fwpolicy - a Firewall Policy toolset
$Id: fwpolicy.html,v 1.2 1999-03-11 10:58:11-08 jhardin Exp jhardin $
Introduction
fwpolicy is a project that I've recently become interested
in trying to implement. I've written a
firewall
GUI for Linux that's been fairly well received, but needs updating for
the newer kernels. I've also had comments that a GUI doesn't work
particularly well for vision-impaired users, and I've noticed a lot of
questions about "how do I redirect traffic to a web server behind my
firewall" and the like on the Linux newsgroups - a management issue that
I'd like to simplify.
After some thought about these issues (migration, accessibility, etc.) I
decided that the proper approach is to separate the problem domain into
three parts:
- The definition of the firewall - the configuration of the
network topology and desired firewalling should be described in abstract
terms not directly related to any one platform. This definition would be
presented in the form of a structured language.
- The implementation of the firewall - a platform-specific tool
should then read the definition file and produce the necessary commands
to implement it. This can be targeted to any platform (Linux, *BSD,
Solarix, Cisco routers, et. al. - even Windows NT, if it's possible to
define firewalling other than manually via the GUI, and Windows '95/'98,
if a third-party security tool is available) and take advantage of the
strengths of the security tools available on that platform.
- The User Interface - the UI must be decoupled
from the actual implementation of the firewall, or you run into the
situation of having a great tool that only works with a specific platform
(e.g. Linux 2.0.x) and for a specific subset of the possible user
base (e.g. GUI users vs. text users or web users).
A little bit of research and some further thought has caused me to
broaden my initial idea into something that appears to be approaching
a master's level thesis project:
The specification and implementation of network security policy on a site-wide basis.
This change in course was largely prompted by visiting
SolSoft's NetPartitioner
site, which made me realize the security policy can be specified for
the entire network, and the implementation tool can look at that policy and
figure out how to implement the policy on the system it's running on or (in
the case of remote configuration) for.
This model scales from defining the firewall policy for a single computer
in someone's home connected to the Internet via PPP up to a corporate
network with multiple paths to the Internet via boundary networks
and bastion hosts. It permits central definition of network security
policy (at least some aspects of it) and easily distributed automated
implementation of that policy.
I probably have bitten off more than I can chew by myself, so I hope
to eventually make this an open-source cross-platform project (GNU
fwpolicy?), but time will tell.
Tasks
Here's what I am presently working on:
- Attempting to define the policy-definition language. It will be formally specified in
Extended BNF
(ISO draft standard)
It will allow:
- Description of network topology:
- Specification of networks (e.g. "corporate network", "boundary network").
- Specification of hosts on the network, so that sources and
destinations of network traffic can be specified if necessary, and
points of implementation of various policies (such as NAT, masquerading,
proxying) can be indicated.
- Specification of points of connection to the network ("interfaces") at
which policy may be explicitly controlled - explicitly defined interfaces
may have explicitly defined policies, undefined interfaces would have
inferred policy.
- Description of network traffic:
- Description of network traffic - typically specification of
TCP and UDP protocols, but with the capability to define multichannel
multiprotocol traffic (for example, FTP and ISAKMP + IPSec).
- Specification of permitted and denied traffic (along the lines of
standard packet filtering rules, but more generically defined).
- Specification of various implementation-dependent features (such as
NAT, masquerade, traffic redirection, dynamic or stateful firewalling,
proxying, etc.).
- Specification of as-yet blurry cloudy things like authentication,
logging, ...
I'll post samples here for comment as I develop them.
Policy file samples:
- Learning about compiler generation in C and Perl - how to get from BNF to code...
Futures
What I'd eventually like to produce is a formal definition of a Firewall
Policy Definition Language (I don't think it'll be comprehensive enough to
warrant being called a Network Security Policy Definition Language), a GPL
GUI front end (probably written using Jesper Pedersen's dotfile generator
tool since I'm already familiar with it), and GPL implementation back ends
for Linux 2.0.x ipfwadm and Linux 2.2.x IP Firewall
Chains firewalls, with support for automatic configuration of masquerading
and port forwarding.
Other things that I'd like to see are:
- Other front ends: Linuxconf, curses, HTML, Java, and so forth.
- Other implementation back ends: *BSD and other UNIX flavors, NT, W'98, Cisco routers, and so forth.
- Non-implementation back ends: A policy documentation tool
would be nice, for producing documentation in technical form,
teach-me-about-security-policy form, CIO form, and a form suitable for
auditing by your company's accounting firm. Maybe a policy auditing tool
that looks for holes and back doors by making digraphs of permitted
traffic. A check-the-implementation script generator that generates a
script to run on a given host to make sure that everything that's denied
is denied and everything that's permitted actually works. And so forth.
- More implementation bells and whistles: automatic configuration of fwtk
and other proxies. Automatic configuration of dynamic and stateful
filtering. Hooks into intrusion detection tools and traffic monitoring tools.
Volunteers are welcome...
You can contact me at
<jhardin@wolfenet.com>.
I'd like to hear your comments and suggestions, particularly if you know
somewhere an open-source version of this (in part or in whole) is already
underway. You can also visit the
current
version of this document, and take a look at
my home page...
Best viewed with
Any Browser
© 1999 by John Hardin. You may copy this page as long as the content is
unchanged (you can change the formatting to fit your site if you want) and the
link to the original page is left intact.