Firewall - Revision history

Pbug: etherreal -> wireshark

2012-12-09T11:01:21Z

etherreal -> wireshark

← Older revision		Revision as of 04:01, 9 December 2012
Line 3:		Line 3:
	Our recommended process for installing a firewall is to have a "default deny" stance. This means "block all in" and block all out" by default. Once that has been established, then only allow rules as required.		Our recommended process for installing a firewall is to have a "default deny" stance. This means "block all in" and block all out" by default. Once that has been established, then only allow rules as required.

	For example, if you have blocked all by default, first you will want to try to resolve [[DNS]] I'm sure. So you will need to start a packet sniffer ([[tcpdump]], [[~~ethereal~~]], [[snoop]]) and watch the packets trying to leave and come in. In another window, type "host hackepedia.org" to try and resolve this DNS. As you should see, you need to allow [[ports\|port]] 53.. but was that [[TCP]] or [[UDP]]? You not only want to only allow that port, you may as well include the protocol as well. Once you have modified your firewall ruleset so that "host hackepedia.org" actually resolves and returns an IP address, try to use your browser to get there. As you will see, now you need to create a TCP rule for outbound port 80. Repeat this process as needed for each service, and eventually you'll have a very decent firewall.		For example, if you have blocked all by default, first you will want to try to resolve [[DNS]] I'm sure. So you will need to start a packet sniffer ([[tcpdump]], [[wireshark]], [[snoop]]) and watch the packets trying to leave and come in. In another window, type "host hackepedia.org" to try and resolve this DNS. As you should see, you need to allow [[ports\|port]] 53.. but was that [[TCP]] or [[UDP]]? You not only want to only allow that port, you may as well include the protocol as well. Once you have modified your firewall ruleset so that "host hackepedia.org" actually resolves and returns an IP address, try to use your browser to get there. As you will see, now you need to create a TCP rule for outbound port 80. Repeat this process as needed for each service, and eventually you'll have a very decent firewall.

	Of course, this is time consuming, and error prone, especially for someone who is just starting. A better solution may be to find a ruleset, or script online, and modify it until it works and fits your specific requirements.		Of course, this is time consuming, and error prone, especially for someone who is just starting. A better solution may be to find a ruleset, or script online, and modify it until it works and fits your specific requirements.

Pbug: /* Firewalls for UNIX */ forgot link

2012-12-09T10:40:38Z

Firewalls for UNIX: forgot link

← Older revision		Revision as of 03:40, 9 December 2012
Line 13:		Line 13:
	=== Firewalls for UNIX ===		=== Firewalls for UNIX ===

	; [[pf]] : A stateful firewall written by Daniel Hartmeier for [[OpenBSD]]. Has been ported to all [[BSD]]'s. pf has a nice logging mechanism that one can view with [[tcpdump]]. This firewall can share states between other firewalls meaning communication can continue if the path of communication changes through another firewall. This firewall has built-in [[NAT]]. Apple Mac OS X has started using pf with Mountain Lion.		; [[pf]] : A stateful firewall written by Daniel Hartmeier for [[OpenBSD]]. Has been ported to all [[BSD]]'s. pf has a nice logging mechanism that one can view with [[tcpdump]]. This firewall can share states between other firewalls meaning communication can continue if the path of communication changes through another firewall. This firewall has built-in [[NAT]]. Apple [[Mac OS X]] has started using pf with Mountain Lion.

	; [[npf]] : A stateful firewall in NetBSD. According to the manpage it will be released for NetBSD 6.0.		; [[npf]] : A stateful firewall in NetBSD. According to the manpage it will be released for NetBSD 6.0.

Pbug: /* Firewalls for UNIX */ apple mac os x for pf

2012-12-09T10:39:54Z

Firewalls for UNIX: apple mac os x for pf

← Older revision		Revision as of 03:39, 9 December 2012
Line 13:		Line 13:
	=== Firewalls for UNIX ===		=== Firewalls for UNIX ===

	; [[pf]] : A stateful firewall written by Daniel Hartmeier for [[OpenBSD]]. Has been ported to all [[BSD]]'s. pf has a nice logging mechanism that one can view with [[tcpdump]]. This firewall can share states between other firewalls meaning communication can continue if the path of communication changes through another firewall. This firewall has built-in [[NAT]].		; [[pf]] : A stateful firewall written by Daniel Hartmeier for [[OpenBSD]]. Has been ported to all [[BSD]]'s. pf has a nice logging mechanism that one can view with [[tcpdump]]. This firewall can share states between other firewalls meaning communication can continue if the path of communication changes through another firewall. This firewall has built-in [[NAT]]. Apple Mac OS X has started using pf with Mountain Lion.

	; [[npf]] : A stateful firewall in NetBSD. According to the manpage it will be released for NetBSD 6.0.		; [[npf]] : A stateful firewall in NetBSD. According to the manpage it will be released for NetBSD 6.0.

Pbug: /* Firewalls for UNIX */ better formatting

2011-08-16T18:52:56Z

Firewalls for UNIX: better formatting

← Older revision		Revision as of 11:52, 16 August 2011
Line 15:		Line 15:
	; [[pf]] : A stateful firewall written by Daniel Hartmeier for [[OpenBSD]]. Has been ported to all [[BSD]]'s. pf has a nice logging mechanism that one can view with [[tcpdump]]. This firewall can share states between other firewalls meaning communication can continue if the path of communication changes through another firewall. This firewall has built-in [[NAT]].		; [[pf]] : A stateful firewall written by Daniel Hartmeier for [[OpenBSD]]. Has been ported to all [[BSD]]'s. pf has a nice logging mechanism that one can view with [[tcpdump]]. This firewall can share states between other firewalls meaning communication can continue if the path of communication changes through another firewall. This firewall has built-in [[NAT]].

	; [[npf]] : A stateful firewall in NetBSD. According to the		; [[npf]] : A stateful firewall in NetBSD. According to the manpage it will be released for NetBSD 6.0.
	manpage it will be released for NetBSD 6.0.

Pbug: /* Firewalls for UNIX */ npf

2011-08-16T18:52:15Z

Firewalls for UNIX: npf

← Older revision		Revision as of 11:52, 16 August 2011
Line 14:		Line 14:

	; [[pf]] : A stateful firewall written by Daniel Hartmeier for [[OpenBSD]]. Has been ported to all [[BSD]]'s. pf has a nice logging mechanism that one can view with [[tcpdump]]. This firewall can share states between other firewalls meaning communication can continue if the path of communication changes through another firewall. This firewall has built-in [[NAT]].		; [[pf]] : A stateful firewall written by Daniel Hartmeier for [[OpenBSD]]. Has been ported to all [[BSD]]'s. pf has a nice logging mechanism that one can view with [[tcpdump]]. This firewall can share states between other firewalls meaning communication can continue if the path of communication changes through another firewall. This firewall has built-in [[NAT]].

			; [[npf]] : A stateful firewall in NetBSD. According to the
			manpage it will be released for NetBSD 6.0.


	; [[ipfw]] : IP Firewall available in [[FreeBSD]] and Apple [[Mac OS X]]. Much work done from Luigi Rizzo. States were introduced with the second version of ipfw. [[NAT]] can be achieved with IPDIVERT [[socket]]s with programs such as [[natd]].		; [[ipfw]] : IP Firewall available in [[FreeBSD]] and Apple [[Mac OS X]]. Much work done from Luigi Rizzo. States were introduced with the second version of ipfw. [[NAT]] can be achieved with IPDIVERT [[socket]]s with programs such as [[natd]].
Line 24:		Line 28:

	; Cisco PIX : More expensive commercial hardware/software solution from Cisco. Runs on a dedicated box, using a highly specialized UNIX variant as the OS. Supports most (all?) major firewall features.		; Cisco PIX : More expensive commercial hardware/software solution from Cisco. Runs on a dedicated box, using a highly specialized UNIX variant as the OS. Supports most (all?) major firewall features.


	=== Home Firewall ===		=== Home Firewall ===

84.170.164.148: Home Firewalls / Lanner

2011-01-04T19:02:52Z

Home Firewalls / Lanner

← Older revision		Revision as of 12:02, 4 January 2011
Line 24:		Line 24:

	; Cisco PIX : More expensive commercial hardware/software solution from Cisco. Runs on a dedicated box, using a highly specialized UNIX variant as the OS. Supports most (all?) major firewall features.		; Cisco PIX : More expensive commercial hardware/software solution from Cisco. Runs on a dedicated box, using a highly specialized UNIX variant as the OS. Supports most (all?) major firewall features.


			=== Home Firewall ===

			Brands such as Soekris, Alix and Lanner are pretty popular in geek circles. They are small, energy efficient boxes with 2 or more ethernet ports so that they can act like a firewall. They run open source and proprietary operating systems.

			Here is a picture of a Lanner firewall/router.

			[[File:lanner1.jpg]]

			You can surely also run a firewall in a PC or laptop but it's not as dedicated as these.

	=== Firewalls for Windows ===		=== Firewalls for Windows ===

	[[Windows#Firewalls]]		[[Windows#Firewalls]]

Franks: /* Firewalls for UNIX */ spell check

2008-05-28T07:54:22Z

Firewalls for UNIX: spell check

← Older revision		Revision as of 00:54, 28 May 2008
Line 19:		Line 19:
	; [[ipf]] : IP Filter is available in a number of [[UBO]]s. Written by Darren Reed. Stateful, has built-in [[NAT]].		; [[ipf]] : IP Filter is available in a number of [[UBO]]s. Written by Darren Reed. Stateful, has built-in [[NAT]].

	; [[netfilter]] / [[iptables]] : The standard firewall software that comes with the [[Linux]] Operating System. Stateful has built-in [[NAT]]. Has a huge number of specialized filters ranging from statistical matching ("30% of all tcp packets"), to ~~patcket~~ burst management, to raw content checking.		; [[netfilter]] / [[iptables]] : The standard firewall software that comes with the [[Linux]] Operating System. Stateful has built-in [[NAT]]. Has a huge number of specialized filters ranging from statistical matching ("30% of all tcp packets"), to packet burst management, to raw content checking.

	; Checkpoint : Expensive commercial firewall runs on Solaris. Written in Israel. Could have been the first stateful firewall, patented. Has [[NAT]].		; Checkpoint : Expensive commercial firewall runs on Solaris. Written in Israel. Could have been the first stateful firewall, patented. Has [[NAT]].

	; Cisco PIX : More expensive ~~commerical~~ hardware/software solution from Cisco. Runs on a dedicated box, using a highly specialized UNIX variant as the OS. Supports most (all?) major firewall features.		; Cisco PIX : More expensive commercial hardware/software solution from Cisco. Runs on a dedicated box, using a highly specialized UNIX variant as the OS. Supports most (all?) major firewall features.

	=== Firewalls for Windows ===		=== Firewalls for Windows ===

	[[Windows#Firewalls]]		[[Windows#Firewalls]]

Pbug at 19:19, 24 May 2008

2008-05-24T19:19:21Z

← Older revision		Revision as of 12:19, 24 May 2008
Line 1:		Line 1:
	A Firewall is part of an Operating System's networking stack that allows one to create policies for network traffic, and permit or deny that traffic accordingly. Firewalls most commonly work on [[OSI]] layers 3 and 4, although any layer except 1 is possible. Commercial firewalls often inspect higher layers than 3 and 4, for example SMTP content ([[RFC]] 2821 and 2822). Firewalls cannot inspect encrypted protocols (see [[cryptography]]) unless they have been given the secret key. Firewalls can run either on a specific host, or on a dedicated system that sits between the production systems and the rest of the Internet.		A Firewall is part of an Operating System's [[internet stack\|networking stack]] that allows one to create policies for network traffic, and permit or deny that traffic accordingly. Firewalls most commonly work on [[OSI]] layers 3 and 4, although any layer except 1 is possible. Commercial firewalls often inspect higher layers than 3 and 4, for example SMTP content ([[RFC]] 2821 and 2822). Firewalls cannot inspect encrypted protocols (see [[cryptography]]) unless they have been given the secret key. Firewalls can run either on a specific host, or on a dedicated system that sits between the production systems and the rest of the Internet.

	Our recommended process for installing a firewall is to have a "default deny" stance. This means "block all in" and block all out" by default. Once that has been established, then only allow rules as required.		Our recommended process for installing a firewall is to have a "default deny" stance. This means "block all in" and block all out" by default. Once that has been established, then only allow rules as required.

Franks at 00:01, 8 January 2007

2007-01-08T00:01:00Z

← Older revision		Revision as of 17:01, 7 January 2007
Line 27:		Line 27:
	=== Firewalls for Windows ===		=== Firewalls for Windows ===

	~~A common free firewall for Windows that blocks all of your~~ [[~~ports~~]] ~~is [http://www.zonealarm.com zone alarm]. Checkpoint Firewall also works on Windows.~~		[[Windows#Firewalls]]

Franks at 07:58, 19 October 2006

2006-10-19T07:58:45Z

← Older revision		Revision as of 00:58, 19 October 2006
Line 3:		Line 3:
	Our recommended process for installing a firewall is to have a "default deny" stance. This means "block all in" and block all out" by default. Once that has been established, then only allow rules as required.		Our recommended process for installing a firewall is to have a "default deny" stance. This means "block all in" and block all out" by default. Once that has been established, then only allow rules as required.

	For example, if you have blocked all by default, first you will want to try to resolve [[DNS]] I'm sure. So you will need to start a packet sniffer ([[tcpdump]], [[ethereal]], [[snoop]]) and watch the packets trying to leave and come in. In another window, type "host ~~yashy~~.~~com~~" to try and resolve my DNS. As you should see, you need to allow [[ports\|port]] 53.. but was that [[TCP]] or [[UDP]]? You not only want to only allow that port, you may as well include the protocol as well. Once you have modified your firewall ruleset so that "host ~~yashy~~.~~com~~" actually resolves and returns an IP address, try to use your browser to get there. As you will see, now you need to create a TCP rule for outbound port 80. Repeat this process as needed for each service, and eventually you'll have a very decent firewall.		For example, if you have blocked all by default, first you will want to try to resolve [[DNS]] I'm sure. So you will need to start a packet sniffer ([[tcpdump]], [[ethereal]], [[snoop]]) and watch the packets trying to leave and come in. In another window, type "host hackepedia.org" to try and resolve this DNS. As you should see, you need to allow [[ports\|port]] 53.. but was that [[TCP]] or [[UDP]]? You not only want to only allow that port, you may as well include the protocol as well. Once you have modified your firewall ruleset so that "host hackepedia.org" actually resolves and returns an IP address, try to use your browser to get there. As you will see, now you need to create a TCP rule for outbound port 80. Repeat this process as needed for each service, and eventually you'll have a very decent firewall.

	Of course, this is time consuming, and error prone, especially for someone who is just starting. A better solution may be to find a ruleset, or script online, and modify it until it works and fits your specific requirements.		Of course, this is time consuming, and error prone, especially for someone who is just starting. A better solution may be to find a ruleset, or script online, and modify it until it works and fits your specific requirements.