 network appliances to filter network traffic

1. Internet Intranet Firewalls  network appliances to filter network traffic  filter on header (largely based on layers 3-5)

2. Firewall Filtering Criteria Destination IP Source IP Destination Port Source Port Flag (TCP-only) ACK - acknowledge FIN - final PSH - push RST - reset SYN - synchronize URG - urgent

3. Firewall Types  static packet filtering  dynamic packet filtering  stateful packet filtering  proxy server

4.  static packet filtering packet  Network manager configures access control lists  Packets are compared to access control lists  Example: block

5. 0 - echo reply 3 - destination unreachable 4 - source quench (from overloaded router) 5 - redirect (indicates a better path) 6 - echo request 9 - router advertisement (fore new routers) 10 - router solicitation (host request for advertisement) 11 - time exceeded (packet header may include time) 12 - parameter problem (catch all for errors) 13 - time stamp request (checking link speed) 14 - time stamp reply Problems with static filtering • Blocking FIN scanning • Difficult to filter • Difficult to filter Internet Control Message Protocol - designed for Internet testing/maintenance - does not use ports - has type field

6.  dynamic packet filtering ACLs packet  Includes all capabilities of static filtering  Maintains an Active Sessions Table  Example: block external FIN scan

7.  stateful packet filtering ACLs Active Sessions Table packet  Includes all capabilities of dynamic filtering  Also “understands” certain application behavior  Example: better control over UDP, NFS, RPC

8.  proxy server packet destination  Messages to destination IP are rerouted to a proxy  The proxy communicates on behalf of the destination  The proxy may also communicate with destination

9. Firewalls in Practice