Information system security wk6-2
1 like1,553 views
If you have question Message me!
Information system security wk6-2
- 1. IT346 Information System Security Week 6-2: Firewall (2) ¨C Firewall Rules ??.??.??????? ??????? Faculty of Information Technology Page 1
- 2. ????????????????????????? ???????????????????????????????? firewall ??? ??????????????????????? ??????????? (Network Security Policy) ????????? firewall ???? ????????????????? ????????????????????????????????????????????? ??????????????????? ????????????????????????????????????????? firewall ???????????? ACL (Access Control List) ???? Firewall Rule ?????????????? ACL ???? ??????????????? First Match ??? firewall ???????????????????????????????????????????????????? ???????? Faculty of Information Technology Page 2
- 3. ????????????? Firewall ?????????????????????????????????????????????????? ????????? ?????????????????????????????????????? ?????????? login ????????????????????????????????????????? ????????????? traffic ???????????????????????????????????????????????????? ????????????????????????????????????????????? ????????????????????????????????????????????????????????????? ? ???? ????????????????????????????????????????????????????? (???? ????? Web ? Server) ????????????????????????????????????????????????????????????????? ? ? ???????????? Faculty of Information Technology Page 3
- 4. ????????????? Firewall ?????????????????????????????????????????????????????????????? ??????????? ? ??????????????????????????????????????????????????????????????? ? ????????????????????????????????????????????????????????? (Network? based Security) ???????????????????????? (audit) ?????????????????????????????????? ??????????? ? Firewall ????????????????????????????????????????????? audit (???????????????????????????????????????) ?????????????????????????????????????????????????????????????????? ??????????????? HTTP, FTP ??? SMTP Faculty of Information Technology Page 4
- 5. ???????????? firewall Firewall ??????????????????????????????????????????? Firewall ? ????????????????????????????????????????????????????????????????????????? ?????????????????????????????????? ? ?????????????????????????????????????????????????????? Dial-up ???? ???????????????????????????????????????????????? ???????????????????????????????????? application protocols ????? (??????????? tunneling) ???? ?????????? client ???????????????? ????????????????????????????????? (??????????????????????? Trojan horse) Faculty of Information Technology Page 5
- 6. ???????????? firewall ???????????????? virus ????????????????????? ? ?????????????????????????????????????????????????????????????????????????? ? ? ??????????????????????????????????????? ? ? ?????? virus ??????????? ????????????????????? firewall ???????? ? ??????? pattern ??? virus ?????????? Faculty of Information Technology Page 6
- 7. ?????-????????????????????????? ????? ? ? ? ? ? ???????????????????????????????????? ? ????????????????????????????????????????????????????????????? ?????? VPN ????????? IPSec ?????????????????? ????????????? ???? ??????????? ???? IP address ??????????????? ???????????? ??????? ? ???????????????? ? ??????????????????????????? ? ???????????????????????????????????????? ? ? ? Faculty of Information Technology Page 7
- 8. Rules of Packet Filtering ???????????? Packet Filtering ??????????????????????????????? ????????? packet ???????????????? ??????? Access Control List (ACL) ACL ?????????????????????????????? ???? ??????? (traffic) ????????? ?????? (permit) ?????????? ???? ????????? (deny) ?????????????????????? Faculty of Information Technology Page 8
- 9. ??????????? ACL ????????? ??????????????? Access Control Entry (ACE) ?????????????????????? ?????? ACL ????????????????? ???? ACL ?????????????????????????????????????????????????? ??????? ???????? implicit deny all ??????? ????????? ??????????????????????????? ??????????? ??????????? ?????????????????? ????????? (deny/block) ?? ???????????????????????????????????? Faculty of Information Technology Page 9
- 10. ??????????? ACL ????????? ACL ???????????????????????????????????? ?????????? ?????????? ??????????????????????????????????????????????????????????????????????? ???????????????????????? Firewall (???????????????????????????????) ??????? action ?????????????? allow (permit) ???? block (deny) ? ??????? allow ????????????????????????? (traffic) ????????????????? ? ?????????? block ?????? (traffic) ??????????????? (drop) ?? ? Faculty of Information Technology Page 10
- 11. ???????? Firewall Rules Source Destination Protocol Action Address Port Address Port * * 119.46.85.5 * * Block * * 192.168.10.1 22 TCP Allow 192.168.*.* * * 22 TCP Allow * * * 80 TCP Allow * * * 80 UDP Allow * * * * * Block Faculty of Information Technology Page 11
- 12. ???????? Firewall Rules ???????????? host ??? ?????????????? IP Address 119.46.85.5 ???????????? port ??? ???? protocol ??? ? ???? ????? 119.46.85.5 ???? host ??????? ????????? host ??? ?????????????? IP Address 192.168.10.1 ???? port 22 ???? TCP protocol ??? ? ???? ????? 192.168.10.1 ???? Server ?????? ???????????? SSH (port 22) ????????? host ???????? ?????????????? IP Address ??? ???? port 22 ???? TCP protocol ??? ? ??????????????????????? Server ??????????????????? SSH ?????????????????????? port 80 (HTTP) ??????? TCP ??? UDP protocol ???????????????????????????? ???????????? ACL Faculty of Information Technology Page 12
- 13. ???????? Packet Filtering Rules Source Src Port Destination Dest Port Action Comment 75.13.126.11 * 75.13.126.11 * Block ?????????? server ??? ? * * 192.168.1.1 25 Allow Connection ????? SMTP ?????? Packets ????????????????? 75.13.126.11 ??? blocked ???????????????????????????????????? ???????????? inbound email (port 25 = SMTP incoming) ?????????????????? ???????????? gateway 192.168.1.1 ??????????? Source Src Port Destination Dest Port Flag Action Comment * * * * * Block Default ????????? default policy ??????????????????????????????????? ???????? ??? Block ??????????????? ??????????????????????????? Faculty of Information Technology Page 13
- 14. ???????? Packet Filtering Rules Source Src Port Destination Dest Port 192.168.*.* * * * * * * * * * * >1024 Flag Comment Allow ACK Actio n ????????????????? Allow ???????????????????????? Allow Traffic ?????????????????????? Server ?????????? TCP connection ???????????????? ??????????? Flag ACK ??????????????? ?????????????????????? FTP connections FTP ????????????????????????? TCP 2 ???????????????????????????: ? control connection ???????? setup ???????????????? ? data connection ????????????????? Data connection ??? port ??????????????????? Server ??????????? port ??????????? ?????????????? ? Traffic ????????? client ????? ????????????????????????????????? ? ? Traffic ????????? ????????????????????????? (ACK) ?????????????????????????? ? Traffic ????????? ??????????????????????????? client ????????????????? port ??????????? Faculty of Information Technology Page 14
- 15. ??????? 1: ????????? Firewall Rules ???????? 2 ¨C 3 ?? ??????? Firewall Rules ???????????? ??????????????????? ¨C ????????? ??? Firewall Rules ???????? Faculty of Information Technology Page 15
- 16. ??????? 1: ????????? Firewall Rules Source Src Port Destination Dest Port * * * 25 Flag Action Comment Allow Connection ????? SMTP ?????? SMTP (Simple Mail Transfer Protocol) ??? Port 25 ???? port default ????????????????????????? SMTP ???????????????????????? ?????????????????????????????????????????????? SMTP ????????? ????????????????? Firewall Rules ??????????????? ???????? ??????????????? Firewall Rules ???????????????????????? Faculty of Information Technology Page 16
- 17. ???? ????????? firewall ??????????????????????????????????????????????????? ?????????????????? ?????????????????? ??????????? firewall ?????? ?????????????????????????????????????????????????????????????? ? ???? ?????? firewall ????????????????????????????????????????????????????????? ???????????????? ????????????????????????????????????????????? Faculty of Information Technology Page 17
- 18. Network Address Translation (NAT) NAT ?????????????????? firewall ??? firewall ?????????????????????? ???????????????????? NAT ?????????????????????????????????????????????????????????????? ????????????? Faculty of Information Technology Page 18
- 19. Network Address Translation (NAT) ???????????????? NAT ?????????????????????????????? Stateful Inspection Firewall ????????????????????? ? Firewall ???????????????????????????????????????????????????? ? ????? NAT gateway ??????????????????????????????????????? Private IP (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/24) ???????????????????? ???????????? NAT ?????????????????????????? source address, source port, destination address, destination port ??????????? NAT ????????? source address ?????????????? IP address ??????? firewall ???????????? Faculty of Information Technology Page 19
- 20. Network Address Translation (NAT) 2: NAT router ??????? source address ??? datagram ??? 10.0.0.1, 3345 ???? 138.76.29.7 ????? 5001, ??????????? NAT table 2 WAN side address LAN side address 138.76.29.7, 5001 10.0.0.1, 3345 ¡¡ ¡¡ S: 10.0.0.1, 3345 D: 128.119.40.186, 80 10.0.0.1 S: 138.76.29.7, 5001 D: 128.119.40.186, 80 138.76.29.7 S: 128.119.40.186, 80 D: 138.76.29.7, 5001 3 3: Reply ????????? destination address: 138.76.29.7 ????? 5001 Faculty of Information Technology 1: host 10.0.0.1 ??? datagram ????? 128.119.40.186, 80 NAT translation table 1 10.0.0.4 S: 128.119.40.186, 80 D: 10.0.0.1, 3345 10.0.0.2 4 4: NAT router ??????? destination address ??? datagram ??? 138.76.29.7 ????? 5001 ???? 10.0.0.1 ????? 3345 10.0.0.3 Page 20