5.2. Packet Filtering
Packet filtering
systems route packets between internal and external hosts, but they
do it selectively. They allow or block certain types of packets in a
way that reflects a site's own security policy, as shown in
Figure 5-1. The type of router used in a packet
filtering firewall is known as a
screening
router.
Figure 5-1. Using a screening router to do packet filtering
As we discuss in
Chapter 8, "Packet Filtering", every packet has a set
of headers containing certain information. The main information is:
- IP source address
- IP destination address
Protocol (whether the packet is a TCP, UDP, or ICMP packet)
TCP or UDP source port
TCP or UDP destination port
ICMP message type
Packet size
The router can also look past the packet headers at data further on
in the packet; this allows it, for instance, to filter packets based
on more detailed information (like the name of the web page that
somebody is requesting) and to verify that packets appear to be
formatted as expected for their destination port. The router can also
make sure that the packet is valid (it actually is the size that it
claims to be and is a legal size, for instance), which helps catch a
number of denial of service attacks based on malformed packets.
In addition, the router knows things about the packet that
aren't reflected in the packet itself, such as:
- The interface the packet arrives on
- The interface the packet will go out on
Finally, a router that keeps track of packets it has seen knows some
useful historical facts, such as:
- Whether this packet appears to be a response to another packet (that
is, its source was the destination of a recent packet and its
destination is the source of that other packet)
- How many other packets have recently been seen to or from the same
host
- Whether this packet is identical to a recently seen packet
- If this packet is part of a larger packet that has been broken into
parts (fragmented)
To understand how packet filtering works, let's look at the
difference between an ordinary router and a screening router.
An ordinary router simply looks at the destination address of each
packet and picks the best way it knows to send that packet towards
that destination. The decision about how to handle the packet is
based solely on its destination. There are two possibilities: the
router knows how to send the packet towards its destination, and it
does so; or the router does not know how to send the packet towards
its destination, and it forgets about the packet and returns an ICMP
"destination unreachable" message, to the packet's
source.
A screening router, on the other hand, looks at packets more closely.
In addition to determining whether or not it can
route a packet towards its destination, a screening router also
determines whether or not it should.
"Should" or "should not" are determined by
the site's security policy, which the screening router has been
configured to enforce.
Packet filtering may also be performed by devices that pay attention
only to "should" and "should not" and have no
ability to route. Devices that do this are packet filtering
bridges. They are rarer than packet filtering routers,
mostly because they are dedicated security devices that don't
provide all the other functions that routers do. Most sites would
rather add features to routers that they need anyway, instead of
adding a dedicated device. However, being a dedicated device provides
advantages for packet filtering bridges; in particular, they are
harder to detect and attack than packet filtering routers. They
provide the same general features that we discuss for packet
filtering routers.
Once it has looked at all the information, a straightforward packet
filtering router can do any of the following things:
ore sophisticated routers might also be able to do one or more of
these things:
- Modify the packet (for instance, to do network address translation).
- Send the packet on to a destination other than the one that it was
bound for (for instance, to force transactions through a proxy server
or perform load balancing).
- Modify the filtering rules (for instance, to accept replies to a UDP
packet or to deny all traffic from a site that has sent hostile
packets).
The fact that servers for particular Internet services reside at
certain port numbers lets the router block or allow certain types of
connections simply by specifying the appropriate port number (e.g.,
TCP port 23 for Telnet connections) in the set of rules specified for
packet filtering. (
Chapter 8, "Packet Filtering", describes in detail
how you construct these rules.)
Here are some examples of ways in which you might program a screening
router to selectively route packets to or from your site:
- Block all incoming connections from systems outside the internal
network, except for incoming SMTP connections (so that you can
receive electronic mail).
- Block all connections to or from certain systems you distrust.
- Allow electronic mail and FTP services, but block dangerous services
like TFTP, the X Window System, RPC, and the "r" services
(rlogin, rsh,
rcp, etc.). (See Chapter 13, "Internet Services and Firewalls",
for more information.)
Packet filtering devices that keep track of packets that they see are
frequently called
stateful packet filters
(because they keep information about the state of transactions). They
may also be called
dynamic packet filters
because they change their handling of packets dynamically depending
on the traffic they see. Devices that look at the content of packets,
rather than at just their headers, are frequently called
intelligent packet filters. In practice, almost
all stateful packet filters also are capable of looking at the
contents of packets, and many are also capable of modifying the
contents of packets, so you may see all these capabilities lumped
together under the heading "stateful packet filtering".
However, something can legitimately be called a "stateful
packet filter" without having the ability to do advanced
content filtering or modification.
A packet filtering system is also a logical place to provide virtual
private network or network address translation services. Since the
packet filter is already looking at all of the packets, it can easily
identify packets that are intended for a destination that is part of
the virtual private network, encrypt those packets, and encapsulate
them in another packet bound for the appropriate destination.
5.2.1. Advantages of Packet Filtering
Packet filtering has a number of advantages.
5.2.1.1. One screening router can help protect an entire network
One of the key advantages of packet filtering is that a single,
strategically placed packet filtering router can help protect an
entire network. If only one router connects your site to the
Internet, you gain tremendous leverage on network security,
regardless of the size of your site, by doing packet filtering on
that router.
5.2.1.2. Simple packet filtering is extremely efficient
Because simple packet filtering requires paying attention only to a
few packet headers, it can be done with very low overhead. Proxying
is a fairly time-consuming operation, and adding proxying means
directing connections through another program, usually on a machine
that otherwise wouldn't be necessary to the routing process.
Packet filtering takes place on a machine that was already in the
critical path, and introduces a much smaller delay.
However, there is no free lunch; the more work your packet filters
do, the slower they will be. If your packet filters behave like
proxies, doing complicated data-driven operations that require
keeping track of multiple packets, they will tend to perform like
proxies as well.
5.2.1.3. Packet filtering is widely available
Packet filtering capabilities are available in many hardware and
software routing products, both commercial and freely available over
the Internet. Most sites already have packet filtering capabilities
available in the routers they use.
ost commercial router products include packet filtering
capabilities. Packet filtering capabilities are also available for a
number of general-purpose computers. These are discussed further in
Chapter 8, "Packet Filtering".
5.2.2. Disadvantages of Packet Filtering
Although packet filtering provides many advantages, there are some
disadvantages to using packet filtering as well.
5.2.2.1. Current filtering tools are not perfect
Despite the widespread availability of packet filtering in various
hardware and software packages, packet filtering is still not a
perfect tool. The packet filtering capabilities of many of these
products share, to a greater or lesser degree, common limitations:
- The packet filtering rules tend to be hard to configure. Although
there is a range of difficulty, it mostly runs from slightly
mind-twisting to brain-numbingly impossible.
- Once configured, the packet filtering rules tend to be hard to test.
- The packet filtering capabilities of many of the products are
incomplete, making implementation of certain types of highly
desirable filters difficult or impossible.
- Like anything else,
packet filtering packages may have bugs in them; these bugs are more
likely than proxying bugs to result in security problems. Usually, a
proxy that fails simply stops passing data, while a failed packet
filtering implementation may allow packets it should have denied.
5.2.2.2. Packet filtering reduces router performance
Doing packet filtering places a significant extra load on a router.
As we discussed previously, more complex filters place more load on
the router, but in some cases, simply turning on packet filtering on
a given interface can also cost you a lot of performance on some
routers, because the filtering is incompatible with certain caching
strategies commonly used for performance enhancement. Cisco's
"fastpath" functionality is an example of this; normally,
fastpath can perform basic routing functions completely on the
interface card, without involving the main CPU, but using some forms
of filtering requires involving the main CPU for each packet, which
is much slower. What enables/disables fastpath depends on the
hardware and software version.
5.2.2.3. Some policies can't readily be enforced by normal packet filtering routers
The information that a packet filtering router has available to it
doesn't allow you to specify some rules you might like to have.
For example, packets say what host they come from but generally not
what user. Therefore, you can't enforce restrictions on
particular users. Similarly, packets say what port they're
going to but not what application; when you enforce restrictions on
higher-level protocols, you do it by port number, hoping that nothing
else is running on the port assigned to that protocol. Malicious
insiders can easily subvert this kind of control.
This problem is eased by using more intelligent packet filters;
however, in each case, you have to give up some of the advantages of
normal packet filtering. For instance, a packet filter can insist
that users authenticate themselves before sending packets, and then
it can filter packets by username. However, this removes the
transparency advantage of normal packet filtering. A packet filter
can also do protocol validity checking, but this is less than perfect
and also increases filtering overhead.
![Previous](../gifs/txtpreva.gif) | ![Home](../gifs/txthome.gif) | ![Next](../gifs/txtnexta.gif) |
5. Firewall Technologies | ![Book Index](../gifs/index.gif) | 5.3. Proxy Services |