[Network Security] Firewall

2022.12.03.Sat. 수정

Firewall

What are Firewalls?

Firewall(방화벽)

V3, 알약 - 방화벽 제공 -> Host firewall

network 전체 방화벽: Network firewall

=> 단순 firewall (문맥상만 구분)

Motivation

• 신뢰X 외부 네트워크 접근/공격으로부터 내부를 보호
• 공격에 대해 각 호스트를 업그레이드/교체하기 < 방화벽이라는 솔루션 ~> 시스템 전체의 기본적인 방어 제공
  내부 보안 ↑ -> 시설 교체/ 시스템 업그레이드 but 비용 ↑ -> 방화벽 => 저비용 고효율 solution

• 로깅 ~> 보안 관리, 추적 등 용이

Definitions

3가지 설계 목표(-> 1번만 만족시켜도 ok)

A collection of components placed between two networks that collectively have the following properties (as design goals) [BELL94]:

• All traffic from inside to outside, and vice versa, must pass through the firewall.
  This is achieved by physically blocking all access to the local network except via the firewall
  • 방화벽이 유일한 통로가 되어야 함

외부로 나가고 내부로 들어오는 모든 트래픽이 firewall 통과해야 함

• Only authorized traffic, as defined by the local security policy, will be allowed to pass.
  Various types of firewalls are used, which implement various types of security policies
  • 인증된 트래픽만 통과

내부(local); 방화벽(보안) 정책 결정, 인증된 트래픽만 방화벽 통과

• The firewall itself is immune to penetration (침투/침입).
  This implies the use of a hardened system with a secured operating system
  • 공격에 대한 방어 

외부의 침투/침입 공격 방어

The implementation of your Internet security policy  -> 네트워크 정책 구현물을 firewall에 구현

ㄴBy Marcus Ranum, inventor of the proxy firewall and the implementer of the first commercial firewall product

Capabilities 

기본 기능

• 접근 제어(Access Control)
  • 방화벽의 가장 기본적이고 중요한 기능
  • 통과시킬 접근과 차단할 접근을 관리자가 명시 -> 방화벽 실행
  • 구현 방법 -> 패킷 필터링(Packet Filtering) 방식/ 프록시(Proxy) 방식
• 로깅(Logging)과 감사 추적(Audit Trail)
  • provides a location for monitoring security events
  • 로깅: 방화벽을 통과하는 패킷 및 연결에 대한 정보나 관리자의 설정 변경 정보 저장
  • 감사추적: 시스템내에 저장된 로그를 이용해 허용X 접속 시도, 연결 등 확인
• 인증(Authentication) 모든 기능 X
  • 메시지 인증 : 전송되는 메시지에 대한 신뢰성을 보장
  • 사용자 인증: 패스워드 같은 단순 인증부터 OTP, 토큰 기반 등의 높은 수준 인증까지 가능
  • 클라이언트 인증 : 특수한 접속을 요구하는 호스트 자체가 정당한 접속 호스트인지 확인
• 데이터 암호화
  • 방화벽에서 다른 방화벽까지 전송되는 데이터를 암호화해서 보냄(보통 VPN 기능 이용) -> IPSec

Limitations

패킷 기반 방어 -> 바이트스트림 해석X

• 바이러스 차단 X
  • 방화벽은 패킷의 데이터 내용 자체는 검사X 때문
•  내부 공격 차단 X  -> BYOD; Bring your own device
  • 경계에 대한 보안 정책을 수행할 뿐 내부 공격자에게 보안 정책을 적용할 수 X
  • 노트북, 포터블 저장기기 등이 외부에서 감염되어 내부에서 사용될 경우
• 자신을 통하지 않은 통신에 대한 제어 X
• 새로운 형태의 공격 차단X  -> 가장 큰 한계점
  • 방화벽은 예측된 접속에 대한 규칙을 세우고 이에 대해서만 방어
• 방화벽을 우회하는 공격은 방어 X -> VPN, ssh tunneling

Policy

• User control
  • Controls access to the data based on the role of the user who is attempting to access it. Applied to users inside the firewall perimeter.
• Service control
  • Controls access by the type of service offered by the host. Applied on the basis of network address, protocol of connection and port numbers.
• Direction control
  • Determines the direction in which requests may be initiated and are allowed to flow through the firewall. It tells whether the traffic is “inbound” (From the network to firewall) or vice-versa “outbound”

Inbound = Ingress/ Outbound = Egress

유저의 역할

네트워크 address/ protocol/ port number

트래픽 방향(inbound/ outbound)

Actions 

트래픽 통과 허용/ 허용X

• Accepted
  • Allowed to enter the connected network/host through the firewall.
• Denied
  • Not permitted to enter the other side of firewall.
• Rejected
  • Similar to “Denied”, but tells the source about this decision through ICMP packet.

Src -> denied: 메시지X drop/ rejected: drop되었다고 메시지

1. Ingress filtering: Inspects the incoming traffic to safeguard an internal network and prevent attacks from outside.
2. Egress filtering: Inspects the outgoing traffic and prevent the users in the internal network to reach out to the outside network. For example like blocking social networking sites in school

외부로 들어오는/ 나가는 트래픽 -> 허용하는 ip주소만 받음(filitering)

Types of Firewalls

Depending on the mode of operation -> 4 types

: Packet Filter Firewall/ Stateful Firewall/ Application Proxy Firewall/ Circuit-level Proxy firewall

 

패킷 단위로 들어오면 
network ~ transport 계층(이더넷, IP, TCP/UDP) 헤더

stateless: 이전 패킷에 대한 정보 저장X
tcp flooding attack이여도 허용하는 ip주소 패킷이면 허용
-> 방지: Statefull firewall

connection state 기록 -> TCP, UDP 

외부인터넷 접속 시
패킷 -> 프록시 ->  자기가 인터넷 서비스에 접속하는 것처럼 통신
-> 패킷 결과만 호스트에게 돌려줌
=> application까지 올라와야하고
data에 대해서 검사 어느정도 수행 가능 but, 속도 느림

application까지X transport까지가 circuit level
인터넷에서 임시 proxy 서버 프로토콜(SOCKS4/5) 제공
내 ip 주소 밝히기 싫음

Packet Filtering Firewall

• Controls traffic based on the information in packet headers, without looking into the payload that contains application data
  • src/dest IP addr & port, IP protocol, interface, etc.
• typically a list of rules of matches on fields
  • if match rule says if forward or discard packet

룰 -> 이러한 필드 어떤 조건 만족 
=> 허용/차단 근거(전달/ 버리기)

• Doesn’t pay attention to if the packet is a part of existing stream or traffic
• Doesn’t maintain the states about packets. Also called Stateless Firewall

-> 연결이 연속적 바이트스트림인지 
/ 여러 com에서 적용된 패킷인지 구분X 

Stateless packet filtering: example [Kurose-Ross]

#1. block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23

=> all incoming, outgoing UDP flows and telnet connections are blocked 

#2. block inbound TCP segments with ACK=0.

=> prevents external clients from making TCP connections with internal clients but allows internal clients to connect to outside.

Access Control Lists (ACL) [Kurose-Ross]

Packet Filter Pros & Cons

• 장점
  • 헤더만 살펴보기 때문에 처리속도가 빠름
  • 기존 응용에 쉽게 연동가능 -> 응용에 상관X 동작
  • 저렴한 구축 비용
• 단점
  • TCP/IP 프로토콜 구조적 취약점 -> Dos attack, flooding attack, spoofing
  • 데이터에 대한 공격 차단 불가능
  • 헤더 조작 가능 로깅 및 사용자 인증 기능 제공 X
  • 설정에 오류가 있으면 공격당할 수 있음

• Attacks
  • IP address spoofing, source route attacks, tiny fragment attacks
  • For More Information: https://www.informit.com/articles/article.aspx?p=376125&seqNum=10

Stateful Firewall

: 연결에 대한 정보 유지/ 저장 -> 유효한 sequence number인지 확인 가능
<-> packet filter firewall: stateless

• Tracks the state of traffic by monitoring all the connection interactions until is closed
• Connection state table(-> DB) is maintained to understand the context(문맥) of packets
• Examples 
  • Connections are only allowed through the ports that hold open connections
  • Open inbound traffic for low "well-known" port number for server
  • Track TCP sequence numbers 유지

TCP, UDP 가능
UDP: stateless protocol
ㄴ> connection 있을 수 O
상태 명시적 저장X
but, ICMP request/reply <- ping 연결

TCP: close <- FIN/ACK
UDP: timeout

 

statless에서는 sequence 저장X
패킷 헤더만 살펴보고 결정, 정보 버림 

sliding window 크기 알 수 O
ㄴ보다 매우 큰 sequence number 등장 <- 공격?

Stateful packet filtering [Kurose-Ross]

stateless packet filter

말이 되지 않는 패킷이라도 allow

admits packets that “make no sense,” e.g., dest port = 80, ACK bit set, even though no TCP connection established:

stateful packet filter

track status(알고 있음) of every TCP connection

• track connection setup (SYN), teardown (FIN): determine whether incoming, outgoing packets “makes sense”
• timeout inactive connections at firewall: no longer admit packets

연결이 맺어지지 않았는데 ACK가 있는 패킷 -> 차단
연결에 대한 항상 확인 -> 어떤 연결에 속한 패킷인지 O

ACL(; Access Control List) augmented to indicate need to check connection state table before admitting packet

Stateful Firewall Pros & Cons

• 장점
  • 보안성 우수
  • 새로운 서비스 적용 용이 firewall에만 적용
• 단점
  • 보안에 비례한 구축의 복잡성
  • ↑ 구축 비용
  • 관리의 필요성

Application-Proxy Firewall (Application (Layer) Gateway; ALG)\

-> header, data내용도 firewall에서 확인 가능 but, 속도 느려짐

• The client’s connection terminates at the proxy and a separate connection isinitiated from the proxy to the destination host
• Data on the connection is analyzed up to the application layer to determine if the packet should be allowed or rejected
•  Controls input, output and access from/to an application or service
• Acts an intermediary by impersonating the intended recipient
• Requires each application software in the firewall

Pros & Cons

• 장점
  • 데이터까지 검사가 가능 -> ↑ 보안성 제공
  • OTP등 인증 기능 사용 가능
  • 강화된 로깅 및 감사 기능 제공
  • 서비스별 개별 접근 제한/이용시간 등 부가 기능 구현용이
• 단점
  • 처리 속도
  • 새로운 서비스(또는 프로토콜) 제공을 위해 새로운 프록시를 추가 -> 유연성 ↓

initiation 
초기화해서 서버와 데이터구현
자신이 프로그램 구현
program마다 새로 proxy 구현 -> 한번에 구현X => 유연성↓

Circuit-Level Proxy Firewall

• filtering is based upon the state at session layer or below, but not app.
• Case Study: SOCKet Secure (SOCKS) Circuit-Level Gateway
  • SOCKS v5 defined as RFC1928 to allow TCP/UDP applications to use firewall
  • Client app contacts SOCKS server, authenticates, sends relay request server evaluates & establishes relay connection
  • Unlike HTTP proxies, SOCKS proxies do not understand the data transmitted

데이터에 대한 이해X
바이러스가 잘 전송되면 방화벽이 방어X

과정이 따로 인증 or 차단X
초기화 허용/차단 이미 결정 -> forwarding만 시행

 

ISP 검열 프록시 ~> 회피

방어벽을 회피/ ip 숨기고 싶은 용도로 사용 가능

• Interestingly, the proxy technology can be used to evade egress filtering
  • The destination will be modified to the proxy server
• The actual origin (source IP) can be hidden
  • Anonymizing proxy

Pros & Cons

• 장점
  • 단순하면서 서비스 유연성이 ↑ -> 서비스 새로 구현X
  • 서비스별 별도의 프록시가 필요 X
• 단점
  • 클라이언트에 SOCKS 프로토콜 처리를 위한 프로그램 필요
  • 응용 계층으로 들어가지 X -> 응용 서비스의 접근통제 로그기록은 제공 X + data 분석 제공X -> 보안성 ↓

Locating Firewalls

Firewall Basing

It is common to base a firewall on a stand-alone machine running a common operating system, such as UNIX or Linux, that may be supplied as a pre- configured security appliance

Types

• Bastion host (배스천 호스트)
• Host-based firewall
• Network Device Firewall
• Virtual Firewall

Bastion Hostcritical strongpoint in network

• hosts multiple application/circuit-level gateways -> 동작 해야함 
  • Each proxy can restrict features, hosts accessed
  • Each proxy is independent, non-privileged
• runs secure OS, only essential services -> 권력 ↑ 호스트 -> 보안 강력 OS, 필수적 서비스만
• requires user authentication to access proxy or host

Host-Based Firewalls

filter packet flows on a host

• used to secure individual host, and often also used on servers
• Advantages
  • taylored filter rules for specific host needs -> 호스트 원하는 룰 필터룰 결정
  • protection from both internal / external attacks
  • additional layer of protection to org firewall -> 조직에 대한 firewall

nternal은 host가 하나의 pc -> leaf node(: 자기 자신의 네트워크 트래픽을 필터링 가능)

Network Device Firewall (or screening router)

• Firewall functions, especially packet filtering and stateful inspection capabilities, are commonly provided in network devices such as routers and switches to monitor and filter packet flows through the device
• They are used to provide additional layers of protection in conjunction with bastion hosts and host-based firewalls
• 필터링 속도가 빠름
• 라우터 펌웨어만으로는 접근제어가 어려움 -> 배스천 호스트와 함께 사용

Virtual Firewall

cloud service -> virtual machine

In a virtualized environment, rather than using physically separate devices as server, switches, routers, or firewall bastion hosts, there may be virtualized versions of these, sharing common physical hardware

SDN; Software-Defined Network
NFV; Network Function Virtualization

// 방화벽의 위치

// 방화벽이 어떤식으로 구성되면 좋은지

DMZ Networks - DeMilitarized Zone

+ VPN; Virtual Private Networks
ㄴwith IPSec

장점: firewall 뚫려서 공격 -> DMZ만 피해 범위를 줄일 수

Distributed Firewall Configuration

좀 더 보안/개선 모델

More on Firewalls

Intrusion Detection Systems (IDS) [Kurose-Ross]

침입 탐지 시스템: 공격인지 아닌지 판단

• deep packet inspection(DPI): look at packet contents (e.g., check character strings in packet against database of known virus, attack strings)
• examine correlation among multiple packets: port scanning, network mapping, DoS attack

여러 패킷의 연관성 -> 정보

Intrusion Prevention Systems (IPS)

침입 차단하는 기능 추가 

+ 공격이라고 판단 -> block

• recent addition to security products which
  • inline net/host-based IDS that can block traffic
  • functional addition to firewall that adds Intrusion Detection System (IDS)capabilities
• can block traffic like a firewall
• using IDS algorithms -> 공격 탐지
• may be network or host based
  • Host IPS: e.g., McAfee Host Intrusion Prevention for Desktop
    https://www.mcafee.com/enterprise/en-us/products/host-ips-for-desktop.html
  • Network IPS: e.g., Snort, Zeek (formarly Bro), Suricata, etc.
    https://www.snort.org/
    https://suricata-ids.org/

Unified Threat Management (UTM)

통합 위험 관리 시스템(솔루션)

• Products that include multiple security features integrated into one box
• Maybe just a marketing term for mid-size network

---

Evading Firewalls

터널링 (Tunneling)

• 데이터 스트림을 인터넷 상에서 가상의 파이프를 통해 전달시키는 기술
• 패킷 내에 터널링할 대상을 캡슐화시켜 목적지까지 전송
• 두 노드 또는 두 네트워크 간에 가상의 링크(VPN등)를 형성하는 기법
• 하나의 프로토콜이 다른 프로토콜을 감싸는 캡슐화 기능 ~> 운반

터널링 기법

• 대부분, 보안 채널의 역할 -> 암호화 기법 적용이 일반적
• 오버레이 네트워크 구성도 가능하게 함

SSH Tunneling to Evade Firewalls

Scenario

need to telnet to a machine called “work”. We need to telnet from machine “home” to “work”.

but, the company’s firewall blocks all incoming traffic which makes telnet from “home” impossible.
The company’s firewall does allowssh traffic to reach its internal machine “apollo”, where we have an account.

How can we use this machine to evade the firewall?

• Establish a ssh tunnel between “home” and “apollo”.
• On the “home” end, the tunnel receives TCP packets from the telnet client.
• It forwards the TCP data to “apollo” end, from where the data is out in another TCP packet which is sent to machine “work”.
• The firewall can only see the traffic between “home” and “apollo” and not from “apollo” to “work”. Also ssh traffic is encrypted.

Local port forwarding 사용 -> Host A의 SSH 클라이언트는 사용자가 지정한 로컬 포트를 검사(Listen)

Application client가 이 포트로 접속 -> SSH 클라이언트는 이 데이터를 Host B에 있는 SSH 서버에 전송

-> 다시 SSH 서버가 application server로 전송하는 것을 보여줌

• Establish an ssh tunnel from “home” to “apollo”. This tunnel will forward TCP data received on 8000 on “home” to port 23 on “work”
• After establishing the tunnel, telnet to the 8000, and the telnet traffic will be forwarded host work via the ssh tunnel.

Scenario

We are working in a company and working on a machine called“work”.

We would like to visit Facebook, but the company has blocked it to prevent employees from getting distracted.

We use an outside machine “home” tobypass such a firewall. How can we bypass it?

• establish an ssh tunnel from “work” to “home”.
• establishing the tunnel -> we can type “localhost:8000” in our browser.
• The tunnel will forward our HTTP requests to Facebook via home.
• The firewall can only see the ssh traffic between “work” and “home” and not the actual web traffic between “work” and “Facebook”.

Dynamic Port Forwarding

• This command establishes an ssh tunnel between localhost (port 9000) and the machine “home”. Here we do not specify the destination for the port forwarding.
• -> we configure the browser in such a way that all the requests should go through localhost:9000, treating it as a proxy.
• Dynamic port forwarding that we set up using ssh is a SOCKS proxy.
• the browser is configured -> we can type URL of any blocked site which will connect to ssh proxy at port 9000 on the localhost.
• ssh will send the TCP data over the tunnel to the machine “home” which will communicate with the blocked site.

Using VPN to Evade Firewall

• Using VPN, one can create a tunnel between a computer inside the network and another one outside.
  IP packets can be sent using this tunnel.
• the tunnel traffic is encrypted ->  firewalls are not able to see what is inside this tunnel and cannot conduct filtering.
• 해외 여행을 가서도 국내 게임 서버 이용
• 집에서도 회사 내의 서버에 보안 상태로 접근
• 원격의 두 지점을 내부 네트워크처럼 이용 (오버레이 네트워크)

 

---

Summary

• Firewall의 정의, 역할
• Firewall의 종류
  • 패킷필터링
  • Stateful firewall
  • Application proxy
  • Circuit-level proxy
• 위치에 따른 firewall
  • Bastion host(베스천 호스트)
  • Host-based firewall
  • Network Device Firewall
  • Virual Firewall
  • DMZ

• IDS/IPS/UTM
  
• Bypassing firewalls
  • ssh tunneling
  • VPN

---

https://youtu.be/ry8tWAL66zQ

https://youtu.be/J_hCWbO44To