How do experienced users test stateful firewall with TCP/IPv6?
My test case includes:
- echo reply without request
- tcp ack without syn
Are there any more test cases, especially with IPv6?
A method for two clients, each isolated behind separate firewalls working in NAT, can establish communication with each other, even if the connection is explicitly allowed.
UDP packets does not contain any state. When an initial UDP packet leaves the firewall with NAT, it will allow UDP traffic to be returned through the same "session".
When to clients starts mass-sending udp packets at each other (same source/dest port tuple), at some point, both firewalls will believe that they initiated the traffic, and allow traffic between the two clients, each isolated by a NAT firewall.
Some firewalls does not only track connections based on tcp connection state, but also the application protocol's request to i.e. send a file over irc or ftp. While this is a feature when it works as intended, it can also be used to make the firewall open up for unintended connections.
An example of this is the XSS IRC DCC attack: http://encyclopediadramatica.ch/Firefox_XPS_IRC_Attack
Sounds like you will want to settle in with a cup of coffee, a copy of the spec, and the libpcap man pages.
It should not be too difficult to write a program that will craft and transmit these packets for you. The high level flow will be
After you build this out for each of your test cases you can just run the app and watch the firewall for correct behavior. I would, of course, capture the traffic and make sure something like wireshark decides it properly as part of your testing/qa process.