Firewalls

Ethical Hacking.
Firewall.
Case Study by: Sonali. Parab.

Ethical Hacking: Firewall.
1
Firewall
Objective
A firewall is a system designed to prevent unauthorized access to or from a private network.
Firewalls are frequently used to prevent unauthorized Internet users from accessing private
networks connected to the Internet, especially intranets. All messages entering or leaving the
intranet pass through the firewall, which examines each message and blocks those that do not
meet the specified security criteria.
Abstract
In computing, a firewall is a software or hardware-based network security system that
controls the incoming and outgoing network traffic based on applied rule set. A firewall
establishes a barrier between a trusted, secure internal network and another network (e.g., the
Internet) that is not assumed to be secure and trusted.
Many personal computer operating systems include software-based firewalls to protect
against threats from the public Internet. Many routers that pass data between networks
contain firewall components and, conversely, many firewalls can perform basic routing
functions.
Figure 1: Illustration of Firewall.

2
Introduction
What is a Firewall?
A firewall is a secure Internet gateway that is used to interconnect a private network to the
Internet (see Figure 1). There are a number of components that make up a firewall:
i) The Internet access security policy of the organisation. This states, at a high level, what
degree of security the organisation expects when connecting to the Internet. The
security policy is independent of technology and techniques, and should have a lifetime
independent of the equipment used. An example of statements from such a security
policy might be: external users will not be allowed to access the corporate network
without a strong level of authentication; any corporate information not in the public
domain must be transferred across the Internet in a confidential manner, and
corporate users will only be allowed to send electronic mail to the Internet - all other
services will be banned.
ii) The mapping of the security policy onto technical designs and procedures that are
to be followed when connecting to the Internet. This information will be updated as
new technology is announced, and as system configurations change etc. For
example, regarding authentication, the technical design might specify the use of one-time
passwords. Technical designs are usually based on one of two security policies,
permit any service unless it is expressly denied, or deny any service unless it is expressly
permitted. The latter is clearly the more secure of the two.
iii) The firewall system, which is the hardware and software which implements the
firewall. Typical firewall systems comprise a IP packet filtering router, and a host
computer (sometimes called a bastion host or application gateway) running application
filtering and authentication software.
Why Firewalls?
 Prevent denial of service attacks: SYN flooding: attacker establishes many bogus TCP
connections, no resources left for “real” connections.
 Prevent illegal modification/access of internal data. e.g., attacker replaces CIA’s
homepage with something else.
 Allow only authorized access to inside network (set of authenticated users/hosts).
There are three types of fire walls.
Packet Filter: IP Packet Filter Firewall is a firewall deciding to forward or to drop a certain
packet according to the information of the packet’s head. Packet filters act by inspecting the
"packets" which transfer between computers on the Internet. If a packet matches the packet
filter's set of rules, the packet filter will drop (silently discard) the packet, or reject it (discard
it, and send "error responses" to the source).
This type of packet filtering pays no attention to whether a packet is part of an existing
stream of traffic (i.e. it stores no information on connection "state"). Instead, it filters each
packet based only on information contained in the packet itself.

Packet filtering firewalls work mainly on the first three layers of the OSI reference model,
which means most of the work is done between the network and physical layers, with a little
bit of peeking into the transport layer to figure out source and destination port numbers.
3
Figure 2: Packet Filtering Firewall.
Stateful Filters
Stateful filters introduce a technology of stateful inspection packet filtering. These firewalls
perform the work of their first-generation predecessors but operate up to layer 4 (transport
layer) of the OSI model. This is achieved by retaining packets until enough are available to
make a judgment about its state. Known as stateful packet inspection, it records all
connections passing through it and determines whether a packet is the start of a new
connection, a part of an existing connection, or not part of any connection. Though static
rules are still used, these rules can now contain connection state as one of their test criteria.
Certain DoS attacks bombard the firewall with thousands of fake connection packets to
overwhelm it by filling its connection state memory.
Figure 3: Stateful Inspection Firewall.

Application Layer
Application layer filtering can "understand" certain applications and protocols (such as File
Transfer Protocol (FTP), Domain Name System (DNS), or Hypertext Transfer Protocol
(HTTP)). This is useful as it is able to detect if an unwanted protocol is attempting to bypass
the firewall on an allowed port, or detect if a protocol is being abused in any harmful way.
The existing deep packet inspection functionality of modern firewalls can be shared by
Intrusion prevention systems (IPS).
4
Figure 4: Application level gateway Firewall.
Bastion Host Firewall:
A Bastion host is a special purpose computer on a network specifically designed and
configured to withstand attacks. A firewall at layer 5 Internet (7 ISO) is sometimes called a
bastion host, application gateway, proxy server or guardian system. Its purpose is to filter
the service provided by the application. The computer generally hosts a single application,
for example a proxy server, and all other services are removed or limited to reduce the threat
to the computer. It is hardened in this manner primarily due to its location and purpose,
which is either on the outside of the firewall or in the DMZ and usually involves access from
untrusted networks or computers.
Figure 5: Bastion Host Firewall.

5
Literature Review
The term firewall originally referred to a wall intended to confine a fire or potential fire
within a building. Later uses refer to similar structures, such as the metal sheet separating the
engine compartment of a vehicle or aircraft from the passenger compartment.
Firewall technology emerged in the late 1980s when the Internet was a fairly new technology
in terms of its global use and connectivity. The predecessors to firewalls for network security
were the routers used in the late 1980s
 Clifford Stoll's discovery of German spies tampering with his system
 Bill Cheswick's "Evening with Berferd" 1992 in which he set up a simple electronic "jail"
to observe an attacker
 In 1988, an employee at the NASA Ames Research Center in California sent a memo
by email to his colleagues that read, "We are currently under attack from an Internet
VIRUS! It has hit Berkeley, UC San Diego, Lawrence Livermore, Stanford, and NASA
Ames."
 The Morris Worm spread itself through multiple vulnerabilities in the machines of the
time. Although it was not malicious in intent, the Morris Worm was the first large scale
attack on Internet security; the online community was neither expecting an attack nor
prepared to deal with one.
First generation: Packet filters
The first paper published on firewall technology was in 1988, when engineers from Digital
Equipment Corporation (DEC) developed filter systems known as packet filter firewalls. This
fairly basic system was the first generation of what is now a highly involved and technical
internet security feature. At AT&T Bell Labs, Bill Cheswick and Steve Bellovin were
continuing their research in packet filtering and developed a working model for their own
company based on their original first generation architecture.
Packet filters act by inspecting the "packets" which are transferred between computers on the
Internet. If a packet matches the packet filter's set of filtering rules, the packet filter will drop
(silently discard) the packet or reject it (discard it, and send "error responses" to the source).
This type of packet filtering pays no attention to whether a packet is part of an existing
stream of traffic (i.e. it stores no information on connection "state"). Instead, it filters each
packet based only on information contained in the packet itself (most commonly using a
combination of the packet's source and destination address, its protocol, and, for TCP and
UDP traffic, the port number).
TCP and UDP protocols constitute most communication over the Internet, and because TCP
and UDP traffic by convention uses well known ports for particular types of traffic, a
"stateless" packet filter can distinguish between, and thus control, those types of traffic (such

as web browsing, remote printing, email transmission, file transfer), unless the machines on
each side of the packet filter are both using the same non-standard ports.
Packet filtering firewalls work mainly on the first three layers of the OSI reference model,
which means most of the work is done between the network and physical layers, with a little
bit of peeking into the transport layer to figure out source and destination port numbers.
When a packet originates from the sender and filters through a firewall, the device checks for
matches to any of the packet filtering rules that are configured in the firewall and drops or
rejects the packet accordingly. When the packet passes through the firewall, it filters the
packet on a protocol/port number basis (GSS). For example, if a rule in the firewall exists to
block telnet access, then the firewall will block the TCP protocol for port number 23.
6
Second generation: "Stateful" filters
From 1989–1990 three colleagues from AT&T Bell Laboratories, Dave Presetto, Janardan
Sharma, and Kshitij Nigam, developed the second generation of firewalls, calling
themCircuit- level gateways.
Second-generation firewalls perform the work of their first-generation predecessors but
operate up to layer 4 (transport layer) of the OSI model. This is achieved by retaining packets
until enough information is available to make a judgement about its state. Known as stateful
packet inspection, it records all connections passing through it and determines whether a
packet is the start of a new connection, a part of an existing connection, or not part of any
connection. Though static rules are still used, these rules can now contain connection state as
one of their test criteria. Certain denial-of-service attacks bombard the firewall with
thousands of fake connection packets in an attempt to overwhelm it by filling its connection
state memory.
Third generation: application layer
Marcus Ranum, Wei Xu, and Peter Churchyard developed an Application Firewall known as
Firewall Toolkit (FWTK). In June 1994, Wei Xu extended the FWTK with the Kernel
enhancement of IP filter and socket transparent. This was known as the first transparent
Application firewall, released as a commercial product of Gauntlet firewall at Trusted
Information Systems. Gauntlet firewall was rated one of the number 1 firewalls during 1995–
1998.
The key benefit of application layer filtering is that it can "understand" certain applications
and protocols (such as File Transfer Protocol (FTP), Domain Name System (DNS),
orHypertext Transfer Protocol (HTTP)). This is useful as it is able to detect if an unwanted
protocol is attempting to bypass the firewall on an allowed port, or detect if a protocol is
being abused in any harmful way. As of 2012, the so-called next-generation firewall (NGFW)
is nothing more than the "widen" or "deepen" inspection at application-stack. For example,

the existing deep packet inspection functionality of modern firewalls can be extended to
include i) Intrusion prevention systems (IPS);
ii) User identity integration (by binding user IDs to IP or MAC addresses for
7
"reputation"); and/or
iii) Web Application Firewall (WAF). WAF attacks may be implemented in the tool
"WAF Fingerprinting utilizing timing side channels" (WAFFle).
Study
Penetration of Firewall
Attacking Packet Filtering Firewall
• IP Address Spoofing Attack
• Denial-of-service Attack
• Tiny Fragment Attack
• Trojan Attack
Attacking Stateful Inspection Firewall
• Protocol Tunneling
• Trojans Rebound
Attacking Proxy
• Unauthorized Web Access
• Unauthorized Socks Access
• Unauthorized Telnet Access
Penetration of Firewall using WinGate.
WinGate is Integrated Gateway Management Software for Microsoft Windows,
providing web caching, firewall and NAT services, along with a number of integrated proxy
servers and also email services (SMTP, POP3 and IMAP servers).
WinGate 1.0 was first released on 5 October 1995, and was a re-write of a product that had
been previously released in prototype form by Adrien de Croy under the name SocketSet
earlier that year.
WinGate proved very popular, and by the mid to late 1990s, WinGate was almost ubiquitous
in homes and small businesses that needed to share a single Internet connection between
multiple networked computers. The introduction of Internet Connection Sharing inWindows
98 however, combined with increasing availability of cheap NAT-enabled routers, forced
WinGate to evolve to provide more than just internet connection sharing features. Today,
focus for WinGate is primarily access control, email server, caching, reporting, bandwidth
management and content filtering.
WinGate comes in three versions, Standard, Professional and Enterprise. The Enterprise
edition also provides an easily configuredvirtual private network system, which is also
available separately as WinGate VPN. Licensing is based on the number of concurrently

connected users, and a range of license sizes are available. Multiple licenses can also be
aggregated.
8
The current version of WinGate is version 8.0.5 (released 5 December 2013).
Figure 6: WinGate.
Hardware Firewall vs Software Firewall
• Hardware firewalls are specifically built within hardware devices like routers whereas
software firewalls are software programs installed on computers.
• Hardware firewalls protect a whole network while software firewalls protect individual
computers on which they are installed.
• By default, hardware firewalls filter web packets while software firewalls may not filter
web packets unless web traffic filtering controls are enabled.
• A hardware firewall can be configured to use a proxy service for filtering packets while a
software firewall does not use a proxy service to filter.

Firewall Analysis
Understanding the deployed firewall policy can be a daunting task. Administrators today
have no easy way of answering questions such as can I telnet from here to there? Or from
which machines can our DMZ be reached, and with which services? , or what will be the
effect of adding this rule to the firewall?' ' . These are basic questions that administrators need
to answer regularly in order to perform their jobs, and sometimes more importantly, in order
to explain the pol icy and its consequences to their management. There are several reasons
why this task is difficult, including:
1. Firewall configuration languages tend to be arcane, very low level, and highly vendor
9
specific.
2. Vendor-supplied GUIs require their users to cl ick through several windows in order
to fully understand even a single rule: at a minimum, the user needs to check the I P
addresses of the source and destination fields, and the protocols and ports underlying
the service field.
3. Firewall rule-bases are sensitive to rule order. Several rules may match a particular
packet, and usual ly the first matching rule is applied -- so changing the rule order, or
inserting a correct rule in the wrong place, may lead to unexpected behavior and
possible security breaches.
4. Alternating PASS and DROP rules create rule-bases that have complex interactions
between different rules. What pol icy such a rule-base is enforcing is hard for humans
to comprehend when there are more than a handful of rules.
Firewall Policies:
To protect private networks and individual machines from the dangers of the greater Internet,
a firewall can be employed to filter incoming or outgoing traffic based on a predefined set of
rules called firewall policies.
Policy Actions:
• Packets flowing through a firewall can have one of three outcomes:
– Accepted: permitted through the firewall
– Dropped: not allowed through with no indication of failure
– Rejected: not allowed through, accompanied by an attempt to inform the source that
the packet was rejected.
Blacklists and White Lists:
There are two fundamental approaches to creating firewall policies (or rulesets) to
effectively minimize vulnerability to the outside world while maintaining the desired
functionality for the machines in the trusted internal network (or individual computer).

10
• Blacklist approach
– All packets are allowed through except those that fit the rules defined specifically in a
blacklist. This type of configuration is more flexible in ensuring that service to the
internal network is not disrupted by the firewall.
Figure 7: Black list firewall approach.
• Whitelist approach
– A safer approach to defining a firewall ruleset is the default-deny policy, in which
packets are dropped or rejected unless they are specifically allowed by the firewall
Figure 8: White list firewall approach

11
Methodology
Design Principles of Firewall
i. Packet Filtering Firewall:
Allow the packet which match the established rule set to pass and deny the packet which
violate the established rule set, at the same time, it will record log message, alarm the
administrator when a policy has been violated.
Working of Packet Filtering Firewall.
• A packet filter has a set of rules with accept or deny actions
• Based on the information contained in the packet itself
• Using different field in the head of the packet to filter, include the packet's source and
destination address, its protocol, port number, and so on
• When the packet filter receives a packet of information, the filter compares the packet to
your pre-configured rule set
• At the first match, the packet filter either accepts or denies the packet of information
Figure 9: Working of Packet Filtering Firewall.

A packet filtering router should be able to filter IP packets and decision to forward/drop
packets based on the following four fields:
12
 source IP address, destination IP address
 TCP/UDP source and destination port numbers
 ICMP message type
 TCP SYN and ACK bits
Filtering  is used to:
 block connections from specific hosts or networks
 block connections to specific hosts or networks
 block connections to specific ports
 block connections from specific ports
Example 1: block incoming and outgoing datagrams with IP protocol field = 17and with
either source or dest port = 23.
All incoming and outgoing UDP flows and telnet connections are blocked.
Example 2: Block inbound TCP segments with ACK=0.
Prevents external clients from making TCP connections with internal clients, but allows
internal clients to connect to outside.
Advantages
• High speed
• Transparent for the users
Disadvantages
• Cannot filter the packet according the containing of the packet
• Only offer brief log messages
• Every port that may be used must be open to the external network, which increase the risk
of attack
• Very difficult to configure ACL (Access Control List).

13
ii. Stateful Inspection Firewall:
A stateful inspection firewall is a firewall that monitors the state of the connection and
compiles the information in a state table.
Working of Stateful Inspection Firewall
Stateful packet inspection (SPI) or stateful inspection is a firewall that keeps track of the state
of network connections (such as TCP streams, UDP communication) traveling across it. The
firewall is programmed to distinguish legitimate packets for different types of connections.
Only packets matching a known active connection will be allowed by the firewall; others will
be rejected.
Figure 10: Working of Stateful Inspection Firewall.
Advantages
• Safer than static packet filtering
• Better performance than static packet filtering
Disadvantages
• Security is not high enough due to fewer checks on packet data
• More detections demand higher performance of the firewall

iii. Application Layer Gateway (ALG, or Proxy Server)
Responsible for the communication between external network and internal network. When
the users intend to communicate, they do not communicate directly, proxy will help
forwarding instead.
14
Working of Application Layer Gateway (ALG, or Proxy Server)
Figure 11: Working of ALG Firewall.
Function Offered by Proxy
• Authentication mechanism
• Content Filtering
• Mature Log
Advantages
• Accelerate the network by its Cache
• Prevent any detection to internal network
• Filtering the content of the packet effectively
• Reduce direct attack to internal network
• No IP Address Spoofing Attack
• Mature Log
Disadvantages
• A special service must have a special proxy
• Too much access delay when proxy server is busy
• Opaque (not transparent) for the users
• Slower than Packet Filtering firewall

iv. Bastion Host Firewall.
A Bastion host is a special purpose computer on a network specifically designed and
configured to withstand attacks. The computer generally hosts a single application, for
example a proxy server, and all other services are removed or limited to reduce the threat to
the computer. It is hardened in this manner primarily due to its location and purpose, which is
either on the outside of the firewall or in the DMZ and usually involves access from untrusted
networks or computers.
15
Figure 12: Working of Bastion host Firewall.
Placement of Bastion hosts
There are two common network configurations that include bastion hosts and their
placement. The first requires two firewalls, with bastion hosts sitting between the first
"outside world" firewall, and an inside firewall, in a demilitarized zone (DMZ). Often smaller
networks do not have multiple firewalls, so if only one firewall exists in a network, bastion
hosts are commonly placed outside the firewall
Bastion hosts are related to multi-homed hosts and screened hosts. While a dual-homed host
often contains a firewall it is also used to host other services as well. A screened host is a
dual-homed host that is dedicated to running the firewall.
Figure 13: Internal Bastion host. Figure 14: External Bastion host.

16
Firewall Configurations
i. The Dual Homed Gateway
This is a secure firewall design comprising an application gateway and a packet filtering
router. It is called “dual homed” because the gateway has two network interfaces, one
attached to the Internet, the other to the organisation's network. Only applications with proxy
services on the application gateway are able to operate through the firewall. Since IP
forwarding is disabled in the host, IP packets must be directed to one of the proxy servers on
the host, or be rejected. Some manufacturers build the packet filtering capability and the
application proxies into one box, thereby simplifying the design (but removing the possibility
of having an optional info server and modems attached to the screened subnet, see Figure 10).
The disadvantages of the dual homed gateway are that it may be a bottleneck to performance,
and it may be too secure for some sites (!) since it is not possible to let trusted applications
bypass the firewall and communicate directly with peers on the Internet. They must have a
proxy service in the firewall.
Figure 15: Dual Homed Gateway Firewall.
ii. The Screened Host Gateway
The screened host gateway is similar to the above, but more flexible and less secure, since
trusted traffic may pass directly from the Internet into the private network, thereby bypassing
the application gateway. In this design the application gateway only needs a single network
connection
The IP router will normally be configured to pass Internet traffic to the application gateway
or to reject it. Traffic from the corporate network to the Internet will also be rejected, unless
it originates from the application gateway. The only exception to these rules will be for
trusted traffic that will be allowed straight through.
Figure 16: The screened host gateway Firewall.

17
iii. The Screened Subnet Gateway
This configuration creates a small isolated network between the Internet and the corporate
network, which is sometimes referred to as the demilitarised zone (DMZ), see Figure 12. The
advantages of this configuration is that multiple hosts and gateways can be stationed in the
DMZ, thereby achieving a much greater throughput to the Internet than the other
configurations; plus the configuration is very secure as two packet filtering routers are there
to protect the corporate network.
The IP router on the Internet side will only let through Internet traffic that is destined for a
host in the DMZ (and vice versa). The IP router on the corporate network side will only let
site traffic pass to a host in the DMZ (and vice versa).
This system is as secure as the dual homed gateway, but it is also possible to allow trusted
traffic to pass straight through the DMZ if required. This configuration is of course more
expensive to implement!
Figure 17: The Screened Subnet Gateway Firewall.
iv. Double Proxying and a DMZ
The configuration shown in Figure 13 is even more secure that the screened subnet seen in
the previous section. It is used by a bank to protect its internal network from direct access
from the Internet. Users from the Internet have to pass through two application proxies
before they can access the bank’s intranet.
This shows that there really is no limit to how complex a firewall configuration can be. The
only limitations are the cost and performance implications of building ulta-secure firewall
configurations.
Figure 18: Double Proxying and a DMZ Firewall.

Reviews
In short, firewalls are necessary. Without a firewall, your internet-connected PC would not
last for many minutes before succumbing to an attack. Ever since Vista, Windows operating
systems have included an excellent two-way firewall, which means it can protect against
things trying to attack from the outside and things trying to connect with their senders once
they make it inside the firewall to your computer. Many people are content to run the
Windows firewall, and there is nothing wrong with that. However, some people prefer a
firewall from the same publisher who sells their security software.
18
Figure 17: The firewall.

19
Conclusions
What Can a Firewall Do:
• Packet Inspection
• Connections and State
• Stateful Packet Inspection
• protect internal host from the risk of direct interaction
• Insulate the protected host from threats by ensuring that an external host can never directly
communicate with the protected host
Protect resources
• To protect resources from threat
• Protected resources should always be kept patched and up-to-date
• Record all communications especially access policy violations
• Through system log or proprietary logging format
• Alarm when a policy has been violated
References
1. Network Firewall Technologies-i. David W Chadwick
IS Institute, University of Salford, Salford, M5 4WT, England.
2. Packet Filtering and Stateful Firewalls
Avishai Wool, Ph.D., School of Electrical Engineering.
3. KAIST, Dept. of EECS.
4. http://en.wikipedia.org/wiki/Firewall_(computing)
5. http://my.ss.sysu.edu.cn/WebSec/download/chap6.pdf
6. http://en.wikipedia.org/wiki/WinGate

Firewalls

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Firewalls (20)

More from Sonali Parab (19)

Recently uploaded (20)

Firewalls