Worried about potential security gaps? Follow these seven steps to make sure your installation won’t melt under fire.

Set Up a Flame-Proof Firewall

Worried about potential security gaps? Follow these seven steps to make sure your installation won’t melt under fire.

I can still remember when most people thought a firewall was a special wall placed in a building to prevent the spread of fire. Now it’s just what the doctor ordered to protect your company from those heinous hacker homies, and sooner or later it’s going to be your job to put one into operation. Are you up to the job? Do you know how to install a flame-proof firewall? Here are seven sure-fire tips on how to set up a firewall right the first time.

1. Know Why You’re Installing the Firewall

Was this your choice? Been fighting for a firewall? Has it just become company policy? The consultants who brought in the Web site insisted on a firewall? Your boss handed you a box and said, “Here, go install this?” If you know what a firewall is and why you’re installing it, this can help dictate which features to choose during installation and configuration, and even where you place the firewall in your network. So that we’re on the same page, I define a firewall as a service that limits access between the Internet and a private network, between pairs or groups of private networks, or between sensitive and less-sensitive parts of private networks.

More than any other system you’ll configure, a firewall has only one purpose in life, and its purpose may seem to be opposite that availability/usability/ease-of-use credo you’ve had hammered into your head all this time. After all, by definition, a firewall blocks information flow. So ask the question, why are we installing this firewall? You don’t want to make it harder for people to get information, do you?

Time to wake up. Information flow has to be controlled like everything else. The peace, free love, and freedom of information banner just doesn’t fly well in corporate America. Just as we don’t want our precious laptops and automobiles to be “borrowed” by someone else, information in your company is critical to its survival. As rapidly as we expand the boundaries of information access to include our suppliers and customers, we must protect our private information (and theirs).

The Proxy Server Connection
Proxy services are applications that run on a firewall. User requests for Internet services such as FTP, telnet, and http are received and forwarded, according to security policy. Proxy servers, therefore, act as gateways and replace connections. The client doesn’t “talk” directly to the service. In fact, use of a proxy service is usually transparent to the user. Proxy services are implemented via software and thus should be used with a mechanism that physically prevents or restricts direct communication between internal and external systems. Examples of such mechanisms are a dual-homed host (a host with two network interfaces) and/or packet filtering. Proxy servers require proxy clients. Web browsers can be configured to act as proxy clients.

But again, why are you installing a firewall now? Are you setting up a perimeter defense for your corporate network? Creating a DMZ (demilitarized zone) where Web servers and other systems that need to be accessed by your business partners or customers can reside? Putting up a wall around sensitive areas of your company to assure only the select, authorized, vetted few can get in? Firewalls are often used for all these purposes. Knowing who’s supposed to get in, and who’s not, will help you properly configure the firewall, as well as monitor how well it’s performing.

Understanding the type of systems that sit on either side of the firewall helps you determine which ports to open or close. After all, not all access is determined by user ID. Understanding the way services and applications communicate machine-to-machine can help us control access. Most communication relies on connection to a standard port number (see “Consider These Weaknesses”). Block the wrong port and authorized work can’t continue; leave the wrong ones open and your firewall’s got holes large enough for dragons to fly through.

Take the time to ask:

  • What are you trying to protect against? Denial of service? Information theft? Intrusion?
  • Who’s likely to be attacking your systems? Vandals? Joyriders? Braggarts? Information spies? Inexperienced users doing stuff they shouldn’t?” (Stupidity is hardly an attack, but the results are the same.)

2. Read the Docs—Know All about Your Firewall

You know the old adage… if all else fails, read the documentation. But you can’t wait for all else to fail here. Fail to fasten your seat belt and hit a brick wall head on—it’s a little to late to read the instructions. Fail to configure your firewall correctly, and you may be open to an attack that can precipitate corporate meltdown. So grab those docs and a good cup of latte and head for a quiet place. All firewalls are not created equal. They don’t even work the same way. Knowing what your firewall is supposed to do, and how to make it do so, can give you the edge you need to set it up right the first time. Firewalls are complex and chances are you don’t set them up every day. Would you try to pilot a jet with your knowledge of driving an automobile?

I wish I had a quarter for every time someone has said to me he found the answer to the problem he spent hours trying to figure out in the documentation. The first firewall I installed had a printout of a sample configuration for very close to my exact needs. Although the documentation was a little unclear, the screenshots showed me how to enter appropriate information and made it easier to add additional features. If the documentation is unintelligible, get some help. Often the manufacturer has updated docs, FAQs, newer versions of utilities, forums, and direct support links on its site.

By the way, this isn’t the time to question anyone’s judgment in choosing this particular firewall. While this intense study of its features (or lack of them), ease of use, and the ability of its publisher to produce usable documentation may make you aware of its shortcomings and make you wish you or the powers that be had chosen another firewall, chances are you’re not going to get anywhere by grumbling. Put the system together, do the best with what you have, and document the need for other things to occur to make your system safe.

A good practice is to make a list of the things the firewall can do, such as blocking services, blocking systems, controlling who can transfer files across the firewall, and recording information about accesses and attempted access. This helps you with the next step.

3. Match Features of the Product to Your Company Security Policy

Your company security policy will tell you which features of the firewall you’ll need to implement—and let you know the things that the firewall can’t do. See No. 6. Don’t know what your corporate security policy is? Find out. Implementing a flame-proof firewall isn’t so hot if what the company really wants to do is to toast marshmallows. Typical implementations require you to:

  • Set up filters to block services. Does your company allow Internet Relay Chat (IRC)? Probably not. IRC servers can be used to access IRC client machine files, processes, and programs. Don’t let IRC users apply these features against the unsuspecting. Do you want ping, telnet, FTP , traceroute, or http services to enter your network? How about providing internal users use of these services across the Internet? Fortunately, firewalls are usually set up on the “least privilege” security principle and the “that which isn’t expressly permitted is prohibited” proverb—all ports are blocked. You don’t have to close down those with possible malicious use; you have to open those that you want to allow. Your security policy will tell you which ones to choose.
  • Insist that your company establish a security policy. Somebody got a great big dose of security awareness somewhere, or the money wouldn’t have been spent. Tell the powers-that-be that a policy is required for proper setup. If no one will write one, do it yourself. Having a written policy—title it, “This is how I’m going to configure the firewall”—starts the conversation. And, oh, get it approved. Can’t get it approved? Well, they did tell you to set up the firewall, didn’t they? You were going to have to make the choices anyway. Now you’re documenting what you did and allowing management to pass on it.
  • Monitor log activity. Once you know which logs are activated or able to be activated and what’s being logged, you can decide how much of this information is necessary to fulfill policy requirements. However, don’t forget another good use of logs: maintenance. You may want to start out logging more information than you think you need and reducing it if you don’t feel it adds anything to the picture. Once again, this may be part of your security policy.

4. Get the Advice of Peers; Take a Class; Hire an Expert

If you haven’t already joined security lists, now’s the time to do it. A good one is ntbugtraq (www.ntbugtraq.com). These lists provide you with an endless stream of inane chatter about risks and perceived risks of OSs and other products, including firewalls. You’re going to have to filter the information, but it does provide a ready source, and a place for you to ask specific information about your firewall and its perceived features, benefits, and holes.

Visit your vendor’s Web site for the latest information and for responses to security-list tirades and public media reviews. In our “new world,” vendors take a proactive approach and alert users to possible holes and fixes for their products. Visit other Web sites as well and see what holes, fixes, and features they offer. Remember, don’t bemoan your boss’ lack of sophistication for picking this product; instead find out how best to implement and use it to protect your network. A frying pan can knock out an intruder as efficiently as a can of mace; you just have to get a little closer.

Talk to your co-workers, talk to your friends. Attend a seminar, meeting, conference, or class. Talk to your fellow attendees; you may find that one of them has experience with this product too. Get the advice of peers, but be sure to follow the advice of experts.

At this point you’re in a great position to judge whether or not a class will help you. If a vendor or third-party instruction is available on your product, check it out. Since you’ve done your homework, you stand a better chance of finding one that fits. Ask for a curriculum outline and match it against your requirements. Don’t be afraid of extra topics. You’re the learner here, right? You’ll also be better prepared for class. You know the features you need to implement—if they aren’t covered, ask why. Many instructors can give additional help that’s not part of the official curriculum, but some may not. The time to ask is before you plunk down your money.

Should you hire an expert to install the system for you? It depends. You now should be in a better position to judge if this is necessary and/or advisable. After all, you need to manage the firewall when it’s up. Don’t isolate yourself from the initial installation and configuration process. If you feel you want to hire an expert, or if you’ve been told to do so, now you’ll be able to judge better the type of expert to get. Make sure that transfer of knowledge is required. You don’t want to have to call the expert back for every change you make. You also want to be able to monitor the system. Although it should be obvious by now that security policies may vary with the company and an external expert should ask you for this type of advice, some may not. Find out your so-called experts’ willingness to follow your rules before they’re hired.

Packet-Filtering Firewall vs. Screening Router
A packet-filtering system selectively routes packets between hosts in a way that implements a network’s security policy. A packet encapsulates data sent across a network. Each packet contains a set of headers with information necessary for its passage. Header information includes:
  • IP source address 
  • IP destination address
  • Protocol (TCP, UDP, ICMP)
  • TCP or UDP source
  • Destination port
  • ICMP message type

Routers also know the interface the packet arrived on and which interface the packet will go out on. A regular router looks at the destination address of each packet and picks the best way to get that packet to its destination. Either the router knows how to send the packet and thus sends it on or it doesn’t and returns it with a “destination unreachable” message.

A screening router examines the packet more thoroughly. It asks the question, “Should I send this packet on its way?” Since Internet services (http, telnet, ping, and so on) reside at standard port numbers, the router can be configured to block or allow Internet connections by specifying the port number. A screening router may be configured, for example, to block all connections from the Internet except SMTP. (You do want to receive email, don’t you?) Or you could configure it to block all connections from certain systems, or allow email and FTP, but block TFTP, RPC, IRC, and the like.

A screening router can’t be configured to let some operations of a service pass but block others. It’s an all-or-nothing approach.

5. Isolate, Install, Test

Ready to go for it? Don’t immediately set the firewall in its chosen place on the network. Even an attack dog needs to be tested for his response to your commands. Place the system in a test lab. Don’t have one? Make a temporary lab with minimum configuration, say, one client, the firewall, and the Internet access line. Keep the rest of the network out of the picture for now. Armed with your policy, notes, and extensive knowledge, install and configure the system.

Now test it. If it’s supposed to block external users from telnet access to internal hosts, come at it from outside and use the telnet command. If you can get to the internal host, you probably configured the system wrong. Find out why and correct it.

Do all users have unlimited access to the Internet? Create some typical user accounts, one with each type of access you’ve designed. Then log on as those users and test.

Not sure what services applications cutting across barriers need to use? Run them and test as well. You’ve got the idea now. You must intimately document each feature once again and develop test scenarios, then apply them. As you tweak your firewall configuration, retest using each test scenario once again. Check the firewall logs for information gathered and lessons learned.

When your system passes your rigorous testing, it’s time to move it to the real world. You may want to allow access a little at a time to make sure all applications, users, and services have access, but only the access they should have.

6. Monitor the Firewall and Network Access

Once you’re up and running, the rule is to monitor constantly. Don’t just monitor the firewall, monitor network access as well. Remember, a firewall is really just a perimeter defense. It can’t protect against all types of attack, and it’s not the only soldier in your arsenal. A firewall can’t protect your network from access that doesn’t go through its system. Many current attack exploits were carried out with social engineering and the use of viruses or Trojans—things that firewalls usually can’t examine packets to detect.

Firewall Architectures
  • Dual-homed host. A computer with at least two network interfaces. To use this architecture in a firewall implementation, routing between these interfaces is disabled. Therefore, packets from the Internet interface can’t be routed directly to the internal, private network. Systems on either network can communicate with the dual-homed host, but not with each other. When accessing either the external from the internal or vice-versa is necessary, proxy services are used.
  • Screened host or bastion host. This host sits on the internal network. Packet filtering at the screening router is set up to allow external hosts (Internet) to access the bastion host and no other systems on the internal network. The typical use of this system might be an email server. The bastion host is also allowed to make certain types of connections to the external world. Internal systems can connect directly to the bastion host.
  • Screened subnet or perimeter network. This architecture implements a perimeter network to isolate the internal network from the Internet. The bastion host can easily come under attack since it’s accessible from the Internet. Conquering the bastion host can mean wide-open access to your internal network. Thus, a screened subnet can provide further protection. A minimum of two screening routers are used to implement this solution—one router between the internal network and the perimeter network, the other between the perimeter network and the Internet.

7. Lather, Rinse, Repeat!

You’ve heard the joke about the programmer who was found dead in the shower? He had a bottle of shampoo with him and it said, “Lather, rinse, repeat.” As you should know by now, network defense never ends.

Consider These Weaknesses

Internet Service Description Port Exploit
SMTP Electronic mail 25 Mail spoofing, penetrating your network with mail exploits
FTP File transfer 20/21 Access to internal information, no strong authentication
NNTP Usenet news 119 Denial of service
telnet Remote terminal access 23 No authentication
http World Wide Web access 80 Access to improperly protected files
DNS Host name address lookup 53 Information about your internal network
Gopher Text-based, menu-oriented tools help users find information 70 Information
WAIS Wide area information service, allows multiple queries such as for documents that contain a phrase; www.ai.mit.edu/the-net/wais.html is a site that provides a WAIS gateway 210 Information
Archie Indexes of anonymous FTP servers for file and directory names, service via telnet and email, and Archie clients pp or Web browsers at http-Archie gateways; www.archie.emnet.co.uk/ 1525 Allowing access to Archie might allow access directly to NFS and mis/yp servers
Finger Looks up info about a user who has an account on the machine being queried: real name, login phone number, office location, when and where most recently logged in 79 Information
POP, POP2, POP3 Internet mail 109,110 Password in clear issues
whois Information about hosts, networks, domains, and administrators 43 Information
talk Two people to hold conversation 517 No authentication, so easy way to do social engineering
IRC IRC Internet relay chat; IRC user uses IRC client or telnet; IRC services many people at the same time 6667 Many servers means access to client files, processes, programs
MBONE Multicast backbone; expanding real-time conference services for audio, video, and electronic whiteboard; uses: Internet Engineering Task Force meetings, space shuttle flight operations Protocol number a, filter by this Can the tunnel be used as a backdoor?
Name services Used over TCP/IP to establish identity, locate a systems, and notify network that NetBIOS system has shut down 137,138 Find easily accessed hosts on system, learn what services are used on hosts
ICMP Internet control message Filter by message code Information source, denial of service attack
Ping Check if can reach host; uses ICMP   Verify there is such a host
Traceroute or tracert Sees route packet takes on way to destination; uses ICMP; find location, names of routers, SNMP; manages routers, bridges, concentrators, hubs, hosts   Find location, names of routers.
SNMP Manages routers, bridges, concentrators, hubs, hosts 161,162 Control these devices
Network Time Protocol NTP—important in synchronizing time, preventing playback attack; Kerberos depends on time synchronization 37 Lack of use of or spoofing the NTP could result in denial of service attacks
NFS Network file system 2049 Clients can read and change files stored on server without having to log in to the server or enter a password; also does log transactions
lpr and lp Print to printer   No reason to do this across the Internet; allows removal of information by printing it remotely from your servers

Once you install the firewall, you can’t rest. In fact, it’s not a bad idea to pull out this list periodically and make sure you’re still following these steps to a flame-proof firewall.

Featured

Most   Popular