UNDERCODE COMMUNITY

🦑 Enhance network security with SYN packet features full by undercode :

1) Consider the following situation: the
internal network is 198.199.1.0, using linux as a router and firewall to connect to the Internet. On the firewall, eth0 connects to the external network and eth1 connects to the internal network.

2) For the security of the www service, set the following set of ipchains rules:

> ipchains -A input -p tcp -s 198.199.1.0/24: 1024 -d 0.0.0.0/0 www -i eth1 -j ACCEPT

> ipchains -A input -p tcp -s 0.0.0.0/0 www -d 198.199.1.0/24 1024: -i eth0 -j ACCEPT

> In the above settings, only internal users are allowed to access www hosts on the Internet through ports above 1024 (undefined port) ; In other words, allow ports greater than 1024 on the intranet host to connect to port 80 on the Internet. Imagine that this will allow hosts on the Internet to use port 80 to connect to a port on your intranet host that is greater than 1024. From this, we see that there is a security risk in the system because there are many service ports that are greater than 1024. So, how to overcome this hidden danger, we can use the characteristics of the SYN package to eliminate this hidden danger.

3) Let us first take a look at the flag bit of the TCP data segment header. There are six flag bits in TCP, namely: URG, ACK, PSH, RST, SYN and FIN. Let's focus on the ACK, SYN and FIN flags.

4) ACK: indicates whether the confirmation number is legal, 1 means legal, and 0 means the confirmation number is invalid. The acknowledgment number refers to the next byte you want to receive instead of the bytes that have been received previously. It can be seen that the ACK of the packet that initiated the connection establishment request (that is, the first packet) is always set to 0, and the subsequent packets are always set to 1.

5) SYN: used to establish a connection. In the connection request, SYN = 1, in the connection request confirmation, SYN = 1. Therefore, SYN stands for CONNECTION REQUEST and CONNECTION ACCEPTED. In subsequent TCP packets, SYN is always set to 0.
FIN: used to cancel the connection.

6) The above can be summarized with the following table:

ACK flag bit SYN flag bit The meaning of the TCP packet
0 1 connection request
1 1 connection request confirmation (accept connection request)
1 0 confirmation connection request confirmation
1 0 data packet
... ...

our so-called SYN packet is a connection request packet. As shown above, the SYN packet has the following characteristics: SYN = 1, ACK = 0, FIN = 0. Therefore, in order to filter connection request packets, it is sufficient to filter out SYN packets.

In ipchains, we can specify the SYN package like this:
-p tcp -s xxxx / x -y

7) If you can define all SYN packages from 192.168.1.0 like this:
-p tcp -s 192.168.1.0/24 -y
we can also Precede -y to define all non-SYN packets:
-P tcp -s xxxx / x! -Y

8) So, in the above example, we can enhance the security of the network like this:

ipchains -A input -p tcp -s 198.199.1.0/24: 1024 -d 0.0.0.0/0 www -i eth1 -j ACCEPT
ipchains -A input -p tcp -y -s 0.0.0.0/0 www -d 198.199.1.0/24 1024:! -i eth0 -j ACCEPT

🦑 This will prohibit the use of hosts on the Internet 80 port to connect to your internal network host A port greater than 1024, so as to achieve the purpose of enhancing network security.

Reference materials:
1. IPCHANIS-HOWTO
2. Internet firewall domain network security
3. Computer network
written by undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

90 views15:45