© 2003 Avik Sengupta. All Rights Reserved. 1 Secure Firewalls using OpenBSD Avik Sengupta CTO...
-
Upload
virgil-ellis -
Category
Documents
-
view
213 -
download
0
Transcript of © 2003 Avik Sengupta. All Rights Reserved. 1 Secure Firewalls using OpenBSD Avik Sengupta CTO...
© 2003 Avik Sengupta. All Rights Reserved. 1
Secure Firewalls using OpenBSD
Avik SenguptaCTO
Itellix Software Solutions Pvt Ltd
© 2003 Avik Sengupta. All Rights Reserved. 2
Agenda
A gentle introduction to OpenBSDPacket Filter FeaturesNetwork Architecture for PF installationPacket Filter Example and SyntaxAdvanced Features
© 2003 Avik Sengupta. All Rights Reserved. 3
OpenBSD
Derived from 4.4 BSD Proactive security
Extensive source code auditsIntegrated cryptographyMinimalist default install
“Only one remote hole in the default install in 7 years!”Highly portable (i386,sparc,ppc,hppa ...etc..)Free, under a BSD Licence
© 2003 Avik Sengupta. All Rights Reserved. 4
Packet Filter (pf) Basics
Introduced in 2001 in OpenBSD 3.0Filter TCP/IP traffic and perform Network Address TranslationIntercept each IP packet, passing or blocking itStateless inspection, based on fields in each packetStatefull inspection, keeping track of connectionsPacket Normalisation
© 2003 Avik Sengupta. All Rights Reserved. 5
pf Rules
Evaluated from top to bottomRules contain parameters that match a packetRules pass or block a packetLast matching rule wins (except 'quick')Rules can create state
Represents an established connectionKeyed on 4-tuple: source{ip,port} and dest{ip,port}Further state matching packets are passed without rule evaluation
© 2003 Avik Sengupta. All Rights Reserved. 6
Example Network Topology
© 2003 Avik Sengupta. All Rights Reserved. 7
Lets make a firewall -I
Red="fxp0"
Green="rl1"
Amber="rl2"
NoRouteIPs="{127.0.0.0/8, 192.168.0.0/16}”
ExtIP="206.7.8.1"
PrivateIPs="192.168.2.0/24"
DMZIPs="192.168.1.0/24"
scrub in all
© 2003 Avik Sengupta. All Rights Reserved. 8
Lets make a firewall -II
nat on $Red from $InternalIPs to any -> $ExtIP
rdr on $Red proto tcp from any to $ExtIP port 80 -> 192.68.1.2 port 80
rdr on $Green proto tcp from any to $ExtIP port 80 -> 192.68.1.2 port 80
block drop in quick on $Red from $NoRouteIPs to any
block drop out quick on $Red from any to $NoRouteIPs
block in on $Red all
pass in on $Red from any to any port 80 flags S/SA keep state
© 2003 Avik Sengupta. All Rights Reserved. 9
Lets make a firewall -III
block in on $Green all
block out on $Green all
pass in on $Green from $PrivateIPs to any port {80,21,22,25,10000} flags S/SA modulate state
pass out on $Green from $DMZIPs to 192.168.2.10 port 389 keep state
pass out on $Green inet proto icmp from $PrivateIPs to any keep state
© 2003 Avik Sengupta. All Rights Reserved. 10
Lets make a firewall -IV
block in on $Amber all
block out on $Amber all
pass out on $Amber from any to $DMZIPs port 80 flags S/SA keep state
pass in on $Amber from $DMZIPs to $PrivateIPs keep state
pass out on $Amber inet proto tcp from $PrivateIPs to $DMZIPs port {ssh,10000} keep state
© 2003 Avik Sengupta. All Rights Reserved. 11
Managing the firewall
pf is a kernel moduleuserspace control via ioctl() on /dev/pfpfctl – userspace control/config utility
display loaded rulesreload rulesetsstatisticsmanipulate listsmanipulate state table
© 2003 Avik Sengupta. All Rights Reserved. 12
Advanced PF features
Queues and prioritisationRouting (eg. Using multiple uplinks)Anchors and Tables for dynamic ruleset changesIntegration with application level proxiesAll features work with Ipv6Logging (pcap/tcpdump compatible)
© 2003 Avik Sengupta. All Rights Reserved. 13
Thank You!
Resourcesman pf; man pf.conf; man pfctlhttp://www.benzedrine.cx/pf.htmlhttp://www.openbsd.org/faq/pf/index.html“Building Firewalls with OpenBSD and PF” by Jacek Artymiak (July 2003)This presentation:
http://www.sengupta.net/talks/