Strategi - Membangun - Firewall - Dengan - Mikrotik - 1

MikroTik Router OS Firewall Strategies
o m
.i c
o b
o
MikroTik Router OS Network Threats and Countermeasures
ah Speaker: Tom Smyth

CTO Wireless Connect Ltd.
s Location:
Date:
Wroclaw, Poland
1st of March
http://wirelessconnect.eu/ Copyright 2007 -2010 1

Wireless Connect Ltd.
● Irish Company Incorporated in 2006
o m
● Operate an ISP in the centre of Ireland.
.i c
b
● Good Infrastructure Expertise.
o
● Certified MikroTik Partners
o
– Training
h
– Certified OEM Integrators
a
– Consultants
s
– Distributor & Value Added Reseller

Speaker Profile:
● Studied BEng. Mechanical & Electronic Engineering, DCU,
o m
c
Ireland
Have been working in Industry since 2000
.i
●
b
– Server Infrastructure Engineer
o
– Systems / Network Administrator
o
– IS Architect
h
– Internet Security Consultant
a
st
●
1 MikroTik Certified Trainer in June 2007 in Ireland
s http://wirelessconnect.eu/ Copyright 2007 -2010 3

Ogma Connect
● A Collaborative Effort involved in the development and
o m
.i c
support of MikroTik Powered Appliances
● Ogma Connect's name comes from the Ancient God of
b
Communications and eloquence who's name was Oghma
o
Oghma was credited with the invention of the written
●
o
language Ogham which is found carved in stones that mark
h
the land of ancient tribes throughout the once vast Celtic
world in northern & western Europe
●
s a
We want people to be able to connect with each other
eloquently efficiently and elegantly

Presentation Objectives
● IP v4 Firewall Systems Concepts
o m
c
Outline what a firewall can and can not do
.i
●
● Discuss Prevalent Network Attacks and Mitigation
b
Strategies
o
● Structure the Firewall
o
In a security centric manner
–
ah
Create policy based rule sets
Protocol Specific Filtering
s
●
– Proxy Specifically Http Proxy

Sources of Security Information
● ENISA –http://www.enisa.europa.eu/
o m
c
OWASP http://owasp.org
.i
●
● Rits Group – http://www.ritsgroup.com/

● SANS Institute – http://sans.org
o b
CIS Centre for Internet Security – http://cisecurity.org/
o
●
h
● NIST Computer Security http://csrc.nist.gov/
a
● Open BSD – http://OpenBSD.org/
s
● Spamhaus.org – http://spamhaus.org
● nmap.org – http://nmap.org
● ha.ckers.org – http://ha.ckers.org/
Firewall Systems
● One or more systems combined to achieve a desired
o m
c
security objective
There are multiple ways firewall systems handle traffic
.i
●
b
– Routing
o
– NATing
o
– Bridging
h
– Proxying
s a
Firewall Design Objectives
● To implement a security policy by classifying, validating,
o m
c
logging and ultimately reacting to traffic
Flowing to the system
.i
–
b
– Flowing through the system
o
– Flowing from the system
o
● Legitimate / useful traffic for users and systems should:
h
– Not be Blocked
a
– Not be Corrupted
s
– Not be Slowed or Hampered Beyond Strict Tolerances
● Protect the users / systems behind it and Itself

Firewall Capabilities
● Can Identify traffic according to the following
o m
c
– Entry interface
.i
– Exit interface
– Source Address (Source Address List)
b
– Destination Address (destination Address List)
o
– Address Types
– Protocol type (number)
o
– Protocol port (source and destination
– Message type (ICMP)
h
– State of the Connection
a
– IP V4 Options
– TCP Flags
s
– Number of Concurrent Connections
– Packet Rate
– Packet Size
– Packet Fragmentation
– Layer 7 Packet Matching (unencrypted)

Firewall Limitations
● Firewalls generally have difficulty with the following
o m
c
Protocol Validation / Filtration
.i
–
– Deep packet inspection beyond the first 10 packets /
b
2.5KB of data in the stream
o
– Inspection of encrypted data streams such as
o
● Ssh sessions
h
● Https
Ipsec
a
●
TLS Protected Connections
s
●

Firewall Limitations … Dont Worry
● Proxies pick up where firewalls leave off...
o m
c
Proxies allow fine control over specific protocols :)
.i
●
● Limitations are not a problem for inherently safe protocols

●
damage limitation.
o b
For unsafe protocols proxies help can provide some
h o
s a
o m
Proxy .i c
o b
h o
s a
What is a Proxy
● It a service that accepts connections from a client and in
o m
c
turn makes a request to another server.
2 Connections for each Accepted Request
.i
●
b
– Client to the proxy
o
– Proxy to the Server
o
● 1 Connection for each Rejected Request
h
● HTTP Firewall (understands http)
a
– RFC Compliance Checking
s
– Blocking non http protocols running on port 80
– Disable Certain Dangerous Requests
– Block Content

Proxy Limitation
● Cant Reverse Proxy SSL / TLS Settings :(
o m
c
However one can use Stunnel to decrypt the SSL Traffic
.i
●
before it hits the reverse proxy :)
o b
h o
s a
Example Http Reverse Proxy
o m
.i c
o b
h o
s a
Web Client Makes Https Request
o m
.i c
o b
h o
s a
Stunnel Decrypts the Request & forwards to
Reverse Proxy
o m
.i c
o b
h o
s a
Reverse Proxy Analyses Request
o m
.i c
o b
h o
s a
Proxy Accepts & Relays Request
o m
.i c
o b
h o
s a
m
Http Server Responds to Proxy Request
.i c o
o b
h o
s a
Proxy forwards Response to Stunnel
o m
.i c
o b
h o
s a
Client receives the Webpage
o m
.i c
o b
h o
s a
What if the Proxy Says No?
o m
.i c
o b
h o
s a
Proxy Sends Error Msg To Stunnel
o m
.i c
o b
h o
s a
Client Recieves Error Message
o m
.i c
o b
h o
s a
Http Proxy / Reverse Http Proxy
● Identical
o m
c
Http Proxy serves to protect clients
.i
●
● Http Reverse Proxy serves to protect servers

●
o b
Http Proxy can access any Server from a few clients
Http Reverse Proxy can access few servers and is
o
●
available to any client.

●
a
Resolution.
h
Http Proxy Utilises External DNS Servers for Name
s
Http Proxy uses a local DNS for Name Resolution

Reverse Proxy Setup
● Same as a standard Proxy Setup Except for the Following
o m
c
Changes
Proxy Listens on Port 80 (or redirect to proxy port)
.i
●
b
● Static local DNS entries are setup on reverse proxy
o
● External DNS servers point protected hostnames at the
o
external IP of the Reverse Proxy
h
● Proxy is heavily firewalled, usual precautions apply
a
Firewall Rules, no outbound connections allowed except for
●
–
s
Http tcp port 80 to your webserver Network
Syslog udp port 514
NTP Server Requests udp port 123
Http Firewall
● Proxy access list provides option to filter
o m
c
DNS names
.i
–
– Urls
b
– Filetypes
o
– Url paths designed to hack http servers
o
– Ports
h
– IP address
a
● You can make redirect to specific pages
●
●
s
Home page of your website
Custom Error Pages giving as much or as little information
as you require
Http Firewall Building Aproach
● Block Unwanted Requests for telnet, smtp, ftp ports
o m
c
Block Unwanted / Unrequired Http Methods
.i
●
● Block URL Paths containing Dangerous Characters

● Prevent IP Obfuscation Requests
Allow White listed Servers
o b
o
●
h
● Deny access to dissalowed ports
a
● Deny Proxying access to Local Networks
s
● Deny Proxying access to any other system.

Block / Allow Selected Http Methods
● Only allow Required Methods (Safest)
o m
c
– HEAD
.i
– GET
b
– POST
o
● Block potentially dangerous Types of HTTP Methods
o
– TRACE
– CONNECT
h
– DELETE
a
– PUT
s
– OPTIONS

Example of Http firewall Rules
o m
.i c
o b
h o
s a
Path Rule Example
● http://example.com/index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
o m
.i c
o b
h o
s a
Web Proxy Access Rule
● Add an access rule as follows
o m
.i c
o b
h o
s a
m
Protecting sensitive files in
poorly configued Servers
● Deny access to following url paths
– Any “.” Files in linux
.i c o
– /etc/
/etc/shadow
o b
o
–
/var/mysql/
h
–
/var/log
a
–
s
– /system32
– /sysWOW
– /WinNT /Winnt

Proxy Limitation
● ASCII Character codes are not evaluated by proxy but are
o m
c
by webservers
e.g. ros.php =%2F%72%6F%73%2E%70%68%70
.i
●
b
● http://example.com/ros.php
o
● =
o
http://example.com%2F%72%6F%73%2E%70%68%70
●
● =
ah
s
● http://example.com/72%6F%73.%70h%70
● Solution use Regular expressions :)

Regular expression example
● We want to block any requests containing .. to guard
o m
c
against a infamous flaw in IIS a few years ago.
.i
● http://poorlyimplementedserver.com/../../WINNT/System32/CMD.exe
b
● We need to block .. and any ascii character codes for the
o
same
o
● Required Expression= (\.|%2E)(\.|%2E)
h
● Regular Expressions are denoted in MTROS by entering a
a
preceeding “:”
s
● Path to block = :(\.|%2E)(\.|%2E)

Block urls containing ..
o m
.i c
o b
h o
s a
Characters required for attacks
● The Following Characters can be used in attacks against
o m
c
web servers
< > ( ) ; ^ , $ “
.i ` ' ~ * | \ # ! :
–
b
– “ Double Quotes
o
– ' Single Quotes
o
– ` Grave Accent
h
– %0A Line Feed
a
– %0D Carrige Return
s
●

● The following Combination s of characters can be used in
o m
c
attacks against the web servers
@@
.i
–
b
– --
o
– ://
h o
s a
o m
.i c
o b
h o
s a
IP Address Obfuscation
● Wirelessconnect.eu IP address can be represented in the
o m
c
following ways
Decimal –
.i 89.184.47.93
–
b
– Dword Address – 1505242973
o
– Hex Address – 0x59.0xb8.0x2f.0x5d
o
– Octal Representation – 0131.0270.0057.0135
h
– Why Does this Work? – 89.0xb8.0057.0x5d
s a
Combating IP Obfuscation
o m
.i c
o b
h o
s a
White Listing Example
● We want to allow GET, POST & HEAD to the webserver
o m
c
wirelessconnect.eu
.i
●
b
●
o
●
o
●
ah
s
● Remember to always put url path filtering rules above the
host whitelist rules

Last rules of any reverse proxy
● Place the following rules below the host whitelists
o m
.i c
o b
h o
s a
POST HTTP Method Analysis
● Not Possible with MT HTTP Proxy
o m
c
Need web application knowledge.
.i
●
● Web application must have built in validation
o b
h o
s a
Modular Firewall System Example
o m
.i c
o b
h o
s a
Firewall hardening
● Some of the checks may be duplicated, this is ok, belt and
o m
c
braces.
Check for unusual TCP Flags and drop.
.i
●
b
● Drop packets with invalid connection state
o
● Your Effort will complement and bolster your networking
o
operating software provider's efforts to maintain security
h
● Ultimately you are responsible for your networks security
s a
Firewall Best Practices
● Populate a Router with the Maximum RAM Configuration
o m
c
Use Connection Tracking to achieve state-full packet
.i
●
inspection & perform fragmented packet reassembly
b
● Disable Administration interfaces from External Interfaces
o
● Try where possible to use in interfaces rather than source
o
ip address for establishing the level of trust that you have
h
for the
s a
Firewall System Best Practices
● Run as few network services on the firewall hardware as
o m
c
possible
Turn off all Administration services that are not needed
.i
●
b
● Do not use un-encrypted administration protocols
o
● Shore up un-encrypted services with IPSEC policies
SNMP
o
–
ah
DNS (internal use not for customer use)
Http fetch
●
s
Shore up weak encrypted protocols with IPSEC policies

Disable Un-needed services
● Drastically reduces attack surface of your firewall.
o m
c
If a service has a vulnerability your firewall can be
.i
●
compromised (stability, availability, integrity)
b
● Administration Services are particularly risky as they allow
o
for the change of firewall configuration
o
● DNS Server services should be offloaded to a Hardened
h
DNS Box
a
● NTP Server services should be offloaded to a Hardened
s
NTP Box

Unencrypted Administration Risk
● Vulnerable to Sniffing / Replay attacks.
o m
c
Can allow an attacker who can view the traffic to harvest
.i
●
user authentication credentials
b
● IPSEC can eliminate this risk by securing the traffic with the
o
best available FIPS grade cryptography protocols
o
● IPSEC can be used to increase confidence if encryption
h
quality of an administration service is unknown.
s a
More RAM – More Connections
● NSA Security Guide for Routers suggests that Perimeter
o m
c
routers /firewalls be configured with the maximum available
.i
RAM
b
● The More RAM you have the harder the device is to Crash
due to memory exhaustion (DOS / DDOS attacks)
●
Attacks.
o o
MT ROS Devices are Optimised against RAM Exhaustion
ah
The firewall can cope better in busy periods.
s
● Ogma Connect Routers are always Sold with the maximum
Supported RAM available :)
● Wireless Connect Customers can avail of RAM upgrades
for RB1000 & the New and Improved RB1100 :)
m
Hardware with multiple Physical
Interfaces
● The More Interfaces the more you can isolate multiple
untrusted interfaces.
.i c o
●
o b
For Clients who require higher levels of Secuity assurance.
o
● Please Check Out my colleague Wardner Maia's
h
Presentation on Layer 2 Threats and Countermeasures.
s a
Hardware fit for the Job :)
● As you have seen from the My colleague and Friend Patrik
o m
.i c
Schaub's presentation on Mikrotik Datacentre products.
o b
h o
s a
RB 1100
● 13 Interfaces :) so greater control of your network
o m
.i c
●
o b
Available from Wireless Connect Shortly.
o
●
ah
Ogma Connect 2500
● 11 GBE Interfaces by Default
o m
c
Up to 19 GBE with Expansion Cards
.i
●
o b
h o
s a
Connection Tracking
● ConTrack carries out the following essential tasks
o m
c
It monitors the state of all connections / requests flowing
.i
–
in the firewall
b
– Allows the firewall to dynamically open / close ports
according to the connection state in the firewall
–
o o
Performs IP Packet Reassembly before inspection
(prevents IP Fragment Attacks)
ah
Filter Administration Services
● Minimise Risk from outside attacks
o m
c
Allow Flexibility of management internally
.i
●
o b
h o
s a
Firewall Setup Strategy
● Turn on connection tracking
o m
c
Break down the security policy into functional groups
.i
●
● Use chains to define these functional groups

●
o b
Granularly control settings within the chains /groups
Make use of Address lists group hosts together
o
●
ah
List Objectives (policies)
● We want to
o m
c
Detect / Block Traffic to / from Invalid Addresses
.i
–
– Detect / Block Traffic that have a large packet size
b
– Detect / Block Traffic that has unusual characteristics
o
– Detect / Block Traffic from Port Scanners
o
– Detect / Block Traffic from Brute Force Hackers
h
– Once Traffic has been inspected don't keep reprocessing the
same connection.
–
–
s a
Analyse Traffic originating from and Leaving router
Protect Traffic Entering and destined for the router.
Update some Rules dynamically (Self Defending Networks)

Invalid Addresses
● Bogons (source and destinations)
Un allocated addresses
o m
c
–
.i
– Remove (Special Purpose Allocated Addresses)
● Allocated Special Purpose:
b
– Multicast Addresses (source addresses only) 224.0.0.0/4
o
● Broadcast Addresses 255.255.255.255
o
Connected Network Broadcast addresses such as
●
h
– 192.168.0.255 if the router has an ip address of 192.168.0.x/24
a
– 192.168.0.127 if the router has an ip address of 192.168.0.x/25
s
● Private IP Addresses
● Test IP Addresses 192.0.2.0/24
● Loopback Addresses 127.0.0.0/8
Block invalid packets with IP
Broadcast source address
o m
.i c
o b
h o
s a
Blocking IP Directed broadcast
● In forward chain create a rule with “destination address
o m
c
type” = Broadcast.
Example of IP Directed broadcast 192.168.1.255
.i
●
o b
h o
s a
Blocking IP Directed Broadcast
o m
.i c
o b
h o
s a
m
Block Bad People Dynamic
updates
● Reference Spamhaus DROP List (Dont Route or Peer)
updated Weekly
.i c o
b
Reference SANS ISC Top 10 – 10000(optional if you wish)
●
every month
o o
Bogons (un allocated not special Purpose) Updated a circa
ah
m
Updating Address Lists
automatically
● Use a combination of Scheduler and Scripting tools, and
Fetch.
.i c o
b
Fetch is very good because of the ability to use DNS
●
o
Addresses for ease of management.
o
● Security Concerns...Updates traversing untrusted networks
h
Use IPSEC Policy for fetch tool,
–
a
ensure DNS Requests don't traverse untrusted networks
–
–
s or
Use Static DNS

m
Address List Update Script
Sample
:global oldbogoncount;
:global totalbogoncount;
.i c o
b
/ip firewall address-list set comment="oldbogons" [/ip firewall address-list find list=bogons_address_list]
:set oldbogoncount [ip firewall address-list print count-only value-list where list=bogons_address_list];
o
/tool fetch mode=http url="http://wirelessconnect.eu/store/images/bogonsnoprivate.rsc"
o
import bogonsnoprivate.rsc
h
:set totalbogoncount [ip firewall address-list print count-only value-list where list=bogons_address_list];
:if ($oldbogoncount < $totalbogoncount) do {/ip firewall address-list remove [/ip firewall address-list find comment="oldbogons"] }
s a
Block Packets with Large Size
● Block Packets larger than 1500 bytes to protect legacy
o m
c
clients.
b .i
o o
ah
Block Un-needed IP Options
● Strict Source Route
o m
c
Loose Source Route
.i
●
● Route Record
● Timestamp
Router Alert (if not using
o b
o
●
RSVP)
ah
Block Port Scanners
● Detect Nmap Scan types (TCP)
o m
c
Christmas Tree
.i
–
– SYN FIN
b
– FIN
o
– ALL
– SYN/RST
●
Detect TCP
h o
Detect using MT Port Scan
a
Detect and drop scans using
●
s
ICMP Messages out bound
– (Port Unavailable)
– Communications Prohibited

Port Scan Detect
● TCP Scans Detected
o m
c
Directly
UDP Scans indirectly
.i
●
b
● Drop UDP Scans /
o
Results of UDP
Scans (ICMP)
●
h o
Add big offenders to
Port Scanners
a
blocking list

Checking Rate of matches
● For blacklisting
o m
c
obvious UDP
.i
Scanners
b
● Limit the speed of a
scan for 120 ports
per minute
o o
ah
Blocking the UDP Attacker
● Use Add Dst Address
o m
c
to Address List action
b .i
o o
ah
Brute Force Detection
● Depends on server disconnection after failed authentication
o m
c
attempts.
.i
Requires that any one administration session is maintained
●
b
as continuous established connection.
o
● Based on some cool ideas from the MT User Community
o
– On First Connection ( First authentication attempt) add src to
h
Management Light Grey List
On Second Connection add src to Management Grey List
a
–
s
– On Third Connection add src to Management Dark Grey List
– On Fourth Connection add src to Management Black List
● Then insert Rule to Block members of the Management
Black List this List on the Router
m
Sending Protocols to bruteforce check
o
● Send selected protocols to the Brute Force Check Chain
.i c
o b
h o
s a
Brute Force Detection
o m
.i c
o b
h o
s a
Last Rule in Detection Chain
● Accept new connection as long as Src Address is not in the
o m
c
management Black List
.i
●
o b
h o
s a
Further Reading
● For more information on firewall rules click on
o m
c
Http://wirelessconnect.eu/layer3_subscriptions
.i
Sign up for an account and we will send you instructions for
●
b
setting up the firewalls and Proxies when they are publicly
released after the MUM
● http://wiki.mikrotikl.com
o o
ah

Strategi - Membangun - Firewall - Dengan - Mikrotik - 1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Strategi - Membangun - Firewall - Dengan - Mikrotik - 1

Uploaded by

Copyright:

Available Formats

MikroTik Router OS Firewall Strategies

ah Speaker: Tom Smyth

http://wirelessconnect.eu/ Copyright 2007 -2010 1

http://wirelessconnect.eu/ Copyright 2007 -2010 2

s http://wirelessconnect.eu/ Copyright 2007 -2010 3

http://wirelessconnect.eu/ Copyright 2007 -2010 4

● Discuss Prevalent Network Attacks and Mitigation

– Proxy Specifically Http Proxy

http://wirelessconnect.eu/ Copyright 2007 -2010 5

● Rits Group – http://www.ritsgroup.com/

http://wirelessconnect.eu/ Copyright 2007 -2010 8

http://wirelessconnect.eu/ Copyright 2007 -2010 9

– Deep packet inspection beyond the first 10 packets /

TLS Protected Connections

http://wirelessconnect.eu/ Copyright 2007 -2010 10

● Limitations are not a problem for inherently safe protocols

http://wirelessconnect.eu/ Copyright 2007 -2010 13

before it hits the reverse proxy :)

● Http Reverse Proxy serves to protect servers

available to any client.

http://wirelessconnect.eu/ Copyright 2007 -2010 26

● Block URL Paths containing Dangerous Characters

http://wirelessconnect.eu/ Copyright 2007 -2010 29

http://wirelessconnect.eu/ Copyright 2007 -2010 30

http://wirelessconnect.eu/ Copyright 2007 -2010 34

http://wirelessconnect.eu/ Copyright 2007 -2010 35

http://wirelessconnect.eu/ Copyright 2007 -2010 36

http://wirelessconnect.eu/ Copyright 2007 -2010 38

http://wirelessconnect.eu/ Copyright 2007 -2010 43

● Web application must have built in validation

inspection & perform fragmented packet reassembly

http://wirelessconnect.eu/ Copyright 2007 -2010 49

compromised (stability, availability, integrity)

http://wirelessconnect.eu/ Copyright 2007 -2010 50

user authentication credentials

● Use chains to define these functional groups

– Detect / Block Traffic that have a large packet size

http://wirelessconnect.eu/ Copyright 2007 -2010 60

http://wirelessconnect.eu/ Copyright 2007 -2010 66

http://wirelessconnect.eu/ Copyright 2007 -2010 70

s http://wirelessconnect.eu/ Copyright 2007 -2010 71

You might also like