0

I'm preparing for an introductory information security examination in university and this is one of the tutorial questions on Firewall design. My concerns for the provided solution is how to define the rules for the firewalls in terms of the source port and the destination ports as well as any thought process before coming up with the partitioning.

Here are the relevant sections for my question

Networking Background

Some of you have not completed the Networking module yet, and thus may not familiar with the role of port numbers in a client-server connection and communication. A service offered by a server can be accessed via some predefined port number. For instance, consider an SMTP email server, which listens to port number 25. If a client wants to communicate with the server for a SMTP communication, the client sends packets to the server’s IP address at port number 25. The server responses by sending packets to the client’s IP address at another port number selected by the client, which is greater than 1,023.

Hence, in summary, if the client sends packets to the SMTP server, the destination port of these packets must be 25, but the source port can be any number greater than 1,023. Conversely, packets sent by the SMTP server have source port 25, and their destination port is the one specified by the client.

Notice that a source IP address can be easily forged. A reply packet sent to this spoofed IP address is delivered to the address and is therefore generally unaccessible to the packet spoofer. In this tutorial, we assume that a sent packet will reach its destination as specified in the destination IP address. Man-in-the-middle between a firewall and a host is out-of-scope in the firewall design. It needs to be separately dealt with by other measures.

The actual question

(Firewall design:) Suppose you are the system administrator of a new secondary school, and your first task is to design the school’s network and its firewalls. You have decided to have 2 firewalls to protect your network. The machines in the network include:

(a) Lab: There is a total of ∼100 machines in a few labs for students to prepare their reports, search for materials on the Web, etc. There are also network printers in the labs.

(b) Teachers: Every teacher has a PC in the teacher's room. The teachers use the PCs to enter students’ grades, send/receive emails, prepare teaching materials, print exam questions, perform Web searches, etc. There are also network printers in the teacher rooms.

(c) Web-server: the school’s Web server.

(d) Email-server: the school’s SMTP email server.

(e) SQL-server: This is a SQL server that stores the student database. Some information can be accessed via a Web-based application hosted in the Web server. For example, a Web-based application can allow the students to update their mobile phones. Some other information can be accessed only by the teachers.

You need to configure firewall rules in the firewall table of each deployed firewall. Each rule occupies a row in the table. The fields of each rule, together with their possible values, are as follows:

Diagram

(a) source IP: a set of source IP addresses. It can be specified as a boolean expression over the above-listed predefined names, e.g. Email-server, and other newly- defined names, e.g. Internal to refer to all machines in the school.

(b) dest IP: a set of destination IP addresses. Likewise, its boolean expression can be defined over the predefined names listed above, or any newly-added names.

(c) source port, destination port: the source and destination port number, respectively. Notice that some services use fixed predefined port numbers. The firewall can recognize some well-known port numbers, like HTTP, SMTP, LPR, SQL. (Note: LPR is a network printing protocol, which listens to port number 515.)

(d) direction: this can be IN or OUT. A firewall divides the network into two sectors, say S1, and S2. This field indicates which direction a referred packet is moving, either from S1 to S2, or the other way. Your design has to indicate the meaning/context of IN and OUT.

(e) action: either Block or Allow.

Advice

Notes: Remarks and Requirements.

(a) It is important to prevent cases where student exam questions get mistakenly printed in the Lab.

(b) It is also important to protect the SQL server.

(c) We know that source IP addresses can be spoofed. The school is worried that some students are running some hacking tools that generate spoofed source IP addresses. Hence, the school wants to block outbound packets from the school that does not have legitimate source IP addresses.

(d) In this question, we ignore the detailed issue of routing. So, we do not consider the Internet gateway and Network Address Translation (NAT). For simplicity, we just assume that all machines use “public” IP addresses.

(e) Will you increase the security of the school network if you use 3 firewalls instead? You can think of a good strategy of placing the third firewall and consider what machines to be placed on the new network segment.

Description Firewalls

  • Well, what are your thoughts on how to start? – multithr3at3d Nov 20 '19 at 22:58
  • @multithr3at3d I would think draw out the 5 entities, and draw 1 edge between any 2 entities to represent both directions. If any are not required by the requirements, remove the edge. The initial number of edges will be 5C2 = 10 – Prashin Jeevaganth Nov 20 '19 at 23:49
0

Retired network engineer here.

A stateful firewall processes rules in the direction the socket was initiated and then automatically permits traffic in the return direction that matches the socket. So when you have a http/80 webserver with a stateful firewall in front of it, you need a rule to permit traffic from clients to the webserver/tcp/80, but do not need a rule for the return traffic (no rule with source port 80).

This is different than a stateless access-list in a router. There you would need a rule for the return traffic. “Permit tcp any any established” simplifies those situations, provided you are not overly concerned with data exfiltration (a credit card processing environment for example).

Eliminating the need for the return rule is one of the advantages of stateful firewalls. Rule maintenance is easier and the network is more secure because return rules cannot be abused by (for example) setting source port to 53 (exploiting a return DNS rule to access a network).

Always include the protocol (usually tcp or udp) in firewall rules. TCP/80 is different than udp/80.

While a webserver listens on tcp/80 and tcp/443 (requiring inbound rules), most servers need some outbound access to function. DNS is a good example.

It is also important to understand what networks each device is on. A firewall can only block traffic that goes through it. So draw a map! Is your SQL server on the same subnet as your HTTP server? Does traffic from the internet to your webserver even go through the inner firewall? A firewall can have multiple interfaces and apply separate rules in/out on each interface (although some firewalls also support a “global rule” configuration.

Step #1 in a PCI audit is to provide the auditors with a network, firewall, and system map of the credit card data flow. There are similar audit requirements for healthcare and school data (those are mandated by law!)

A common design would be to have a subnet for your webserver connected to your outer firewall. You would have a subnet for your SQL server on your inner firewall. Your webserver is the most likely device to be compromised first by attackers , so keep it isolated. Your SQL server has the data that will get you fired if it is compromised, so keep it protected.

I’ll note that your existing rules allow the internet to portscan your teachers boxes by setting source port to 80. Preventing that is exactly why you want a stateful firewall, eliminating the need for that “source port 80” rule.

  • Thank you for the answer. Would you mind clarifying when to put the * notation for the destination port, for example in Rule 1 of Firewall Table 2 and also Rule 3 in the same table? – Prashin Jeevaganth Nov 21 '19 at 3:59
  • I would allow teacher and lab machines to make outbound connections to the Internet on any destination port. That is necessary for arbitrary applications that access the internet to work (FaceTime, Apple push notifications, Skype, netrek, steam, etc). You may want to block outbound connections to DNS before that, forcing use of your preferred DNS server (many schools use openDNS to prevent students from accessing...inappropriate..content). – Darrell Root Nov 21 '19 at 4:05
  • How about Rule 1 of Firewall Table 2? Think it was left out in your comment. – Prashin Jeevaganth Nov 21 '19 at 4:11
  • But when granting access for the labs to access the internet, don’t accidentally grant them access to the teachers. That’s why it’s nice to have ACLs per interface rather than per firewall. – Darrell Root Nov 21 '19 at 4:12
  • To prevent the accidental access, do you mean adding a rule on top of the first firewall to block Labs--> Teachers? – Prashin Jeevaganth Nov 21 '19 at 4:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.