Firewalls

This page is very incomplete at the moment.

Reasons for firewalls

• Protecting the inside world from the outside world
• Protecting the outside world from the inside world
• Privacy
• Restricting and/or monitoring the behavior of individuals within your organization.
• Conserving IP address space.

Some Types of firewalls

There are a number of different characteristics by which you can categorize firewalls.

The following characteristics may be mixed. Many real world firewalls may be some combination of the following types.

• Packet Filter

  This type of firewall requires considerable skill to administer correctly. It offers the highest performance. It preserves all information about the source and destination, which is important to security conscious servers which use this information to aid in logging and authentication. It does not filter the data streams based on content. All other things being equal, packet filters are the least vulnerable to attaks against the firewall itself. Packet filters normally only perform modifications which do not affect the data stream itself and which normally occur on the internet anyway (such as breaking packets into fragments or reassembly of fragments). A basic packet filter based firewall allows all IP packets permitted by the firewall rules to pass (although it may reassemble fragments and/or refragment before doing so).

• Proxy Based

  Proxies usually require proxy aware applications or proxy aware users. Proxy based firewalls can filter based on content of the data stream and can modify the data stream. This allows them to protect weak server applications inside the firewall against certain types of known attacks but at the expense of a more complicated firewall which is therefore more vulnerable to attacks against the firewall itself; whether this risk is warranted depends on how poorly written the application being protected is. A basic proxy based firewall does not forward any IP packets and only forwards the data streams for which specific application proxies have been installed. A proxy may hide the identities of hosts inside the firewall from hosts outside a firewall and vice versa. Attempting to put software developers and other technically savvy users behind a proxy based firewall could result in death threats.

• Transparent Proxy

  A transparent proxy combines some of the features of the packet filter and the proxy based firewall. A transparent proxy can inspect and/or modify the contents of the application data stream while optionally preserving and acting on the source and destination information in the IP header. Since the original source and destination information in the packets is availible to the transparent proxy, neither client applications nor users need to be firewall aware to use the services protected by the proxy.

• IP Masquerading

  In some cases, a firewall is used to allow a large number of internal hosts to use a small number of global addresses. IP Masquerading was primarily developed to handle these situations although it has certain uses for handling certain problematic protocols.

• Bastion host

  The term "bastion host" may refer to a host which is connected to your internal and external networks with no forwarding path for IP packets either through or around the bastion host, in which case it can be considered a type of firewall, or it may refer to a host located in a "de-militarized zone (DMZ)" between the inside nework and the outside network, typically with one or more firewalls separating the demilatarized zone from either or both the internal and external networks.

• Black Box
• Crystal Box

• Single-homed A single homed firewall is only useful if it used in conjuction with another firewall, typically a packet filtering router.
• Dual-homed Most firewalls are dual homed; they have two network interfaces, one for the inside network and one for the outside network.
• Multi-homed Technically, multi-homed refers to two or more network interfaces; therefore, dual-homed can be considered a subset of multi-homed. A firewall may have more than two interfaces for a number of reasons. There may be more than one connection to the outside world. You may want to protect various departments within your organization from each other. You may want to implement two logical firewalls on either side of your demilatirized zone with a single firewall. You may want to more throughly isolate certain older, less carefully maintained hosts inside your organization. You may want to offer IP connectivity to another organization within your building while protecting your network from them and offering them some protection as well. You may want to prevent hosts from masquerading as or evesdropping on other hosts within your network; a firewalls ability to effectively protect hosts and traffic within your network is limited to its direct control over the traffic between hosts.

IPsec

• freeswan home page
• NIST Cerberus, An IPsec Reference Implementation for Linux.
• Swan, or FreeSWAN, is a project to develop an S/WAN (IPsec) implementation under linux outside the US.
• RSA is coordinating the S/WAN inititative to provide interoperable IPsec implementations.

Assorted Links

• Filter Language Compiler
• linux IP Masquerade mini-HOWTO
• Linux IP Masquerading Web Site
• Digital by Design (DBD) and
• Linux IP masquerade resource Free Electron Labs offer security consulting services including linux based firewalls.
• A paper by X/OS is one of the best descriptions of ipfwadm and the kernel firewalling features. In particular, it contains some of the only documentation availible for the transparent proxy features.
• X/OS also brings us the A HREF="http://www.xos.nl/linux/ipfwadm/">ipfwadm home page.
• X/OS sells configured firewalls based on linux and security consulting.
• Firewalls mailing list archive at greate circle.com.
• Searchable Firewalls mailing list archive at www.nexial.nl.
• There is a poor quality archive of the firewalls mailing list at www.netsys.com
• The Linux Router Project
• sample cisco firewall rules
• The ftp client supplied by microsoft with windows 95 and windows NT cannot support PASV. A couple windows ftp clients which do are WS_FTP Pro and CuteFTP. These are about $35 each. There is an LE version of WS_FTP which is availible free for academic and non-profit use.
• Here is a report from Creative Networks based on 66 phone interviews which discusses how standards based SMTP/MIME based systems are much more reliable and cheaper to maintain than proprietary systems like microsoft exchange and Lotus Notes.
• Linux Firewalling and Proxy Server HOWTO
  This document, unfortunately, is heavily biased towards proxy based systems and supports this bias with a number of absurd statements rather than making any of the legitimate arguments which could be made.
• Linux Bridge and Firewall Mini-HOWTO.
• socks
• RFC1918 gives the address blocks for private internets.
• gnatbox
• linux net search results.
• test
• Netscape Automatic Proxy configuration
  Netscape 3.0 and higher allow a javascript function to be called to see if it should comminicate via a proxy for each url. SOCKS is permitted.
• Microsoft does not appear to publish real information on their autoconfiguration mechanism.
• SOCKShome page.

Performance

Pentium 120 with tulip cards:
  Packet Size (bytes)    64    128    256    512    1024   1280   1518
  Throughput (Mbit/s)  9.560  19.00  34.71  64.81  97.95  98.36  98.56
  Est Packets/sec      18700  18600  16900  15800  12000   9600   8100     

Pentium II/266 with DEC DE500 cards:
   Packet Size (bytes)    64    128    256    512    1024   1280   1518
   Throughput (Mbit/s)  15.25  32.82  59.36  95.87  97.98  98.38  98.56
   Est Packets/sec      29800  32000  29000  23400  12000   9600   8100