If no rule fits, we default to either allow or deny
Deny all is safer but takes more work to manage because you need to go in every time to add exceptions where appropriate
Allow all has dangers but is easy to manage because you change the firewall less
Choosing allow or deny is based on what you/company needs and how secure you need to be
IP/MAC are the easiest/quickest to filter; data is the slowest
You can do things like filter by port if the port shouldn't be used by that server
Example: DNS server doesn't need ports for web or email
Example: Pings are good for testing connections, but they allow nmap type attacks (ICMP)
Stateful vs Stateless Firewalls
Stateful firewalls filter based on full context
Iptables are stateful (technically so is Windows firewall, we just don't care about that right now. Linux rulz! windows drools)
Once the certain traffic is approved it's added to the state table and get more access to the protected network
If it wasn't approved it gets blocked
They can use IPSec (IP security) such as tunnels and encryption
They are better at identifying unauthorized and forged info
Stateless firewalls work on static information and don't inspect entire packets
For example: source and destination is Info stateless might look at
Packet filtering is done with matching conditions
These conditions are pre-approved with corresponding pre-approved actions(Also known as an access control list)
They mainly focuses on packet filtering
Typically faster then stateful
Firewall Use Case Example: DDOS
DDOS attacks are very common, and a firewall can be a good first line of defense for them
There are also third party services that specialize in DDOS prevention, but we can do something to help prevent DDOS as well.
You could for example filter out a range of addresses
You can think of use cases for your network, are you a USA based company with no workers or subcontractors elsewhere? Then maybe filter out non-USA IP addresses
As rules are examined, if a rule is used the system performs the operation and no further rules are used
Allow all or deny all is the last rule in the chain
There are multiple chains for different areas like prerouting(as they come in) and postrouting(as they go out)
Each chain has the potential for multiple tables, like the "filter" table that decides if we allow or deny the packet access.
Your options are accept, drop or reject packets
Drop denies without notification
Reject sends back error
You can set a script for base rules and to modify rules in case of things like hacking and you need to shut down everything fast, or to set up your IPv6 in the same way as your IPv4
DMZ is where the potential problems go, like Web, Email, VoIP and FTP
A duel firewall is where you have multiple firewalls at the same company, this is defense in depth and generally a good practice.
Example: An external firewall that forwards potential problem packets to DMZ, and an internal firewall that protects the internal network from the DMZ
Example: In industry a lot of companies will also incorporate things like network firewalls and computer firewalls, and have different vendors for each so the same "holes" don't line up
Suggested Activities and Discussion Topics:
In small groups, work on what you think should happen for a DDOS event for your server. Make a list of priorities and spec them out like you're creating a script
In groups of 3, write a script to to show IPtables rules, IP6tables rules, add some headings and titles so it's clear what you're looking at.
In pairs, write a script to shut down everyone on the system except you (Alternative to full shutdown)
Individually go through the documentation for one server you are running, and one server you are NOT running and see what the firewall options are, is it a script? Program? GUI? Does it persist on reboot?
Complete the lab that is found on This PDF Make sure you are paying careful attention to the requirements.
Would you like to see some more classes?
Click here