I'm preparing for an introductory information security examination in university and this is one of the tutorial questions on Firewall design. My concerns for the provided solution is how to define the rules for the firewalls in terms of the source port and the destination ports as well as any thought process before coming up with the partitioning.
Here are the relevant sections for my question
Some of you have not completed the Networking module yet, and thus may not familiar with the role of port numbers in a client-server connection and communication. A service offered by a server can be accessed via some predefined port number. For instance, consider an SMTP email server, which listens to port number 25. If a client wants to communicate with the server for a SMTP communication, the client sends packets to the server’s IP address at port number 25. The server responses by sending packets to the client’s IP address at another port number selected by the client, which is greater than 1,023.
Hence, in summary, if the client sends packets to the SMTP server, the destination port of these packets must be 25, but the source port can be any number greater than 1,023. Conversely, packets sent by the SMTP server have source port 25, and their destination port is the one specified by the client.
Notice that a source IP address can be easily forged. A reply packet sent to this spoofed IP address is delivered to the address and is therefore generally unaccessible to the packet spoofer. In this tutorial, we assume that a sent packet will reach its destination as specified in the destination IP address. Man-in-the-middle between a firewall and a host is out-of-scope in the firewall design. It needs to be separately dealt with by other measures.
The actual question
(Firewall design:) Suppose you are the system administrator of a new secondary school, and your first task is to design the school’s network and its firewalls. You have decided to have 2 firewalls to protect your network. The machines in the network include:
(a) Lab: There is a total of ∼100 machines in a few labs for students to prepare their reports, search for materials on the Web, etc. There are also network printers in the labs.
(b) Teachers: Every teacher has a PC in the teacher's room. The teachers use the PCs to enter students’ grades, send/receive emails, prepare teaching materials, print exam questions, perform Web searches, etc. There are also network printers in the teacher rooms.
(c) Web-server: the school’s Web server.
(d) Email-server: the school’s SMTP email server.
(e) SQL-server: This is a SQL server that stores the student database. Some information can be accessed via a Web-based application hosted in the Web server. For example, a Web-based application can allow the students to update their mobile phones. Some other information can be accessed only by the teachers.
You need to configure firewall rules in the firewall table of each deployed firewall. Each rule occupies a row in the table. The fields of each rule, together with their possible values, are as follows:
(a) source IP: a set of source IP addresses. It can be specified as a boolean expression over the above-listed predefined names, e.g. Email-server, and other newly- defined names, e.g. Internal to refer to all machines in the school.
(b) dest IP: a set of destination IP addresses. Likewise, its boolean expression can be defined over the predefined names listed above, or any newly-added names.
(c) source port, destination port: the source and destination port number, respectively. Notice that some services use fixed predefined port numbers. The firewall can recognize some well-known port numbers, like HTTP, SMTP, LPR, SQL. (Note: LPR is a network printing protocol, which listens to port number 515.)
(d) direction: this can be IN or OUT. A firewall divides the network into two sectors, say S1, and S2. This field indicates which direction a referred packet is moving, either from S1 to S2, or the other way. Your design has to indicate the meaning/context of IN and OUT.
(e) action: either Block or Allow.
Notes: Remarks and Requirements.
(a) It is important to prevent cases where student exam questions get mistakenly printed in the Lab.
(b) It is also important to protect the SQL server.
(c) We know that source IP addresses can be spoofed. The school is worried that some students are running some hacking tools that generate spoofed source IP addresses. Hence, the school wants to block outbound packets from the school that does not have legitimate source IP addresses.
(d) In this question, we ignore the detailed issue of routing. So, we do not consider the Internet gateway and Network Address Translation (NAT). For simplicity, we just assume that all machines use “public” IP addresses.
(e) Will you increase the security of the school network if you use 3 firewalls instead? You can think of a good strategy of placing the third firewall and consider what machines to be placed on the new network segment.