Question

Provide a filter table and a connection table for a stateful firewall that is as restrictive as possible but accomplishes the following: a. Allows all internal users to establish Telnet sessions with external hosts. b. Allows external users to surf the company Web site at 222.22.0.12. c. But otherwise blocks all inbound and outbound traffic. The internal network is 222.22/16. In your solution, suppose that the connection table is currently caching three connections, all from inside to outside. You’ll need to invent appropriate IP addresses and port numbers.

Short answer

The filter table allows outbound Telnet and inbound HTTP to 222.22.0.12; all else is blocked. The connection table tracks three active Telnet connections.

Step-by-step solution

Analyze Requirements

Identify that we need to allow Telnet sessions from internal users to external hosts, allow web surfing from external users to a specific internal IP (222.22.0.12), and block other traffics.

Define Internal Network Address

The internal network is given as 222.22/16, which comprises addresses from 222.22.0.0 to 222.22.255.255.

Create Filter Table for Outbound Telnet

Since Telnet uses TCP port 23, create a rule allowing outbound connections with source IP from 222.22/16, destination IP as any external address, protocol TCP, and destination port 23. Set the default action to block all other outbound connections.

Create Filter Table for Inbound HTTP

Allow inbound HTTP connections on TCP port 80 with destination IP as 222.22.0.12. Use any source IP (external). Set the default action to block all other inbound connections.

Compile Filter Table

Compile the filter table as follows: - Outbound: Allow TCP, source: 222.22/16, dest: any, dest port: 23 - Inbound: Allow TCP, source: any, dest: 222.22.0.12, dest port: 80 - Default rule: Block all other traffic

Establish Connection Table

Create a connection table to track active stateful connections from inside to outside. Assume three connections: 1. Source: 222.22.1.10:5000, Dest: 203.0.113.5:23 2. Source: 222.22.1.11:5001, Dest: 203.0.113.6:23 3. Source: 222.22.1.12:5002, Dest: 203.0.113.7:23

Verify Restrictions

Ensure the filter table fulfills the restrictions: Telnet is allowed outbound, HTTP is allowed inbound to 222.22.0.12, and all other traffics are blocked as planned.

Key concepts

Network Security

Network security is a critical aspect of protecting an organization's data and resources. It involves creating measures to safeguard the integrity, confidentiality, and availability of information across networks.

A stateful firewall is one of the tools used in network security. It keeps track of the state of active connections and makes decisions based on the context of the traffic, such as the established sessions.

For instance, in a company network using a stateful firewall, the firewall can allow internal users to start Telnet sessions with external hosts securely. At the same time, it can ensure that only authorized traffic, like incoming web requests to the company site, is allowed through, while blocking other malicious or unauthorized traffic.

By implementing stringent network security measures, companies reduce the risk of cyber attacks and unauthorized access.

Filter Table

A filter table in network security contains a set of rules that control incoming and outgoing traffic through a firewall. These rules determine which packets can pass and which should be blocked, based on attributes such as IP addresses and port numbers.

Creating a filter table for a stateful firewall involves defining specific rules to achieve desired security outcomes.

• For outbound Telnet, a rule might allow traffic with a source from an internal network to any external destination on TCP port 23.
• For inbound HTTP traffic, another rule might allow traffic with a destination at a specific IP, say 222.22.0.12, on TCP port 80.

The filter table also includes default rules that block any traffic not explicitly allowed by other rules, ensuring that network security is maintained at all times.

Connection Table

A connection table is a vital part of a stateful firewall. It keeps a record of established connections, allowing the firewall to recognize expected traffic related to those connections and permit its passage, while potentially rejecting others.

This allows for efficient management of ongoing sessions, crucial in scenarios where connections are initiated by trusted sources, such as internal users accessing external networks.

For example, a connection table might track three Telnet connections initiated from internal IPs to external IPs. This includes details such as:

• Source IP and port (e.g., 222.22.1.10:5000)
• Destination IP and port (e.g., 203.0.113.5:23)

By maintaining this table, a firewall accurately manages legitimate traffic and halts unexpected attempts to breach network security.

TCP Ports

TCP ports serve as endpoints for communicating devices. They help determine the type of service requested or provided by a device over the network.

In a stateful firewall setup, different services use different TCP ports to enable secured communication. Telnet, for example, uses TCP port 23, which can be specified in firewall rules to allow or block Telnet traffic.

For web traffic, HTTP commonly uses TCP port 80. By explicitly permitting incoming traffic on this port, a firewall allows the web server to receive data from the internet, enhancing user accessibility while maintaining security standards.

It is important to set up these ports correctly in firewall configurations to ensure both usability and protection.

Internal Network Configuration

Internal network configuration involves defining a network's internal IP address range, which allows an organization to efficiently manage network resources and security policies.

In the example given, an internal network could be defined by the range 222.22/16. This implies all IP addresses from 222.22.0.0 to 222.22.255.255 are part of the internal network.

Such configuration enables a network administrator to establish rules guiding how internal devices interact with external networks, determining which types of connections are permitted.

Properly configured internal networks are crucial for implementing secure firewall rules and ensuring seamless, safe connectivity both within an organization and with the outside world.