|
Adaptive Firewalls with iptables |
|
|
|
Source: Sans.org - Posted by Benjamin D. Thomas
|
Up until now, we've looked at stateless and stateful firewalls. Remember, stateless firewalls only have the
features of a given packet to use as criteria for whether that packet should be passed, blocked, or logged. With
a stateful firewall, in addition to the fields in that packet, we also have access to the kernel's table of open
connections to use in deciding the fate of this packet.
There's a problem, though. Picture an attacker that has launched attacks against almost every port on our web
server box for the past half hour. The firewall has successfully repelled all of them, but now the attacker turns
her attentions to port 80. All of the hostile overflow attempts are let through unhindered. Why? Because the
firewall ruleset allows all traffic to the web server through, and our firewall can't remember the fact that this
IP address has been pounding all the other ports on the system.
What if we could tell the firewall to remember the IP address of attackers and block them for a short period of
time following their last attack? By remembering their past actions, we can block incoming web server
connections that would otherwise have been allowed.
Read this full article at Sans.org
Powered by AkoComment! |
