FIREWALL TECHNOLOGIES AND APPLICATIONS
TABLE INTRODUCTION ABOUT THIS BOOK HOW TO USE THIS BOOK WHAT YOU DON’T NEED TO READ FOOLISH ASSUMPTIONS HOW THIS BOOK IS ORGANIZED PART I: INTRODUCING FIREWALL BASICS PART II: ESTABLISHING RULES PART III: DESIGNING NETWORK CONFIGURATIONS PART IV: DEPLOYING SOLUTIONS USING FIREWALL PRODUCTS PART V: THE PART OF TENS ICONS USED IN THIS BOOK WHERE TO GO FROM HERE DEFINING A FIREWALL THE VALUE OF YOUR NETWORK GET YOURSELF CONNECTED MODEM DIAL-UP CONNECTIONS ISDN CONNECTIONS DSL CONNECTIONS CABLE MODEMS T1 AND T3 ADDRESS TYPES THE NEED FOR SPEED AND SECURITY TCP/IP BASICS WHAT FIREWALLS DO WHAT FIREWALLS LOOK LIKE A FIREWALL THAT FITS NETWORK ROUTER APPLIANCE SOFTWARE-ONLY FIREWALLS ALL-IN-ONE TOOLS RULES, RULES, EVERYWHERE RULES HOW SUITE IT IS: THE TCP/IP SUITE OF PROTOCOLS SIZING UP THE COMPETITION NETWORKING FOR THE COLD WAR: A VERY SHORT HISTORY OF TCP/IP PEELING AWAY THE PROTOCOL LAYERS THE NUMBERS GAME: ADDRESS BASICS URLS: HOW TO REFERENCE RESOURCES UNDERSTANDING IP ADDRESSES 1 AND 1 IS 10 WHAT IP ADDRESSES MEAN PRIVATE IP ADDRESSES DISSECTING NETWORK TRAFFIC: THE ANATOMY OF AN IP PACKET SOURCE ADDRESS DESTINATION ADDRESS TRANSPORT LAYER PROTOCOL OTHER STUFF THE OTHER INTERNET LAYER PROTOCOL: ICMP TRANSPORT LAYER PROTOCOLS STAYING CONNECTED: UDP AND TCP PORTS ARE NOT ONLY FOR SAILORS SOME PORTS ARE WELL KNOWN APPLICATION LAYER PROTOCOLS HTTP SMTP POP3 DNS TELNET COMPLEX PROTOCOLS FTP FUTURE PROTOCOLS THE KEEPER OF THE PROTOCOLS PUTTING IT ALL TOGETHER: HOW A REQUEST IS PROCESSED WHAT FIREWALLS DO (AND WHERE’S THE FIRE, ANYWAY?) BASIC FUNCTIONS OF A FIREWALL WHAT A FIREWALL CAN’T DO GENERAL STRATEGY: ALLOW-ALL OR DENY-ALL PACKET FILTERING FILTERING IP DATA STATEFUL PACKET FILTERING NETWORK ADDRESS TRANSLATION (NAT) SECURITY ASPECTS OF NAT CONSEQUENCES OF NAT APPLICATION PROXY MONITORING AND LOGGING MAKING INTERNAL SERVERS AVAILABLE: STATIC ADDRESS MAPPING STATIC IP ADDRESS ASSIGNMENT STATIC INBOUND TRANSLATION FILTERING CONTENT AND MORE DETECTING INTRUSION DETECTING AN INTRUSION IN PROGRESS RESPONDING TO AN INTRUSION REACTING TO A SECURITY INCIDENT IMPROVING PERFORMANCE BY CACHING AND LOAD BALANCING CACHING WEB RESULTS UNITED WE STAND, DIVIDING THE LOAD USING ENCRYPTION TO PREVENT MODIFICATION OR INSPECTION ENCRYPTION AND FIREWALLS WHO ARE YOU: AUTHENTICATION PROTOCOLS THE S IN HTTPS IP AND SECURITY: IPSEC VIRTUAL PRIVATE NETWORKS (VPNS) INTRUSION ATTACKS: A STRANGER IN THE HOUSE DENIAL-OF-SERVICE ATTACKS WHEN EVERYONE IS OUT TO GET YOU: DISTRIBUTED DOS ATTACKS HOW HACKERS GET IN THE KEY IS UNDER THE MAT: INSECURE PASSWORDS DEFAULT CONFIGURATIONS BUGS BACK DOORS IT’S A ZOO: VIRUSES, WORMS, AND TROJAN HORSES WHO ARE YOU? MAN-IN-THE-MIDDLE ATTACKS IMPERSONATION EAVESDROPPING INSIDE JOBS OTHER TECHNIQUES CAN A FIREWALL REALLY PROTECT ME? ARE YOU SCARED YET? DEFINING AN INTERNET ACCEPTABLE USE POLICY DEFINING A SECURITY POLICY SETTING A SECURITY POLICY FOR STARTERS, SOME DEFAULT RULES ALLOWING WEB ACCESS CONFIGURING INBOUND FIREWALL RULES CONFIGURING OUTBOUND FIREWALL RULES FINDING INTERNET RESOURCES PROVIDING NAME RESOLUTION TO INTERNET-BASED CLIENTS PROVIDING INTERNET NAME RESOLUTION TO INTERNAL CLIENTS FILE TRANSFER PROTOCOL (FTP) MESSAGING AND CONFERENCING AMERICA ONLINE (AOL) MESSAGING MSN MESSENGER AND WINDOWS MESSENGER NETMEETING THIN CLIENT SOLUTIONS CITRIX METAFRAME WINDOWS TERMINAL SERVICES INTERNET CONTROL MESSAGE PROTOCOL (ICMP) RAIN, SLEET, SNOW, AND FIREWALLS: GETTING THE E-MAIL THROUGH ANSWERING THE RIGHT QUESTIONS ALLOWING ACCESS TO EXTERNAL MAIL SERVICES ALLOWING ACCESS TO INTERNAL MAIL SERVICES KNOCK, KNOCK: WHO GOES THERE? RADIUS FUNCTIONALITY CONFIGURING INBOUND RADIUS FIREWALL RULES IPSEC ENCRYPTION WHEN DOES IPSEC FAIL? WHAT WILL THE FUTURE BRING? CONFIGURING A FIREWALL TO PASS IPSEC DATA LET ME IN: TUNNELING THROUGH THE INTERNET SELECTING A TUNNELING PROTOCOL USING PPTP FIREWALL RULES USING L2TP/IPSEC FIREWALL RULES LIMITING ACCESS BY USERS: NOT ALL ARE CHOSEN FILTERING TYPES OF CONTENT FILTERING OTHER CONTENT PREVENTING ACCESS TO KNOWN “BAD” SITES IMPLEMENTING CONTENT RATING SETTING THE CLOCK: FILTERING ON DATE/TIME NO-BOX SOLUTION: ISP FIREWALL SERVICE SINGLE-BOX SOLUTION: DUAL-HOMED FIREWALL SCREENED HOST BYPASSING THE SCREENED HOST DEPLOYMENT SCENARIO ALLOWING INTERNAL NETWORK USERS TO ACCESS THE INTERNET LOOKING AT THE DEMILITARIZED ZONE: NO-MAN’S LAND EXAMING TYPICAL DMZ CONFIGURATIONS DESIGNING THREE-PRONGED FIREWALLS PROS AND CONS ADDRESSING DECISIONS DEPLOYING A THREE-PRONGED FIREWALL DEPLOYING A TUNNEL SOLUTION USING PPTP DEPLOYING A TUNNEL SOLUTION USING L2TP DEPLOYING A WEB SERVER WITH A SQL BACK END BUILDING A CASE FOR MULTI-PRONGED FIREWALLS WHEN TWO FIREWALLS ARE BETTER THAN ONE DMZS WITH TWO FIREWALLS ALLOWING PRIVATE NETWORK USERS TO ACCESS THE INTERNET FIREWALL FUNCTIONS IN WINDOWS WINDOWS 98 AND WINDOWS ME FILE AND PRINTER SHARING PPTP CLIENT INTERNET CONNECTION SHARING: NAT FOR DUMMIES WINDOWS NT 4 0 PACKET FILTERING PPTP SERVER WINDOWS 2000 L2TP AND IPSEC WINDOWS XP INTERNET CONNECTION FIREWALL (ICF) WINDOWS SERVER 2003 MAKING INSTALLATION CHOICES INTRODUCING IPTABLES USING IPTABLES COMMANDS IPTABLES COMMANDS IPTABLES TARGETS ORDER MATTERS IPTABLES OPTIONS AND CONDITIONS PUTTING IT ALL TOGETHER: BUILDING A SIMPLE LINUX FIREWALL MASQUERADING AND NAT SIMPLIFYING THINGS: FIREWALL GUIS ADDING PROXY FUNCTIONALITY PUT YOUR SOCKS ON SQUID ANYONE? HOME COMPUTERS AT RISK HOME COMPUTERS HAVE CHANGED HACKERS HAVE CHANGED YOU HAVE CHANGED FEATURES OF PERSONAL FIREWALLS ENTERPRISE FIREWALLS VERSUS PERSONAL FIREWALLS HOW TO BE SAFE ON THE INTERNET PERSONAL FIREWALL: ZONEALARM ZONEALARM FEATURES ZONEALARM USER INTERFACE ZONEALARM INSTALLATION ZONEALARM CONFIGURATION TASKS PERSONAL FIREWALL: BLACKICE BLACKICE FEATURES BLACKICE USER INTERFACE BLACKICE INSTALLATION BLACKICE CONFIGURATION TASKS NORTON PERSONAL FIREWALL NORTON PERSONAL FIREWALL FEATURES NORTON PERSONAL FIREWALL INTERFACE NORTON PERSONAL FIREWALL INSTALLATION NORTON PERSONAL FIREWALL CONFIGURATION TASKS MAKING INTERNET ACCESS FASTER AND MORE SECURE LOOKING UNDER THE HOOD: HOW ISA WORKS CHOOSING BETWEEN THE TWO EDITIONS PREPARING FOR INSTALLATION INSTALLING ISA SERVER GATHERING INFORMATION CONNECTING BY TELEPHONE EXAMINING THE THREE CLIENTS SECURENAT CLIENT FIREWALL CLIENT WEB PROXY CLIENT THE BEST CLIENT FOR YOU FOLLOWING THE RULES: THE TWO TYPES PUTTING THE TWO TYPES TOGETHER CREATING A PROTOCOL RULE LETTING THE GOOD GUYS IN PUBLISHING A WEB SERVER PUBLISHING A NON-WEB SERVER CREATING PACKET FILTERS DESIGNING YOUR NETWORK WITH ISA SERVER A SIMPLE NETWORK A NETWORK WITH A THREE-PRONGED DMZ A NETWORK WITH A BACK-TO-BACK DMZ TAKING THE NEXT STEP FIREWALL-1 FEATURES ACCESS CONTROL TRACKING ACCESS: ADVANCED LOGGING, REPORTING, AND ALERTING PROTECTION AGAINST COMMONLY USED ATTACKS CONTENT SECURITY INTRUSION DETECTION VPN-1 PERFORMANCE FIREWALL-1 COMPONENTS STANDALONE DEPLOYMENTS CLIENT/SERVER DEPLOYMENT FIREWALL-1 NEXT GENERATION INSTALLATION INSTALLING AND CONFIGURING FIREWALL-1 NG FIREWALL-1 NG CONFIGURATION TASKS STARTING THE SMARTDASHBOARD CLIENT DEFINING A COMPUTER OBJECT DEFINING A FIREWALL OBJECT DEFINING A NETWORK SEGMENT CREATING A USER ACCOUNT CREATING A GROUP ACCOUNT DEFINING A RULE BASE INSTALLING THE SECURITY POLICY HOW DO YOU DECIDE? WHAT TO COMPARE? WHAT ARE SOME OF THE CHOICES? SAM SPADE NMAP NETSTAT TCPVIEW TDIMON FPORT SNORT INTERNET SCANNER NESSUS NETWORK MONITOR ETHEREAL NETCAT WWW SANS ORG WWW CERT ORG WWW INFOSYSSEC ORG WWW MICROSOFT COM/SECURITY WWW ICSALABS COM WWW SECURITYFOCUS COM WWW GOCSI COM WWW ISASERVER ORG WWW INTERHACK NET/PUBS/FWFAQ FIREWALL LISTS