Stateful Firewalling:
A network communication is made up of small chunks of data called packets.
In the case of TCP, several of these packets are used solely to create, maintain,
and finish the connection. This is because TCP uses the concept of a connection,
allowing it to automatically correct data errors, interpret incoming packets
in the same order they were sent in, and otherwise keep track of a sustained
connection. Now, how does this relate to packet filters (firewalls)?
Normal “stateless” packet filters, like the ones present on most
routers, inspect each packet individually, with no memory or understanding of
its place in a connection. Now, suppose, like many organizations, you've chosen
not to allow external computers to initiate connections with your internal machines.
A stateless firewall/router can only distinguish a packet that's part of an
existing connection from one that's part of a new connection by reading the
packet's SYN flag.
Re-read that sentence. It has to trust the packet itself.
But wait! A foreign (external) computer created that packet. . . so it can set
the flags any way that it likes! Some network scanners exploit this to bypass firewalls, scanning networks that should have been invisible to it! So, how
do defend ourselves?!
Well, get a stateful firewall! A stateful firewall has a memory of each connection
passing through it. When that foreign packet tries to enter the network, claiming
to be part of an existing connection, the firewall can consult its list of
connections. When it finds that the packet doesn't match any of these, it can
drop that packet and defeat the scan!
Even with the “stateless” UDP protocol, statefulness is still a very
useful feature. Suppose, as before, that you're restricting outside computers
from initiating connections with your internal machines. Well, DNS (computer
name IP address) lookups use UDP [2].
If your routers can't keep track of your DNS requests, they have to allow in
DNS-type (UDP port 53) packets from any DNS server [3]!
A stateful firewall keeps track of all your outgoing DNS requests and only allows
DNS-type (UDP port 53) packets from servers that you've queried and does so
intelligently enough to not keep taking data after the first response.
There's another wonderful advantage to stateful firewalls. They're a whole
lot easier to administer, using a smaller number of rules to create much more
precise firewalling. For the techies here, I offer the example of active FTP.
When your FTP client opens a connection to an FTP server, this is a TCP connection originating at some high port on your client and ending on port 21 on the server.
Whenever you get data, from the directory listing to a full file transfer, a
second connection is opened up. Under active FTP, this connection originates
at the server, on port 20, ending on your client, at some random
high port negotiated between the two hosts. This is backwards! In essence, for
the data channel, your client is acting like a server.
Why is this a
problem? Well, on a stateless “default deny” firewall, where you have
to explicitly list every type of packet that you want to be allowed through
the firewall, it's tough to characterize this connection. In the end, your firewall
says “let every connection through that originates on my clients, and, additionally, allow any machine's TCP port 20 to connect to any high port on
my clients.” This is a kludge and a mess! One reason this makes us uncomfortable
is that attackers have learned to originate their scans from this port, just
to get through these stateless firewalls.
Now, with stateful firewalling, we're
in a much better situation. The firewall is smart enough to monitor the port
negotiation, memorizing what port the data connection will connect to on the
client. It then opens that port, and that port only, rather than the 64512
possible ports on that machine. Not only is this smarter, it's also easy to
configure as it only requires one rule and no kludges.
Stateful firewalls are an incredible and obvious enhancement over stateless.
Every serious enterprise-level firewall incorporates stateful firewalling. That's
not to say that enterprise-level organizations don't use stateless firewalls/routers
too. This connection tracking takes a hell of a lot of memory! Many of these
organizations use stateless devices to block traffic that they never allow from outside, i.e. LAN file sharing (nfs, smb), and follow this up with stateful filtering
to handle the rest.
In any case, statefulness gives your firewall memory, thus
intelligence and power. Its incorporation is an incredible win for Linux. I
strongly recommend that you adopt this stateful technology, whether you use
it via Linux or not.