This chapter is from the book
This chapter is from the book
This chapter is from the book
Filtering Outgoing Packets
If your environment represents a trusted environment, filtering outgoing packets might not appear to be as critical as filtering incoming packets. Your system won’t respond to incoming messages that the firewall doesn’t pass through. Residential sites often take this approach. Nevertheless, even for residential sites, symmetric filtering is important, particularly if the firewall protects Microsoft Windows machines. For commercial sites, outgoing filtering is inarguably important.
If your firewall protects a LAN of Microsoft Windows systems, controlling outgoing traffic becomes much more important. Compromised Windows machines have historically been (and continue to be) used in coordinated DoS attacks and other outbound attacks. For this reason especially, it’s important to filter what leaves your network.
Filtering outgoing messages also allows you to run LAN services without leaking into the Internet, where these packets don’t belong. It’s not only a question of disallowing external access to local LAN services. It’s also a question of not broadcasting local system information onto the Internet. Examples of this would be if you were running a local DHCPD, NTP, SMB, or other server for internal use. Other obnoxious services might be broadcasting wall or syslogd messages.
A related source is some of the personal computer software, which sometimes ignores the Internet service port protocols and reserved assignments. This is the personal computer equivalent of running a program designed for LAN use on an Internet-connected machine.
A final reason is simply to keep local traffic local that isn’t intended to leave the LAN but that conceivably could. Keeping local traffic local is a good idea from a security standpoint but also as a means for bandwidth conservation.
Local Source Address Filtering
Filtering outgoing packets based on the source address is easy. For a small site or a single computer connected to the Internet, the source address is always your computer’s IP address during normal operation. There is no reason to allow an outgoing packet to have any other source address, and the firewall should enforce this.
For people whose IP address is dynamically assigned by their ISP, a brief exception exists during address assignment. This exception is specific to DHCP and is the one case in which a host broadcasts messages using 0.0.0.0 as its source address.
For people with a LAN whose firewall machine has a dynamically assigned IP address, limiting outgoing packets to contain the source address of the firewall machine’s IP address is mandatory. It protects you from several fairly common configuration mistakes that appear as cases of source address spoofing or illegal source addresses to remote hosts.
If your users or their software aren’t 100% trustworthy, it’s important to ensure that local traffic contains legitimate, local addresses only, to avoid participating in DoS attacks using source address spoofing.
This last point is especially important. RFC 2827, “Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing” (updated by RFC 3704, “Ingress Filtering for Multihomed Networks”), is a current “best practices” document speaking to exactly this point. Ideally, every router should filter out the obvious illegal source addresses and ensure that traffic leaving the local network contains only routable source addresses belonging to that network.
Remote Destination Address Filtering
As with incoming packets, you might want to allow certain kinds of outgoing packets to be addressed only to specific remote networks or individual machines. In these cases, the firewall rules will define either specific IP addresses or a limited range of IP destination addresses to which these packets will be allowed.
The first class of outgoing packets to filter by destination address is packets destined to remote servers that you’ve contacted. Although some packets, such as those going to web or FTP servers, can be expected to be destined to anywhere on the Internet, other remote services will legitimately be offered from only your ISP or specially chosen trusted hosts. Examples of services that are probably offered only through your ISP are mail services such as SMTP or POP3, DNS services, DHCP dynamic IP address assignment, and the Usenet news service.
The second class of outgoing packets to filter by destination address is packets destined to remote clients who are accessing a service offered from your site. Again, although some outgoing service connections, such as responses from your local web server, can be expected to be going anywhere, other local services will be offered to only a few trusted remote sites or friends. Examples of restricted local services might be telnet, SSH, Samba-based services, and RPC services accessed via portmap. Not only will the firewall rules deny general incoming connections to these services, but the rules also won’t allow outgoing responses from these services to just anyone.
Local Source Port Filtering
Explicitly defining which service ports on your network can be used for outgoing connections serves two purposes—one for your client programs and one for your server programs. Specifying the source ports allowed for your outgoing connections helps ensure that your programs are behaving correctly, and it protects other people from any local network traffic that doesn’t belong on the Internet.
Outgoing connections from your local clients will almost always originate from an unprivileged source port. Limiting your clients to the unprivileged ports in the firewall rules helps protect other people from potential mistakes on your end by ensuring that your client programs are behaving as expected.
Outgoing packets from your local server programs will always originate from their assigned service port and will be in response to a request received. Limiting your servers to their assigned ports at the firewall level ensures that your server programs are functioning correctly at the protocol level. More important, it helps protect any private, local network services that you might be running from outside access. It also helps protect remote sites from being bothered by network traffic that should remain confined to your local systems.
Remote Destination Port Filtering
Your local client programs are designed to connect to network servers offering their services from their assigned service ports. From this perspective, limiting your local clients to connect only to their associated server’s service port ensures protocol correctness. Limiting your client connections to specific destination ports serves a couple of other purposes as well. First, it helps guard against local, private network client programs inadvertently attempting to access servers on the Internet. Second, it does much to disallow outgoing mistakes, port scans, and other mischief potentially originating from your site.
Your local server programs will almost always participate in connections originating from unprivileged ports. The firewall rules limit your servers’ outgoing traffic to only unprivileged destination ports.
Outgoing TCP Connection State Filtering
Outgoing TCP packet acceptance rules can make use of the connection state flags associated with TCP connections, just as the incoming rules do. All TCP connections adhere to the same set of connection states, which differs between client and server.
Outgoing TCP packets from local clients will have the SYN flag set in the first packet sent as part of the three-way connection establishment handshake. The initial connection request will have the SYN flag set, but not the ACK flag. Your local client firewall rules will allow outgoing packets with either the SYN or the ACK flag set.
Outgoing packets from local servers will always be responses to an initial connection request initiated from a remote client program. Every packet sent from your servers will have the ACK flag set. Your local server firewall rules will require all outgoing packets from your servers to have the ACK flag set.