CNIT455 Ex.1 Main

Packet filter: purpose

Limits connectivity by permitting or blocking ingress and/or egress traffic according to rules.

Ingress versus egress

Ingress enters the protected network/interface; egress leaves it.

Ruleset

Collection of packet-filter rules that determines what traffic is permitted or blocked.

Default-deny filtering

Explicitly permit required traffic, then deny everything else.

Packet filter versus firewall

A firewall includes packet filtering; a packet filter alone is not necessarily a complete firewall.

Packet-filter packaging options

Software integrated with an IP stack, a replacement IP stack/bastion-host approach, or a specialized hardware device.

Packet-filter software examples

Windows Firewall, iptables, and pf.

Address filtering: IP addresses versus DNS names

The course recommends IP addresses because DNS names are easier to spoof.

IP filtering criteria

Source and destination IP addresses.

IP spoofing: local and remote approaches named in lecture

Local ARP manipulation; remote IP source routing such as LSRR.

LSRR: expansion and purpose

Loose Source Record Routing; lets the sender specify routers that a packet must traverse.

LSRR: security concern and mitigation

Can help spoofed-source traffic receive replies; disable source routing on border routers and firewalls.

TCP/UDP ports: source versus destination

A connection initiator commonly uses an ephemeral source port and contacts a service destination port; each transport has its own port space.

Port numbers: do they prove the application identity?

No. Software can use nonstandard ports, and malicious traffic can imitate a standard service port.

Ephemeral ports: course convention

The slides describe randomly selected client source ports above 1023; actual ranges vary by operating system.

TCP replies: source-port clarification

Replies on an established connection use the service's port as the source; a server does not randomly change ports for every reply.

Static packet filtering

Checks each packet independently against address/port rules, without tracking connection state.

Dynamic packet filtering

Stateful packet inspection (SPI); checks packet context and connection state as well as addresses and ports.

Destination-port filtering example

Permit traffic destined for TCP port 25 on the mail server.

Broad high-port allowance: risk

Allowing all inbound ports above 1023 exposes services listening on those ports.

Bidirectional static filtering

Uses source-port and destination-port rules to permit traffic in both directions; still does not prove traffic belongs to a valid session.

Static TCP ACK/FIN check: lecture strategy

Permit certain high-port inbound packets with ACK/FIN set as a rough indication of existing traffic; this is not full state tracking.

Static TCP filtering: dynamic-connection limitation

Protocols such as active FTP or H.323 can open additional connections that simple rules do not handle well.

Passive FTP (PASV): filtering advantage

The client initiates the data connection, making outbound-oriented firewall rules easier to apply.

UDP: why static reply filtering is difficult

UDP is connectionless and has no TCP ACK/FIN flags to indicate an established flow.

UDP filtering: DNS example in lecture

Use DNS forwarding and restrict DNS exchanges to the designated upstream resolver's IP address.

State table

Tracks communication context so the firewall can distinguish expected return traffic from unrelated packets.

SPI: TCP checks listed

Can track sequence numbers and connection information for incoming and outgoing packets.

SPI: UDP handling

Tracks recent UDP flows even though UDP itself is connectionless.

SPI: additional capabilities listed

May provide session authentication and application inspection; capabilities depend on the implementation.

SPI versus proxy: endpoint relationship

SPI still forwards packets between the original hosts; a proxy terminates and relays separate communications.

Blocked traffic: three responses listed

Send ICMP host unreachable, send an administrative-prohibition response, or silently drop.

Silent drop: tradeoff

Reveals less explicit firewall information but can cause retries that waste bandwidth and resources.

Administrative-prohibition response: drawback

Explicitly tells the sender that policy is blocking the traffic.

Packet filters: main strength

High speed; may approach line rate.

Packet filters: limitations emphasized by lecture

Direct host communication and limited user authentication, authorization, and logging in basic filters.

Bridge: OSI layer

Layer 2; forwarding uses destination Layer 2 addresses rather than Layer 3 routing information.

Switch: relation to a bridge

A multiport bridge.

LAT: expansion and purpose

Local Address Table; maps Layer 2 addresses to physical ports.

Bridge promiscuous mode: lecture explanation

Bridge interfaces receive traffic needed to learn addresses and forward frames.

Bridging loops: consequence

Broadcast storms and frames circulating repeatedly.

Spanning tree: purpose

Prevents forwarding loops in a bridged network.

Filtering bridge

A bridge containing a packet filter; useful when routing or address assignments cannot be changed.

Filtering bridge: noncontiguous address advantage

Protects selected hosts on the same Layer 3 segment without requiring their addresses to form a routable aggregate.

Filtering bridge: interface requirement

A dedicated target interface or VLAN, according to the slides.

Filtering bridge: best practices

Prefer routing when practical; leave the target NIC without an L3 address; avoid mixing bridge-source and routing/NAT-target roles on one interface.

Routing: OSI layer and purpose

Layer 3 forwarding between interfaces/networks using IP addressing and routes.

Standard routing: course preference

Preferred when possible for Internet servers because it adds the least latency of the compared methods.

Standard routing: addressing requirement

Addresses must be valid in the relevant internetwork; private and link-local addresses are not publicly Internet-routable.

RFC 1918 private IPv4 ranges

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

IPv4 link-local range

169.254.0.0/16; not a publicly Internet-routable range.

NAT: expansion and basic function

Network Address Translation; rewrites IP addresses as traffic crosses a device.

NAT outbound mapping

Rewrites the internal source address to a public-facing address.

NAT inbound mapping

Rewrites the public destination address to the internal target address.

Static NAT: course abbreviations

SNAT or 1:1 NAT in these slides. Here SNAT means static NAT; in other contexts it often means source NAT.

Static NAT: mapping

One internal IP address maps to one unique external IP address.

Static NAT: protocol layer

Layer 3 address translation.

Static NAT: public-address conservation

Does not reduce the number of public addresses required for the mapped hosts.

Static NAT: incoming and outgoing connections

Supports both, subject to firewall rules.

Static NAT: suggested use in lecture

When inbound connections are required, especially for a small number of private-addressed DMZ servers.

Static NAT: scaling cost in lecture

Binding many public addresses to an interface adds inspection work and can encounter platform limits.

Dynamic NAT: course abbreviations

DNAT or PAT in these slides. Here DNAT means dynamic NAT; in other contexts it commonly means destination NAT.

PAT: expansion and mapping

Port Address Translation; lets many private hosts share one public IP by distinguishing sessions using ports.

PAT versus static NAT: address use

PAT shares one public address among many hosts; static NAT reserves a distinct public address per mapped host.

Port forwarding

Maps incoming traffic for a public-facing port to a specified internal host/service.

Port forwarding: limitation in the lecture model

A given public port mapping targets one internal host; different ports can target different hosts.

Dynamic NAT/PAT: preferred zone in lecture

Private client networks, where connections normally originate internally.

PAT: security limitation

Unsolicited inbound connections are normally blocked without a mapping, but established outbound sessions can still carry malicious traffic.

NAT traversal: purpose

Lets applications discover external addressing or establish communication through NAT mappings.

Both peers behind PAT: challenge

Neither peer normally accepts unsolicited incoming traffic, and each may lack knowledge of its public IP/port mapping.

NAT-PMP and UPnP IGD: function

Let a local application request a mapping/opening from the NAT gateway.

NAT-PMP and UPnP IGD: lecture assessment

Convenient for home networks but a security concern in enterprise environments.

Automatic NAT mapping: application examples

Gaming, peer-to-peer sharing, remote desktop, IoT, and VoIP.

ICE: full name and purpose

Interactive Connectivity Establishment; coordinates address discovery and connection options for NAT traversal.

ICE: process summarized in the slides

Collect local addresses, learn public mappings through STUN, evaluate connectivity, and select direct or relayed communication.

STUN: central function

A public server reports the source IP address and port it observes, revealing the client's external mapping.

STUN: binding request

Client sends a request; server responds with the observed source address and port, which can differ from the client's local values.

Full-cone NAT: mapping in the slides

Traffic from a given internal IP/port uses the same external mapping across destinations.

Symmetric NAT: mapping in the slides

An internal IP/port receives different external mappings for different destinations.

STUN versus symmetric NAT

The mapping observed by the STUN server may not apply to another destination; STUN alone cannot solve this case in the lecture model.

TURN: full name

Traversal Using Relays around NAT.

TURN: function

Relays traffic through a public server when a direct path cannot be established, including strict/symmetric NAT cases.

TURN: connection sequence

Client reserves a relay address/port, shares it with the other endpoint, and traffic is forwarded through the relay.

TURN: advantages listed

Works behind strict NAT/firewalls; supports UDP, TCP, and TLS; useful for WebRTC and VoIP.

TURN: disadvantages listed

Consumes relay bandwidth, increases operating cost, and adds latency.

STUN versus TURN

STUN discovers a public mapping; TURN carries the actual traffic through a relay.

ALG: full name

Application Layer Gateway.

ALG: host isolation

Internal and external hosts communicate through a proxy that maintains separate communications on each side.

ALG: inspection capabilities

Application-level checks such as web content filtering, spam filtering, and malware filtering.

ALG: dynamically opened ports

Can inspect a protocol's control channel to manage additional connections, such as active FTP or H.323.

ALG: protocol-specific requirement

Needs support for the particular application protocol being proxied.

Hybrid firewall

Combines packet filtering with selected ALG/proxy features and may support bridging, routing, and NAT.

Firewall throughput

Bytes per second; comparison can be misleading when packet sizes and traffic protocols differ.

Packet forwarding rate

Packets per second; the lecture prefers it for comparing packet-processing performance.

Why packet inspection adds latency

Packets must be buffered and checked before forwarding; state lookups and NAT rewrites add processing.

Firewall methods: lecture latency order, lowest to highest

Standard routing, bridging, static NAT, dynamic NAT/PAT, application layer gateways.

ALG: why high latency in the lecture comparison?

Maintains two separate sessions and performs application-level processing.

Defense in depth

Multiple complementary security layers; a firewall alone does not secure the entire environment.

Public zone

The untrusted Internet-facing network.

Private zone

Network isolated from unsolicited public access; filtered outbound connections may still be allowed.