<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from url=(0032)http://www.unix.gr/fwdesign.html -->
<HTML><HEAD><TITLE>Firewall Design White Paper</TITLE>
<META content="text/html; charset=windows-1253" http-equiv=Content-Type>
<META content="MSHTML 5.00.2614.3500" name=GENERATOR></HEAD>
<BODY>
<CENTER>
<H3>Firewall Design White Paper</H3></CENTER>
<CENTER>
<H3>Or a Heretics View of Access Nexuses.</H3></CENTER>
<DIV align=right><B>By Angelos Karageorgiou</B></DIV>
<P align=justify>First of all let's define what a firewall is but a bit
differently. Here I will digress a bit from the commonly accepted wisdom, and
will define a firewall as an <B>access nexus</B> in the digital communication
infrastructure of any organization. That is you build a firewall not only to
protect your internal data but to also be able to overall enhance your
communication abilities. This paper here is not a set of instructions of how to
built an access nexus it is more like a white paper of things you should expect
from such a device and be able to ask for them from you vendor. Please do tell
them that they are currently availlable on Open Source Servers.
<P align=justify>Let us take a case study of a Linux box, substiture for your
favorite Unix like OS here, serving as an access nexus. You are all familiar
with the three-fold implementation of networks, Public, Private and DMZ so I
will not bore you any further with silly graphics. We also have to take into
account that most people are using a router , let's say a Cisco, as an access
point to the internet. Our router has the ability of having access lists builit
in, so why do we still need a firewall to protect some of the machines and not
others ? <BR>
<UL>
<LI><B>Extra Security</B>
<UL>
<LI>
<P align=justify>The router does have its access lists but you can have
another set of more specific lists using <A
href="http://www.unix.gr/www.linuxdoc.org/HOWTO/IPCHAINS-HOWTO.html">IPCHAINS</A>
or <A href="http://www.unix.gr/netfilter.kernelnotes.org/">IPTABLES</A> to
further control access to your resources. Furthermore networks tend to
exhibit growth patterns akin to two line programs. Once you plug in a second
router your access lists on the first router are of little use, so it is a
very good idea to redo all the access rules on the firewall too. As for the
strictures of the list keep a balance. Too tight and you make life hard for
your users, too loose and you lose. </P></LI></UL><BR>
<LI><B>Easier routing</B>
<UL>
<LI>
<P align=justify>With more than one routers you only need to add routing
entries on the firewall itself and nowhere else your lan clients will never
know fo the complexity of the outside world, and they should not really
care. </P></LI></UL><BR>
<LI><B>NAT and limits</B>
<UL>
<LI>
<P align=justify>First and foremost, a firewall will be able to do Network
Address Translation (NAT) therefore you can plug as many machines as you
need on the net behind it. Then we have the DMZ on another card on the
firewall. All hosts on the DMZ have 2 network cards to allow them to talk
directly to the private net. And of course there is the <A
href="http://www.socks5.nec.com/">SOCKS</A> protocol from NEC for even more
strangeness in the applications. </P></LI></UL><BR>
<LI><B>Intrusion Detection</B>
<UL>
<LI>
<P align=justify>But we are still passing all the internet traffic for them
through the firewall for a very simple reason: Intrusion Detection. No
matter how powerfull a Cisco is , it still cannot beat <A
href="http://www.snort.org/">SNORT</A> in detecting network abuses. There
are s slew of tools to do analysis of snort alerts and of course my favorite
one is <A href="http://www.unix.gr/firesoft/snortlog2.pl">snortlog</A>.
</P></LI></UL><BR>
<LI><B>RSVP</B>
<UL>
<LI>
<P align=justify>Now how do I manage the bandwith that my DMZ uses ? Suppose
that bandwidth is expensive, which it is in most parts of the world, with a
Linux box and CBQ one can immediately have a very finely tuned traffic
management system with no cost and little effort. Just look for the <A
href="ftp://ftp.equinox.gu.net/pub/linux/cbq/cbq.init">cbqinit</A> script !
</P></LI></UL><BR>
<LI><B>VPN</B>
<UL>
<LI>
<P align=justify>There is too much talk about VPNs , there are fine products
like SWAN which allow network to network secure connections. But let's make
it simpler suppose that you have geographically dispersed users who need
access to some resources on your net. Fire up <A
href="http://poptop.lineo.com/">PoPtoP</A> and you can have these people
access the resources you want them to have. As a note of good design use a
different subnet in the IP address allocation scheme for PPTPD connections
so you can finetune your IPCHAINS access rules ( see above notes). Also
enable wtmp logging for PPPD or else you will never know which user
connected when. </P></LI></UL><BR>
<LI><B>Usage Monitoring</B>
<UL>
<LI>
<P align=justify>Traffic graphers like <A
href="http://ee-staff.ethz.ch/~oetiker/webtools/mrtg/mrtg.html">MRTG</A> <A
href="http://www.comlink.apc.org/~moritz/ipac.html">IPAC</A> are wonderful
tools that can give you graphs of the utilization of the network cards on
your firewall and router. This way you can see patterns of utilization and
make your predictions and purchases accordingly. Very simply it is a
measurement tool for data, and as any scientist will tell you, there is
nothing you can do without measurements. Also tools like <A
href="http://anteater.drzoom.ch/">ANTEATER</A>, <A
href="http://www.unimelb.edu.au/pwebstats/">PWEBSTATS</A> and <A
href="http://www.mrunix.net/webalizer/">WEBALIZER</A> will give you a set of
statistics that will help you understand the <B>character</B> of your lan
and the <B>habits</B> of your users. </P></LI></UL><BR>
<LI><B>Traffic Monitoring</B>
<UL>
<LI>
<P align=justify>Suppose now that you have a pesky little networking
application that you need to debug. Tools like <A
href="htrtp://www.unix.gr/firesoft/trafshow-angelos.tar.gz">TRAFSHOW</A>
will enable you to link it in no time at all. Many thanks to the original
author of this applicaiton. </P></LI></UL><BR>
<LI><B>Traffic logging</B>
<UL>
<LI>
<P align=justify>OK your network is fine, but what does it do when you are
not there ? Enter <A href="http://www.ntop.org/">NTOP</A> an exceptional
piece of software that logs almost everything, and even more , of the
traffic that passes through your system. I do have a gripe with NTOP though
, it sets the interfaces into PROMISCUOUS mode by default and starts all the
alarms ringing, you might want to fiddle with the source at the
pcap_open_live function and switch 1 to 0 </P></LI></UL><BR>
<LI><B>Economy</B>
<UL>
<LI>
<P align=justify>Smart Utilization of badwidth means that you must use a
cache server like <A href="http://www.squid-cache.org/">SQUID</A> or even <A
href="http://www.apache.org/">APACHE's</A> built it caching mechanism to
decrease the latency of web pages received by uor users. As I stated before
the target is the enhanced digital communication or communion if you prefer.
</P></LI></UL><BR>
<LI><B>Economy revisited</B>
<UL>
<LI>
<P align=justify>How much do all these wonderfull things cost ? Nothing you
have the source you can tinker and toy and make things work and be happy.
Compare this with commercial grade appliances and software, sure they will
be better, but how much better? Do you really get your money's worth for the
cash you hand out ? </P></LI></UL><BR>
<LI><B>Secure Remote Management</B>
<UL>
<LI>
<P align=justify>Too much has been said about it , and too many bytes
wasted. The bottom line is that <A
href="http://www.openssh.org/">OPENSSH</A> rules and <A
href="http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html">PUTTY</A>
rules also. You can administer this box from anywhere in the world and still
be more or less secure since the data stream is encrypted. Better yet if you
want to delegate administration to another user, install <A
href="http://www.openssl.org/">OPENSSL</A> and <A
href="http://www.webmin.com/webmin/">WEBMIN</A> and give these people a
graphical front - end that <U>enhances their experience</U> :-)
</P></LI></UL><BR>
<LI><B>Standard Services</B>
<UL>
<LI>
<P align=justify>Last but not least there are all these standard UNIX
services like EMAIL, DNS, FAX and yes email retrieval can be secured by
using an SSL WRAPPER. </P></LI></UL></LI></UL>
<UL></UL><BR><BR><B>Colophon:</B>
<P align=justify>I will forego all rhetoric on the open source model and make
some engineering remarks. You need a firewall/access nexus so that you can
manage access to resources and data traffic. You must pass <U><FONT
color=#ff6666>ALL</FONT></U> your traffic through your access nexus so that you
can know what goes where and does what. An access nexus should be as flexible as
a swiss army knife, as maleable as puty and as resilient as a network engineer
with a collapsed transatlantic backbone line :-) <BR><BR><BR></P></BODY></HTML>