IT Employment

Ask something
Discussion Locked

DSL and Firewalls - A must read

0 helpful
34 replies

by lordinfidel

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Alot of you have probably read my posts and know that I am a huge proponent of security.

I also strongly beleive in the 'build a linux firewall to protect your network' ideal.

But most of you out there have no idea how to secure linux or howto build a firewall. Which is nothing to be ashamed off. It's just a reality.

Which is why I am advocating this *FREE* product.

It is called BBIagent. What is it?

It is a router/firewall that can be set up within minutes without any knowledge of linux.

All you need is a min 386+ with 8megs ram or more, a floppy disk and floppy drive, 2 nics and a connection to the net.

What? no hdd? No cd rom? I don't understand?

Here's how it works, you go to BBIagent.com.
Using there on-line java-applet you make a boot floppy. You will need to know the make of your NIC's. They have most linux drivers on-line in their applet. So there is a good chance yours in on the list.

Then you download the boot.img, and using rawwrite, you write the img to a floppy.

You then boot your new router off of the floppy.
Go to your second system that can talk to your router. Open up a web browser and connect to it.

(I strongly urge downloading the java .jar file and uploading itto the router, If you have winzip, change the file extension back to .jar.)

Once you upload the .jar file to the router you can then start administering the router.

Yes It does PPPoE connections
Yes It does DNS proxy
Yes It does have a VERY configurable firewall
Yes It can do access list
Yes It can do Virtual Services (port forwarding)
Yes It can automatically reconnect.
And alot more...

TIPs, when you build your image, select everything. If you do not select everything,you will not have the option of turning it on.

They are located at www.bbiagent.com

Any Questions!

Yes It's Free!!!!!

34 replies

by lordinfidel

So you still don't get why I would advocate such a product.

Well, plain and simple. I'm using it right now.

I relaimed my little cisco 1650 so it can be used for other things.

I am running it on a cray pentium 166 w/32 megs of ram.

I have a pretty complex set of rules in there, (yes I even tried to hack myself remotely) And it works.

Yes it is Stateful. If you don't know what that means it basically means it keeps track of connections that you have initiated.

(although you do need a rule for established ssl sessions ans related ICMP sessions)

It is pretty well supported. (I asked a support question and got an answer back 4 hours later, w-NO PAYING FOR IT)

Simply put, this product kicks ass.

The set-up time can't be beat. You don't even need to know anything about linux. Which is the beauty of it.

Is it a cop out? For geeks like me, sort of. But who cares.

For the home dsl user or the consultant who is not really to hip on how to secure linux or how to build a firewall / router....

NO!

I could not even achieve these results with 2K RRAS and PktFilter (a free add on that is similair to IPchains)

Also there is NO HDD, which means no one can write any utilities to it. It basically becomes a hardware based device since everything runs in memory.

Any questions!

by lordinfidel

I know someone will catch me on it... It was suppoese to read Crappy p166 not a cray p166

And it was reclaimed not relaimed.

by lordinfidel

I'm feeling kind of generous today, So I figured I would discuss building a firewall.

There are alot of places to start, but I will start with the Default Rule (sometimes know as the cleanup rule or catch all rule).

Different firewalls implement this in a different way. But essentially a default rule is:

What happens to a packet when no rules match it.

So if you design your ruleset and you don't define a Default rule, 10 to 1 odds requests that you don't mean to get thru do.

I personally employ both egress (inbound) and ingress (outboud) filtering. That means that nothing comes in or out that I do not explicitly let thru.

In order to enforce that I have to do several things. The first thing is to create a rule that says, Anything from Anywhere Drop.

This becomes my default behaviour of my firewall.
(Using BBIagent) I place this rule at the very end of my firewall. (Iptables/Chains has a seperate area called the default policy where you define this behaviour, checkpoint you insert this rule as the last one also)

by lordinfidel

So when do I add the default rule?

I do it when I create the firewall. Why?

As I add a rule, i can test to see if it works.
As long as my default rule is there. If my rule to allow something does not work, I will immediately know it.

So if I create my initial ruleset to say:
(this is assuming that DNS is being done by the firewall/router)

1: from lan to any on tcp port 80 state= new allow
2: from any to any on any drop

Any requests to the net will fail. I will immediately know this. Why?

Because I did not add in the counter rule to #1.
It should read:

1: from lan to any on tcp port 80 state= new allow
2: from wan on tcp port 80 state=estalished to lan = allow
3: from any to any on any drop

Now it will work. There is now a rule for the remote server to return the request back to the client machine on the lan. Where before there was not rule, so as it passed thru the chain, it hit a rule that says drop.

Why established and not new. That is another lesson.

Why drop and not reject, again another lesson.

I know this was kind of un-solicited but I felt like spouting off. And especially if any one decides to use BBIagent that has no idea about firewalling, I just wanted to pass some knowledge along.

If any one has any questions, feel free to ask.
I'm feeling generous.

by lordinfidel

In the rule deployment (in bbiagent)

All of your incoming rules should be in the blocking area.

Your outgoing rules should be in the access list area.

The default rule for blocking section is
wan-- proto-all state all port all drop

The default rule for access section is
proto-all state all port all drop

So wherever you allow something outbound in your access list, you add the counterpart inbound in your blocking list.

Sorry for the confusion.

by jellimonsta

I may well give this product a try for my home net. I do have a DSL router in place but being as this software required pretty much nothing it cannot be bad. I have also just started playing with Linux so hopefully I will be able to work my way around it eventually.

by lordinfidel

It actually requires no knowledge of Linux whatsoever.

It boots off of floppy and runs in totally in memory.

A knowledge of firewalling is helpful but not mandatory. Since it's 'gui' based you can muddle thru it. (although I do plan on posting a basic ruleset for people to use.)

If you are planning on learning linux and firewalling, then you need 3 books (mandatory).

1. building internet firewalls
Published by O'Reilly & Associates
2nd Edition June 2000
894 Pages
ISBN 1-56592-871-7

2.Linux Firewalls
New Riders Publishing; ISBN: 0735710996; 2nd edition (October 24, 2001)

3. TCP/IP Network Administration 3rd edition
By Craig Hunt
Third Edition April 2002
0-596-00297-1, Order Number: 2971

These 3 books are a must have for any linux firewall admin.

The 1st will give you good theory on how to build a firewall and the concepts behind it.

The 2nd covers IPChains and IPtables. It also gives samples of scripts and is a great reference.

The 3rd book goes in depth of protocol behaviour. It's one thing to read the RFC, it's another to understand the underlying concepts of the stack and behaviour of the well known port.

by admin

I was somewhat amused with your self-conversation... but I am going to head over and take a look at it! :)

by admin

Yes, what the poor bright ones must endure, eh? :)

I actually got given some hardware vpns recently and so I'm thinking of getting a few out to friends over the northwest and building our own little private network. Of course I don't want them playing pranks on my home LAN, and this thing looks WAY quicker than setting up and troubleshooting ipchains so I'm going to try it.

I'm with you though, I can't figure out how this thread gets buried and something like: "help my monitor is asleep" gets the replies... :)

by lordinfidel

The one thing I have not been able to do reliably, is get the auto-reconnect to work properly. Either I have it turned down to low or there is a problem with my provider.

I may just opt for the automatic "ping out" method of staying up.

Justrememember to take take a snap shot of your rule sets. I just copied and pasted the blocking and access control screens into paint and saved them. If you ever reboot you lose the ruleset.

They are working on writing them to disk. But I beleivethat they may be running out of space.

I suggested that they allow exproting them onto a second floppy and then allow importing them.

I found that the best way to set it up is to use the Blocking section for all inbound traffic and the Access Control for Outgoing.

It is a great learning tool to see how rule sets can be built. As soon as you make a change it is immediate. You do not have to disconnect/reconnect.

by lordinfidel

When creating a firewall, you will want to create rules that say "Hey I do not want you to get in".

Since we learned in the default rule set, that you want to block new connections from the wan. The question is, How do I do that?

Well, your first inclination is to say, Hey I'm going to reject the connections.

That is all well and good except for one thing. By rejecting packets you just tipped off a would-be hacker that there is some sort of filtering device there.

The optimal way to achieve this is to "Drop" the packets. Dropping packets simply means the filtering device discards the packets and does not send a reply back stating that it did so. Think of it as sending the packets to bit hell, never to be seen again.

Reject will send a reply back.

This also staves off attacks by not sending replies back that could overflow the device's buffer. And it also save on cpu cycles because it does not have to take action on the packet. It will pretend it does not exist.

So unless you *really* want to let them know you are there, always choose drop over reject.

by admin

Yep. Exactly. If a reject is returned it's more interesting than almost anything except "smallish business wireless access point 1234 main ave. city, state" etc. Actually, it's more interesting than that because the natural curiousity thing.... stupid people all tend to have the same stupid stuff but the possibility of something quite interesting can be hard to pass up.
:)

by lordinfidel

(the use of I just means hackers in general, I would never advocate breaking into other systems, that is criminal)

I love misconfigured firewalls.

And I love the home firewall. I tend to stay away from the lg corporate netwks because,

A) they have guys like me working for them
B) if caught, they are more likely to prosecute

The best way to tell if it is a good or bad firewall config is the message you get back.
(You need a packet sniffer to really see what is going on inside the packets, just don't rely on your port scanner)

If it is misconfigured, then I can usually bet that monitoring is lax or non-existent, or that they would not know how to react if they did find out I was there.

The home user (usually has a dsl notation somewhere in my tracert to them[traces are useful for mapping out the terrain]) is a very ripe target.

With the dsl notation, I can usually be sure that they will be on for long period of times. Or that they have minimal protection.

And once I can get thru their minimal security, they usually have all sorts of fun stuff open on their machines that I can attach to, exploit, and have general fun with.

by lordinfidel

It's all well and good to talk about a firewall.

But where (on your home network) would you place this device.

Good question. There are lot's of different places you can put a firewall.

On corporate networks, they typically are placed justbehind the router. Obviusly the router would need to be the farthest point out on your netwk because it is the one that is routing to the net.

Some of you may get confused at this point that's ok. Since we typically think of a router as a gateway, how then do we filter thru the firewall?

Simply put, instead of setting your gateway to that of the router, you set it to the firewall. The firewall typically has what is termed as "IPForwarding" on. IPForwarding does just what it sounds like, it forwards IP based packets.

So is BBIagent both a router and a firewall? Yes.
It does both. Most dsl routers that have firewalling capabilities act as both.

by lordinfidel

So using BBIagent; You get your self a crappy system. Install 2 Nics in it.

Then Connect the TOP most nic to your dsl modem.

The 2nd nic will be connected to 1 of the 2 places. A hub/switch (for multiple systems), or using a crossover cable, into a single pc.

Assign the 2nd nic an IP (the setup wizard will ask you for it) I always use either 192.168.1.1 or 192.168.0.1 (1.1 is just easier to type)

Typically a .1 address is/should be reserverd for your routers. When designingmy networks I always reserve the first 10-20 addr for netwk con devices.

If you are using a hub/switch, connect your devices into it and set those devices gateway to
192.168.1.1

Your address range should be 192.168.1.10-254/24
(/24 is a subnet mask of 255.255.255.0 the 24 stands for the 1st 24 bits of the mask)

Also if you enabled DNS resolution for the BBIagent router, point your DNS resolutions to 192.168.1.1 also.

Then using the applet, connect up to the net and test it out with your web browser. You should be able to connect.

by jellimonsta

I am hoping to try this out some time soon. I will let you know how it goes. Good luck figuring out the outo reconnect issue.

by admin

on this part: "Your address range should be 192.168.1.10-254/24" I would set it much narrower, like to appx. the max number of machines on your LAN.

Also, I almost noted this in the last post, but it doesn't make sense if you ignore pings at thefirewall but let them remain on your router if it is still present on the WAN side, although if you have a good idea why this would be best in a situation (I almost just thought of one...) I would love to hear about it :)

by leehellcat

Hmmm, it seems to good to be true. They always say that you get waht you pay for, and something that is free is not normally all that great. BUT I am a gambling man, so I will give it a go sometime over the Xmas period.

by lordinfidel

It is just personal preference.

For a home lan, why go thru the bother of subnetting your netwk to a /27 or /26 just to get the least number.

Yes, it could be debated that it can help in security by not allowing attackers to get a valid IP. But then again, if the attacker is at that point, you have more to worry about. They are just spoofing an address anyways and usually stick with low numbers.

You lost me with ICMP filtering.

The basic is you don't want your filtering device responding to any new connection attempts from the WAN unless you 'explicitly' allow it.

Can you restate the question so I am a little more clear. I wasn't sure what you meant by remain on the router?

by jellimonsta

Hey!,
I tried using this but I tried unpacking the boot image from the jar file on my W2K station. It goes through all of the processes without a problem but when I tried to boot the proposed system from the boot image I got an error missing NTLDR? Not sure why it is trying to find that because that loads the NTOSKernal in a Win environment. I imagine this problem is due to trying to create the boot image in a Windows environment but I did not notice anywhere I could not do this? Any words of wisdom?

by lordinfidel

I tried using their version of rawwrite to create the image, I wound up using rawritewin that was on rh8.

The jar file, that is not the file you make the image from.

Go back to their site, and use the setup wizard on-line to create the image.Then download and save the image to your local drive.

Also while you are their, download the jar file. Just save it, don't do anything with it yet.

Open up rawritewin (www.directionweb.com/nettools/rawritewin.zip)

Create the disk by navigating to your .img file you downloaded.

Put the completed img disk into the system you want to run it on. After it boots, it takes about a minute, From another system, open up a webbrowser and type in http://IPAdrressOfRouter

A window will appear with the big yellow penguin. Choose upload jar file, navigate to the .jar file you downloaded.

Once that is uploaded, you can log in. The password is BBIagent and is case sensitive.

The thing that sucks about it is that if you shut down the router, it does not remember your rules and you also have to upload the jar file each time you boot.

hopefully future versions will have this corrected.

by admin

hehehe maybe like a white hat version of "the plague"

OK, nobody wants to break into a corporate network with a killer admin ... or is the challenge just too tempting for some?

I of course do not condone any illegal activities either, same asyou, but if I was getting a response from the router on a scan of places I of course owned indicating it's probably a smallish dsl router then I know something is there even if the firewall does not respond and I can pursue accordingly. So I was just saying that you may want to apply the same idea to your dsl router and discard everything there too.

by admin

I have also been interested in this thread to see how things stay on the "hotlist" nowadays. Have you figured this out?

:)

by lordinfidel

Let's say you are running a web server and nothing else.

When someone does a port scan of your system, the only port that should come up is tcp 80. It is difficult to block port scans because they are not ICMP requests.

Port scans typically are just that. They will send a syn packet to that port and wait for a syn-ack.

ICMP on the other will not show up on a tcp port scan. There is no need for the firewall to really have to reply to icmp requests. So I specfiy for the firewall, on the outbound int, to not reply to icmp requests.

Now I also set it up to allow the internal netwk to send out icmp requests and then you have to counter that rule with 'related icmp requests on the outbound int to be allowed'.

But place the rule after the 'deny all new requests on outbound int'.

There are still ways around the rule sets, even with a stateful firewall. Most script kiddies don't understand the protocols deep enough to exploit it. Not to mention that is a a pretty complex process to get it to work and will depend on what the firewall is checking for.

Which brings to me another point. Also specify the source and destination. Just don't leave it open for interpretation. Both on the lan and wan rule sets

the world obviously is 0.0.0.0

by dhabih

After reading this thread I felt that a Linux firewall might be a great compliment to any security plan. I recently began securing a mid-size network. The steps I took to do so are as follows.
1.Secured all Network Hardware (switches and routers) ports, protocols, passwords, ACL?s, etc.
2.Implemented a Hardware firewall.
3.Antivirus Software was already in place and required only minor tweaking.
4.Domain Password management; Got rid of all non-expiring passwords, implemented a strict password policy, etc.
5.Updated all Servers and clients with patches service packs and hot fixes.
6.128 Bit encryption on all wireless access. Will be upgraded with MAC only access when all MAC addresses are imputed.
7.VLAN?s are the next step.
I found the discussion very interesting and am going to implement it at home very soon, I have box sitting in the corner that will fit the purpose just fine. Can you think of any main topics I may have missed in my security implementation, and can you suggest any tools I can use to test my security implementation. Thanks to all of you for a great thread.

by lordinfidel

get your self some port scanners
(www.foundstone.com is a good place to look for some free command line versions fscan)

Also ISS is a good commercial grade but costs some cash. Do a google search for "port scanner"

The using at least 3 different scanners, scan your netwk from an un-firewalled connection.

Also get yourself Hacking Exposed 3rd edition. It will open your eyes.

If you are running any NT webservers, use URLScan to protect it. It is loaded as an ISAPI filter inside IIS. It acts as a app-firewall for IIS.

Did you restrict all outbound traffic? (egress filtering) This helps prevent unwanted connections being generated from the inside.

Are your webservers in a different domain and physical subnet then your user netwk?

Is your AV software installed on the mail server or just at the desktop? And do you have extension blocking employed at the mail server?

by dhabih

The Web Server is located on a different network than the rest of the network.
All outbound traffic is restricted except for the ports that I open per ip address that needed it.
All inbound traffic is restricted except for the ports that I opened per ip address that needed it.
The Antivirus is installed on the mail server and centrally force fed to all clients. Updates are checked for daily and installed as IDE's are created, and a monthly disk updates the database.
Thanks again for the help. I'll try the scanners you recommended and let you know how it goes. I have the book now I just have to finish reading it. Is ISS worth the cash or should I check for trial versions.

by lordinfidel

We are talking about a linux based system.

i've built alot of linux based firewalls. Even though the OS is free, my time is not.

What used to take me 2-3 days to build and debug a firewall, now takes me about an 30 minutes.

As I type this,I am at my house on my dsl connection using BBIagent.

I have gone so far as to offer the maker a 'donation' but with no reply.

I am still attempting to exploit it, and I am sure that someone greater then I will be able to send a buffer overflow command to it.

but I like that it runs off a floppy and is loaded into memory. And is very easy to set-up.

You don't need to worry about securing the linux os. Which is another beef of mine with people just deploying OS's that they do not understand how to secure.

by lordinfidel

You plan on keeping up to date with the support.

That is if you plan on renewing your support plan every year so you can get the updates.

I would'nt reccomend buying it for personal use. But for a corporatation it is nice to have.

My take is this, you just can't use 1 vuln scanner. You need to use at least 3 different ones. Each scanner has it's own way of telling whether or not a vuln is present.

ISS is nice because it is a commercial product and therfore updated regularly. Butit also has a price tag.

If I was you, I would get the hacking exposed books and use their guidelines for securing machines.

At least you have filtering going on in both directions which is half the battle. That limits an attackers avenue of approach. Now concentrate on those areas that the potential attacker has access to. Like your web server.

If it's IIS you should definitely use URLScan to protect it.

For apache, Hacking Exposed Web Applications pages 42-46 cover the most common apache exploits and how to stop them.

This discussion is closed to new replies.