the destination of the packet: this is called ‘routing’.
- If it’s destined for this box, the packet passes downwards in the diagram, to the INPUT chain. If it passes this, any processes waiting for that packet will receive it.
- Otherwise, if the kernel does not have forwarding enabled, or it doesn’t know how to forward the packet, the packet is dropped. If forwarding is enabled, and the packet is destined for another network interface (if you have another one), then the packet goes rightwards on our diagram to the FORWARD chain. If it is ACCEPTed, it will be sent out.
- Finally, a program running on the box can send network packets. These packets pass through the OUTPUT chain immediately: if it says ACCEPT, then the packet continues out to whatever interface it is destined for.
3.2 - Creating your own rules
The iptables tool inserts and deletes rules form the kernel’s packet filtering table. Initially all chains are set to ACCEPT by default. A detailed description can be obtained from the man pages (man iptables).
Commands to change chains:
- create a new chain (-N) NOTE: use upper case letters
- delete an empty chain (-X)
- list the rules for a chain (-L)
- flush a chain (delete all rules in a chain) (-F)
Commands to add/delete rules:
- Append a new rules to a chain (-A)
- Delete a rule at some position in a chain, or the first that matches (-D)
The sections
Note: The examples in these sections only demonstrate particular rules. They may or may not work for the network setup for the lab.
4.0 - Iptables Parameters
Parameters specify the type of packet that you are looking to match with your rule.
4.1 - Specifying jump
If a packet matches one of your rules, you can tell the packet to jump to another chain with the ‘-j’ option
Example:
#jump all packets in INPUT chain to the drop CHAIN
iptables –A INPUT –j DROP
4.2 - Specifying protocol
The protocol can be specified with the ‘–p’ option. Protocols can either be the number in the IP header or ‘tcp’, ‘udp’, or ‘icmp’ (case insensitive).
Example:
#drop all icmp packets
A packet which could not be identified for some reason: this includes running out of memory and ICMP errors which don’t correspond to any known connection. Generally these packets should be dropped.
An example of this powerful extension would be:
iptables –A FORWARD –i eth0 –m state! –state NEW –j DROP
4.7 - Limit explanation
This module must be explicitly specified with -m limit' or--match limit'. It is used to restrict the rate of matches, such as for suppressing log messages. It will only match a given number of times per second (by default 3 matches per hour, with a burst of 5). It takes two optional arguments:
--limit
Followed by a number; specifies the maximum average number of matches to allow per second. The number can specify units explicitly, using /second',/minute', /hour' or/day', or parts of them (so 5/second' is the same as5/s').
--limit-burst
Followed by a number, indicating the maximum burst before the above limit kicks in.
This match can often be used with the LOG target to do rate-limited logging. To understand how it works, let's look at the following rule, which logs packets with the default limit parameters:
iptables -A FORWARD -m limit -j LOG
The first time this rule is reached, the packet will be logged; in fact, since the default burst is 5, the first five packets will be logged. After this, it will be twenty minutes before a packet will be logged from this rule, regardless of how many packets reach it (60 minutes / 3 packets per hour). This value of twenty minutes is because the default limit is 3/hour. Also, every twenty minutes which passes without matching a packet, one of the burst will be regained; if no packets hit the rule for 100 minutes, the burst will be fully recharged to 5 packets (100 minutes / 20mintes per packet); back where we started.
Note: you cannot currently create a rule with a recharge time greater than about 59 hours, so if you set an average rate of one per day, then your burst rate must be less than 3.
You can also use this module to avoid various denial-of-service attacks (DoS) with a faster rate to increase responsiveness.
Syn-flood protection:
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
Furtive port scanner:
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit -
-limit 1/s -j ACCEPT
Ping of death:
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit
1/s -j ACCEPT
5.0 - Network Address Translation (NAT)
There are two types of NAT, source NAT and destination NAT.
Source NAT is when you alter the source address of the first packet: i.e. you are changing where the connection is coming from. Source NAT is always done post-routing, just before the packet goes out onto the wire. Masquerading is a specialized form of SNAT. A router might do masquerading for packets going from one of its internal machines to an outside connection. In this case it will change the source address of the machine to its own address. The external machine will see the packets coming from the router.
Destination NAT is when you alter the destination address of the first packet: i.e. you are changing where the connection is going to. Destination NAT is always done before routing, when the packet first comes off the wire. Port forwarding, load sharing, and transparent proxying are all forms of DNAT. In the router example, the incoming packets intended for the internal machine are routed to it by changing the destination address to the internal address of the machine.
5.1 - NAT in the kernel
You need to create NAT rules which tell the kernel what connections to change, and how to change them. To do this, we use the very versatile iptables tool, and tell it to alter the NAT table by specifying the `-t nat' option.
The table of NAT rules contains three lists called `chains': each rule is examined in order until one matches. The two chains are called PREROUTING (for Destination NAT, as packets first come in), and POSTROUTING (for Source NAT, as packets leave). The third (OUTPUT) will be ignored here.
The following diagram illustrates this concept:
PREROUTING you can only select incoming interface, and at POSTROUTING you can only select outgoing interface. If you use the wrong one, iptables will give an error.
You want to do Source NAT; change the source address of connections to something different. This is done in the POSTROUTING chain, just before it is finally sent out; this is an important detail, since it means that anything else on the Linux box itself (routing, packet filtering) will see the packet unchanged. It also means that the `-o' (outgoing interface) option can be used.
DNAT is done in the PREROUTING chain, just as the packet comes in; this means that anything else on the Linux box itself (routing, packet filtering) will see the packet going to its real' destination. It also means that the-i' (incoming interface) option can be used.
5.3 - Port Forwarding
When running a web server behind your firewall, you want to forward packets destined for that server through the firewall to that box.
Example:
Linux 2.
Append a rule before routing (-A PREROUTING) to the NAT table (-t nat) that
TCP packets (-p tcp) going to 1.2.3.4 (-d 1.2.3.4) port 80 (--dport 80)
have their destination mapped (-j DNAT) to 192.168.1.1, port 80
(--to 192.168.1.1:80).
iptables -A PREROUTING -t nat -p tcp -d 1.2.3.4 --dport 80 -j DNAT --to 192.168.1.1:
NOTE: This only changes the destination of the packet, it does not automatically accept it in the forwarding chain. A rule must be made in the forwarding chain also.
5.4 - Masquerading
There is a specialized case of Source NAT called masquerading: it should only be used for dynamically- assigned IP addresses, such as standard dialups.
You don't need to put in the source address explicitly with masquerading: it will use the source address of the interface the packet is going out from. But more importantly, if the link goes down, the connections (which are now lost anyway) are forgotten, meaning fewer glitches when connection comes back up with a new IP address.
Masquerade everything out ppp0.
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
6.0 – iptables.firewall Script Explanation (See Appendix 1-A)
These rules are already contained in our file iptables.firewall. We do not cover the rules in exactly the same order as they appear in your file. Go through these rules and understand what exactly is being done.
6.1 - Load the iptables modules and connection tracking for ftp and nat:
modprobe ip_tables modprobe iptable_nat modprobe ip_conntrack_ftp modprobe ip_nat_ftp
Configure default policies (-P), meaning default rule to apply if no more specific rule below is applicable. These rules apply if a more specific rule below is not applicable. Defaults are to DROP anything sent to firewall or internal network, permit anything going out.
iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT
6.2 - Flush (-F) all specific rules:
iptables -F INPUT iptables -F FORWARD iptables -F OUTPUT iptables -F -t nat
The rest of this file contains specific rules that are applied in the order listed. If none applies, then the above policy rules are used.
Forward all packets from vmnet1 (internal network) to vmnet2 (the internet).
iptables -A FORWARD -i vmnet1 -o vmnet2 -j ACCEPT
Forward all packets that are part of existing and related connections from vmnet2 to vmnet1.
iptables -A FORWARD -i vmnet2 -o vmnet1 -m state --state ESTABLISHED,RELATED -j ACCEPT
Permit packets in to firewall itself that are part of existing and related connections.
iptables -A INPUT -i vmnet2 -m state --state ESTABLISHED,RELATED -j ACCEPT
Note, in the above two rules, a connection becomes ESTABLISHED in the iptables PREROUTING chain upon receipt of a SYNACK packet that is a response to a previously sent SYN packet. The SYNACK
6.5 – Defending against ICMP Ping Floods
ICMP ping floods are commonly used attacks, especially by “script kiddies.” The attack is really simple, the attacker ping floods you and if he has more upstream than your downstream, you won’t be able to access anything. Iptables allows you to specify how many ICMP “echo” packets you want to reply to. This can be done by adding the following:
iptables -A INPUT –p icmp –-icmp-type echo-request –m limit / -–limit 30/minute –-limit-burst 1 –j ACCEPT
“30/minute’ means accept every other packet. An attacker may still ping flood you, but you
won’t reply to it anyways, and he will give up soon. However, this also allows other people to ping
you, just to test the network connection. The burst is set to 1 packet, so this limit will immediately take effect.
Our Linux based firewall is already completely setup since the iptables.firewall file is provided for us, and all of the machines behind the firewall are protected from harmful traffic. We will now run some tests to show the results of the firewall installation.
Exercise 3
Turn on the firewall rules by typing ./iptables.firewall (in the directory where your iptables.firewall is placed)
If you have enabled the firewall before, you will need to flush the rules before executing the above command.
Now rerun nmap from outside the firewall (BlackHat) on the Linux machine behind the firewall (Protected).
Run nmap with these options:
SCAN -> SYN Stealth DISCOVER -> Don’t Ping OPTIONS -> Don’t resolve Fast Scan TIMING -> Max RTT 40ms
The command is nmap –sS –P0 –n –F –max_rtt_timeout 40
We must add this additional timing option because the firewall does not send a reset packet when nmap scans a closed port, it simply drops it. The RTT value specifies that nmap will not wait longer than 40ms for a response on a port.
Write down which ports are open after the firewalls installation:
Exercise 4
What happened differently in the results from exercise three as opposed to exercise one? Can you speculate what firewall rules caused this?
Exercise 5
From BlackHat, we are going to ping the firewall to observe the rule which defends against icmp ping floods. The rule specified in this lab has the limit as 30/minute and a burst of 1. This means that every other packet will be denied and this rule will be enabled with the first packet.
From your BlackHat, ping the firewall with these options:
ping 131.210.231.1 –n 20 –w 4
Record this output in one window.
Now change the rule in the iptables.firewall file to 10/minute and a burst of 5. Restart the firewall with the command
/etc/rc.d/init.d/iptables stop ./iptables.firewall
In another window from BlackHat ping the firewall with these options:
ping 131.210.231.1 –n 20 –w 4
Comment on the differences between the first rule:
Exercise 7
Restart ethereal on the firewall machine. Run with the options capture packets on ‘any’ interface, update packets in real time, and automatic scrolling.
From BlackHat, ssh to 131.210.231.
Record these output in ethereal and comment on what you saw happen:
Exercise 8
Now we are going to log any packets attempting to telnet to the firewall using the LOG chain.
iptables –A INPUT –d 131.210.231.1 –p tcp --dport 23 –j LOG --log-prefix ‘TELNET ATTEMPT: ‘
Attempt to telnet from your machine to the firewall. Check /var/log/messages for these telnet attemps and record the output from the messages file. type tail /var/log/messages to see the end of the /var/log/messages file.
What did you see:
Exercise 9
Write down three rules that you think might be useful and explain what they do.
7.0 – Zone Alarm
7.1 Using Zone Alarm
Zone alarm is a firewall for the windows operating system. It is available for all versions of Microsoft Windows including Windows CE. You can read more about it at
www.zonelabs.com
It might be a very useful for protecting your home computer if you use Windows.
Acknowledgement: This lab was originally written by Terri Calderone, Varun Kanotra, Ed Paradise, and Edward Rowe Spring 2003.
How long did it take you to complete this lab? Was it an appropriate length lab?
What corrections and or improvements do you suggest for this lab? Please be very specific and if
you add new material give the exact wording and instructions you would give to future students
in the new lab handout. You may cross out and edit the text of the lab on previous pages to make
corrections/suggestions. Note that part of your lab grade is what improvements you make to this
lab.
