This talk is somewhat generic with the implementation done on Linux with iptables. I am not an iptables expert. Instead I use an OSS GUI to generate the rules/script, hence this talk should be accessible to non-iptables experts.
The talk will cover: NAT'ing, routing, firewall design, host/protocol rules, deployment, DMZs, cost and resource practicalities, deployment, application level filtering/inspection and a brief comparison with a commercial firewall.
This and more definitions are available from the Firewall entry on wikipedia.
Which is more important, complete security or a functional network?
If the firewall rules "go wrong" I prefer a functional network for an academic environment.
There's no particularly reason for the above choices except that I tend to use Debian on servers and openSuSe for laptops.
ping 131.111.12.20 traceroute 131.111.12.20
host www.cam.ac.uk host 131.111.8.46
# from the laptop (inside FW) ping 131.111.112.62 # ping the gateway host www.cam.ac.uk # DNS lookup traceroute www.cam.ac.uk wget www.cam.ac.uk smbclient -L www.cam.ac.uk nmap 131.111.12.20 ssh 131.111.12.20 # then we can do the tests below # from web/DNS (outside FW) ping 131.111.112.51 # should work host 131.111.112.51 # should work as I am a DNS server smbclient -L kaos.ch.cam.ac.uk # should be blocked nmap kaos.ch.cam.ac.uk # will take a while and only show a few services ssh kaos.ch.cam.ac.uk # allowed wget kaos.ch.cam.ac.uk # allowed # turn off the firewall rules ssh root@131.111.112.62 /etc/init.d/firewall-FW stop # run a test from above that was previously blocked ssh root@131.111.12.20 smbclient -L kaos.ch.cam.ac.uk # allowed nmap kaos.ch.cam.ac.uk # quick and will show all services # turn the firewall rules back on ssh root@131.111.112.62 /etc/init.d/firewall-FW start # generally a good idea to test a FW with some data transfer # from the web/DNS server (outside the firewall # a 10MB data transfer dd if=/dev/zero bs=1024k count=10 | ssh root@131.111.112.51 dd of=/dev/null
# from laptop ping 192.168.1.62 ping 131.111.12.20
# from the laptop (192.168.1.1) ssh root@131.111.12.20 # DNS/web server outside the firewall less /var/log/auth.log # and you should see the IP address you connected from ping 192.168.1.1
# from 192.168.1.1 (laptop) ssh root@131.111.12.20 smbclient -L 131.111.12.1 wget 131.111.12.1 ssh mr@131.111.12.1 hostname # and you should have found yourself back on the laptop
# to get a public IP, behind the firewall, to forward through the firewall:
# on the firewall:
IP=131.111.11X.XXX # IP of firewall
HOST_IP=131.111.11X.XXX # IP of computer behind firewall for proxy_arp
# NOTE: both firewall and public IP computer behind the firewall need IPs in the same
# network
# eth0 = external interface
route add -host ${HOST_IP} eth0
# enable proxyarp on both interfaces of the firewall:
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp
# NOTE: $IP needs to be in the same network as the firewall IP
# AND
# The Proxy ARP is actually only used to get packets from external to internal network.
# To get packets back the other way, the normal IP routing functionality is employed.
# Therefore the firewall would need an IP address in each network to route packets
# back to hosts...
An application layer firewall may inspect traffic at the application layer and, for example,
block viruses, certain websites and attempts to exploit known logical flaws in client software.
I believe this is typically done by matching patterns of undesirable traffic to network traffic.
Therefore the effectiveness and accurray will be dependent upon how good the patterns are.
My experience with the application layer filtering (Smart Defense) in Checkpoint firewall (R60) is this:
| Category | Checkpoint | Linux iptables and fwbulder |
|---|---|---|
| Software Licence Cost | Lots. E.g. 18K for initial licence | 0. free software |
| Software Maintenance Cost | Lots. E.g. 1.5K per annum for maintenance | 0. free software |
| Software Support Cost | Lots. E.g. 1.2K per annum for support from a 3rd party | 0. free software |
| Staff time on software issues | Lots. Submit a suport request to your support provider. If the support provider can answer then it is quick. If the support request has to go to Checkpoint the wait is long then you might need to run extensive debugging and send them fairly large files | Some. There is a huge amount of information out there on the www and in books. Colleagues can also be very helpful. |
| Training Costs | Lots. E.g. 2K per person for the 5 days of training you really do need | Medium. Staff time spent using and learning iptables, fwbuilder and Linux. A test setup is a good idea |
| Hardware Costs | More. Windows computer to run the GUI. Smart centre on a computer. Firewall on another computer | Less. A computer to run the firewall |
| Site to site VPN | does this well | I do not know and have not investigated |
| VPN for client computers | Lots of licence costs and no support for Linux. | Allow access to your VPN server. Use openVPN, Windows VPN, etc. |
| Automatic fail-over | Impressive. You need more licences. Cluster 2 firewall computers together and you get very good failover. You can also have both FWs active (in the cluster). On the training course we saw no traffic loss when disconnecting one of the clustered FW computers. | The heartbeat application could be used, although it will not synchronise the state tables between two firewalls. pf on openBSD will, I am told, do the full monty with state table synchronisation between clustered servers as one firewall. For a GUI and many other feature there is pfsense on freeBSD which has been ported to openBSD |
aptitude install iproute
Useful iptables commands
# list the rules:
iptables -L
# no DNS lookups (numeric output)
iptables -nvL
# to also see the NAT rules with no DNS lookups (numeric output)
iptables -nvL -t nat
# to see NAT stuff with DNS lookups
iptables -t nat L
# to clear the iptables settings
i${IPTABLES} -P INPUT ACCEPT
${IPTABLES} -P OUTPUT ACCEPT
${IPTABLES} -P FORWARD ACCEPT
${IPTABLES} -F
${IPTABLES} -X
${IPTABLES} -Z
# To stop log messages going to the console:
# /proc/sys/net/ipv4/ip_forward
cat >>/etc/sysctl.conf <<EOF
kernel.printk = 3 4 1 7
EOF
sysctl -p
# Memory usage and state tables
http://www.wallfire.org/misc/netfilter_conntrack_perf.txt
# the hashsize (number of buckets) is set with:
/proc/sys/net/ipv4/netfilter/ip_conntrack_buckets
# interesting stuff for connection tracking in:
/proc/sys/net/ipv4/netfilter
# to set the hashsize dynamically, depending upon kernel version:
# Between 2.6.14 and 2.6.19 (included), use:
echo $HASHSIZE > /sys/module/ip_conntrack/parameters/hashsize
# Since 2.6.20, use:
echo $HASHSIZE > /sys/module/nf_conntrack/parameters/hashsize
# to set CONNTRACK_MAX:
# Since Linux kernel version 2.4.23 (thus Linux 2.6 as well), use:
echo $CONNTRACK_MAX > /proc/sys/net/ipv4/netfilter/ip_conntrack_max
# How large do these values need to be?
The size of kernel memory used by netfilter connection tracking is:
size_of_mem_used_by_conntrack (in bytes) =
CONNTRACK_MAX * sizeof(struct ip_conntrack) +
HASHSIZE * sizeof(struct list_head)
on i386, kernel 2.6.5, size_of_mem_used_by_conntrack is around
CONNTRACK_MAX * 300 + HASHSIZE * 8 (bytes).
(pointer size is 4 bytes, therefore 2 * 4 = 8 )
By default, CONNTRACK_MAX = HASHSIZE * 8. This means that there is an average
of 8 conntrack entries per linked list (in the optimal case, and when
CONNTRACK_MAX is reached), each linked list being a hash table entry
(a bucket).
On systems with enough memory and where performance really matters, you can
consider trying to get an average of one conntrack entry per hash bucket,
which means HASHSIZE = CONNTRACK_MAX.
# Debian etch v4.0 on 64-bit Intel
sizeof(struct ip_conntrack) = 304 bytes
sizeof(struct list_head) = 2 * size of pointer = 2 * 8 = 16 bytes
65536 * 304 + 65536 * 8 = 20447232
20447232 / 1024^2 = 19.5MB
304x + 8x = memory(MB).1024^2
x = memory.1024^2 / 312
# we want approximately 1GB for connections:
x = 1024.124^2 / 312 = 3441480.20512820512820512820
# we want a power of 2 number
2^21 = 2097152
2^22 = 4194304 # chosen as this is for the Department perimeter FW
echo 4194304 > /proc/sys/net/ipv4/netfilter/ip_conntrack_max
echo 4194304 > /sys/module/ip_conntrack/parameters/hashsize
# for an internal NATing firewall we want to use 512MB of memory:
1048576
# in /etc/init.d/firewall-chfwnmr
# set hashsize for performance
echo 1048576 > /sys/module/ip_conntrack/parameters/hashsize
# set connection table size
echo 1048576> /proc/sys/net/ipv4/netfilter/ip_conntrack_max
# set arp cache timeout to 3 minutes
echo 180 > /proc/sys/net/ipv4/route/gc_timeout
# "Neighbour table overflow" - arp tables filling up
First of all: this has nothing to do with netfilter, just with
the routing and cacheing of the routes.
" Although I am familiar with iptables, our Technicians are not, this software allows a graphical representation of what is happening, and a way to edit themselves. Which from an 'all can fix/ understand' point of view is excellent. "
" I cannot see why anyone would want a commercial firewall. "
"
pfSense is on freeBSD and its home page is here http://www.pfsense.com/
pf is the openBSD firewall like netfilters for linux.
pfSync is the tool that copies firewall states between pf firewalls
CARP is the openBSD implementation of something like cisco's VRRP allowing 2
(or more) machines to share a floating IP with one as master and one as
backup.
All this has been ported to freeBSD
pfSense is a build of freeBSD with the pf firewall, pfsync, CARP and php
based configuration (even init scripts) and webGUI with all the bits you need
to have a decent firewall (DHCP, DNS etc).
I have been running a test setup of 2 pfSense firewalls in a CARP cluster for
a while now. The failover is amazing you can yank the power lead out of the
master whilst streaming video and it will failover with only a tiny loss of
packets. Usually the loss is so small the buffering in the video copes with
the loss and you won't even notice.
"
"7 months after replacing a Checkpoint firewall with Linux and iptables there have been zero security incidents. This is on a network with some 2000 devices and a varied selection of hardware and operating systems." - Mike Rose.