S 4.98 Restricting communication to a minimum with packet filters

Initiation responsibility: Head of IT, IT Security Officer

Implementation responsibility: Administrator

Packet filters are IT systems with special software filtering the information in the lower layers of the OSI model and then forwarding or rejecting packets according to specific rules (see S 2.74 Selection of a suitable packet filter).

The configuration of a packet filter used for protecting Internet servers should be very restrictive in order to maximise the resistance against attacks. A well configured Internet server (see S 4.95 Minimal operating system) should be capable of protecting itself against attacks, but the software of an Internet server is much more complex and prone to error than the software of a packet filter designed for security. The packet filter should only permit those communication channels necessary for the function of the Internet servers. In particular, not only the communication initiated from the Internet to the Internet server, but also the communication the Internet server is allowed to establish to the Internet must be controlled. A prerequisite for many attacks is that the attacked computer is capable of establishing new connections to the Internet. If this is not possible, many attacks are unsuccessful. For example, an attack on news servers was very wide spread in 1997, within the framework of which the attacker managed to have important system information sent to him/her via email using an error in a news daemon. If the attacked computers did not have the authorisation for sending emails, the attacker would not have received any response and the attack would not have been successful.

Some examples for the configuration of packet filters for different Internet servers are described below.

If only these rules are implemented, communication from the Internet can only be established to the approved services. If the communication partners can be restricted even further (see examples above), an attacker is not capable of establishing any connection to the Internet server.

Note: The abovementioned rules result in the Internet server not being available from every computer, since ICMP is rejected. Therefore, it is recommendable to allow the ICMP sub-type icmp unreachable from the Internet to the Internet server.

Review questions:

© Federal Office for Information Security. All rights reserved.