Overview
WinRoute provides the following techniques of packet manipulation:
(in the network layer of the OSI model) :
The network address translation is a technique which modifies packets sent from the entire local area network (or from its defined part) so that they look as if sent from the computer which runs WinRoute (the computer replaces the address in the packet with its own one). The incoming packets (which are the answer), are sent back to the computers in the local area network.
Port mapping provides access to selected services protected by NAT.
Packet filtering is a basic security module of each firewall. Using data in packets (like source and target IP address, the type of network protocol, source and target port, etc.) it either allows packets to pass trough or blocks them. If a filtering rule applies (depending on the meaning of the rule), information about the packet is recorded.
Anti-spoofing is an add-on to packet filtering, which protects the local area network against an attack during which an intruder falsifies source IP addresses.
In order to achieve a high level of security, WinRoute contains the so-called inspection module. It is a special driver which works between the line and network layers of the OSI model. The driver uses an original technology which ensures that WinRoute receives packets directly from the network card driver, that is before the packets are received by any other component of the operating system.
The location of the WinRoute's inspection module (which checks the contents of packets) in the network architecture of Windows operating systems is shown in the figure bellow.
Terminology
In the rest of the text bellow, certain terms related to networks are
used. You should get more familiar with these terms. Especially
if you are going to configure packet filtering, it is suitable
to know the meaning of information contained in packet headers.
TCP/IP protocols
WinRoute is a product which works with TCP/IP networks.
The TCP/IP protocols are designed to work in layers.
When speaking about TCP/IP protocols, especially the following
protocols are meant: IP, TCP, UDP, ICMP, and others based on IP.
Network interface
A network interface is a device which connects the computer
with other computers by means of a communication medium.
A network interface may be an ethernet card, modem, ISDN card, etc.
The computer sends and receives packets by means of the network interface.
IP address
An IP address is a unique 32-bit number, which identifies
the computer in IP networks. The unique IP address is assigned
to each computer in the Internet. Each packet passing across the
Internet contains an information about from which address it was sent
(the source IP address) and to which address it should be delivered
(the target IP address).
Network mask
Network mask is used to group IP addresses together. There is a group
of addresses assigned to each network segment. For example, the mask
255.255.255.0 groups together 254 IP addresses. If we have, for example,
a sub-network 194.196.16.0 with mask 255.255.255.0, the addresses we may
assign to computers on the sub-network are 194.196.16.1 through
194.196.16.254
Port
A port is a 16-bit number (the allowed range being 1 through 65535)
used by the protocols of the transport layer - the TCP and UDP
protocols. Ports are used to address applications (services) which run
on a computer. If there was only a single network application running
on the computer, there would be no need for port numbers and the IP
address only would suffice for addressing services.
However, several applications
may run at once on a particular computer and we need to differentiate
among them. This is what port numbers are used for. Thus, a port number
may be seed as an address of an application within the computer.
Packet
A packet is a basic communication data unit used when transmitting
data from one computer to another. Each packet contains a certain
amount of data. The maximum length of a packet depends on the communication
medium. As an example, in ethernet networks the maximum length is
1500 bytes. In each layer, we may divide the contents of the packet
into two parts: the header part and the data part. The header contains
control information of the particular layer, the data part contains data
that belong to the upper layer. More detailed information on
the structure of the packet may be found bellow in the section
on packet filtering.
Network Address Translation
Network address translation (NAT) may be used to achieve the following:
The connection of an entire network using a single registered IP address is made possible since the NAT module rewrites the source address in the packets sent from computers in the local area network with the address of the computer WinRoute is running on.
The connection to the Internet is transparent, which means that the computers in the local network use WinRoute as their gateway (router). From the point of view of the local computers it looks as if they were connected to the Internet using registered addresses. Thus, most applications work with the NAT without the need to setup anything on the application's or server's side. This is the main feature which makes NAT to differ significantly from various proxy servers and application-level gateways that will in principle never be able to support some protocols.
The NAT module maintains a table, which records information about each connection. The main pieces of information are: source IP address and port, target IP address and port, IP address and port used to modify packets.
We may demonstrate the way NAT works using the following example:
Let us consider a computer in a protected network. The IP address of the computer is 192.168.1.22. The computer decides to communicate from port 7658 with a WWW server in the Internet, the IP address of which is 194.196.16.43 and its port number is 80. The communication passes through WinRoute, which uses the address 195.75.16.75 on its outer interface.
First, the computer 192.168.1.22 sends a packet from port 7358 to computer 194.196.16.43, port 80. The packet passes through WinRoute, which checks its table to see if it contains an appropriate entry. If so, the existing entry is used, otherwise WinRoute creates a new one. Then it modifies the packet so that it replaces the source address to its own address. It also changes the source port. Thus the source address will be 195.75.16.65, and the port number will for example be 61001. After the changes the packet is sent on. When an answer arrives, it contains 195.75.16.65 as the target address and 61001 as the target port. WinRoute searches its table by the port number 61001 and finds the entry for the connection. According to the entry, it changes the target address and port, back to 192.168.1.22 and 7658, respectively.
Please note:
Port numbers in the packets passing through WinRoute must be modified,
since if two or more stations in the protected network start to
communicate from the same port number, we need to identify
to which of the stations a packet belongs. The NAT module
assigns port numbers from the range of 61000 through 61600.
A unique port is allocated for each connection.
NAT Critical Points
Applications work with NAT without any problems if the communication
is initiated from the protected network. This is the case with
most applications. However, there are applications which are not
designed correctly and do not comply with the client-server model
entirely. Such applications may not work through NAT, or some of their
functions may be restricted. The reason is that these applications
use more than one connection and the additional connections
are initiated by the server (located somewhere in the Internet).
Naturally enough, NAT blocks such connections.
NAT Configuration
NAT may be configured using the menu:
|
Settings => Interface Table => NAT
|
NAT advanced settings may be used in case you need to apply NAT to some parts (segments) of your network and not to the rest of it. You may need this if registered addresses are used in a part of your network and this part is accessible from the Internet, while the rest of the network uses unregistered addresses. The advanced NAT is also suitable for creating demilitarized zones (DMZs) in which the servers accessible from the Internet run. Another possibility is to choose the IP address which is used to modify the passing packets (the IP address of the interface is used implicitly).
To be able to work with NAT advanced settings, the NAT has to be set on already for an interface. So we first set the NAT on for some interface and then, in the advanced settings, we decide when NAT should not be applied.
The NAT advanced settings are defined with a table of rules. The table is always searched from its top to bottom. The search ends after a first applicable rule is found. The rule is applicable if source and target addresses comply with the data set in the rule.
The NAT advanced settings are configured in the menu:
Settings => Advanced => NAT pad => Add/Edit button
|
An Example Configuration of Advanced NAT
The figure bellow shows three networks:
Port Mapping
WinRoute performs NAT, which makes the protected network inaccessible
from outside. Using port mapping, it is possible to create
communication channels through which services inside the network
may be accessed. So it is possible to create public services like
a WWW server or an FTP server, and others.
How Port Mapping Works
Each packet received from the outside network (from the Internet)
is checked whether its attributes (that is the protocol, target port,
and target IP address) comply with an entry
in the port mapping table (Protocol, Listen Port, Listen IP).
If an entry is found for which all the three attributes are
equal to the packet attributes, the packet is modified and sent
to the protected network to the address defined as "Destination IP" in the
table's entry and to port defined as "Destination port".
Port Mapping Configuration
Mapped ports may be configured in the menu:
Settings => Advanced => Port Mapping => Add/Edit button
|
Several useful configurations of port mapping are shown in Appendix.
Packet Filtering
Setting up filtering rules to protect the local area network is important
especially if the local area network uses registered IP addresses
and if it is directly accessible from the Internet. If you use
NAT for your entire network, you do not need packet filtering.
What a Packet Looks Like
In order to be able to configure packet filtering, it is important
to understand how packets are manipulated in the layers
of the TCP/IP protocol.
In each layer, the contents of a packet might be divided into two
parts: the header and data. The header contains control information
of the given layer. The data part contains data that belong to the
upper layer. Each layer adds its own header, so in the result
the packet looks as shown bellow:
The following information is used when setting up the filtering rules for headers of particular protocols (layers):
Internet Protocol (Internet layer)
Internet Protocol is a basic protocol used for (unreliable) delivery of upper layers' data.
The following information may be used for filtering:
ICMP protocol (Internet layer)
Internet Control Message Protocol is used for sending error and control messages among computers.
The following information may be used for filtering:
TCP protocol (transport layer)
The Transmission Control Protocol is used for reliable transmission of data between two computers. The computers communicate using a "connection". The creation of the connection, data transmission and closing the connection is controlled by special flags in TCP header of the packet. The flag which controls the creation of a connection is of importance for packet filtering, since data can only be transmitted after a connection is created.
The following information may be used for filtering:
UDP protocol (transport layer)
The User Datagram Protocol offers the application layer an unreliable datagram-based transmission of data. In contrast to TCP, the UDP does not create a connection between the two computers and packets may be sent to any IP address and any port number.
The following information may be used for filtering:
The example communication of a browser and a WWW server is shown
in the figure:
More restrictive rules may cause some Internet services to be inaccessible for your users. This is the case with applications which need an additional connection to be created from the Internet, or UDP-based applications. On the other hand, when the rules are more benevolent, more applications will be functional but the network will get less secure.
The basic principle for setting up the filtering rules is that you block the access from the Internet to your network, while you keep the other direction open (the direction from your network to Internet). Then, according to the services you want to access outside and the services you want to offer to the outside world, you tune the the rules.
The most important is the protection of vital services in your network. These services (eg. file servers, intranet WWW servers, SQL servers) usually listen for connections on ports with numbers less than 1024. Services with port numbers less than 1024 might not run on servers only, even user workstation may run such services. This is the case with file sharing. On the other hand, the port numbers used by client applications are greater than 1024. Thus the number 1024 is very significant for security policies setup.
Each reasonable policy blocks access from the Internet to ports less than 1024 for both the TCP and UDP. After that, you may allow services that you want to make accessible from the Internet. For example, for WWW you allow TCP on port 80.
The more restrictive policy also forbids all incoming UDP packets and also TCP packets that try to establish a connection from Internet to port numbers greater than 1024. So, this policy entirely forbids a connection to be established with the protected network from the Internet, but it allows any communication to be initiated from the protected network. When this policy is applied, some application may cease to function (entirely or in part, this depends upon the application). The applications that will have problems are those which expect that their party will connect from the Internet to port number greater than 1024. Also applications which use UDP will not work.
Example policies:
When setting up the filtering rules it is important to remember that the rules are searched in the order they appear in the table and once an applicable rule is found, the search is stopped.
The following examples show both the more and less restrictive policies you may use when setting up the rules:
The figure shows the configuration of the policy in the packet filter:
Restricting User Access to Certain Internet Services
Packet filtering may also be used to restrict the access to some Internet
services from your network. It is possible to restrict only some computers,
based on source IP addresses. The type of service that you wish to
restrict is specified by the target port number of the service.
For example, to restrict access to FTP (File Transfer Protocol), do the following:
For outgoing packets on the interface connected to Internet:
If you run a proxy server which does filtering according to URL and you want to make your users use the proxy instead of a direct connection, use the following:
For outgoing packets on the interface connected to Internet:
The security rules are processed using the following method:
The rules are searched in the order in which they are displayed
in the configuration dialog. Upon arrival or departure of a packet,
first the rules for the interface from which the packet arrived
are searched. Then rules valid for any interface are searched.
After an applicable rule is found, no other rules are searched
and an appropriate action is taken: the packet is either
allowed to pass through, discarded or denied.
Optionally, an information about the packet is written to a file
or to WinRoute window.
|
The packet filtering may be configured in the menu:
Settings => Advanced => Packet Filter => Add/Edit
|
Anti-spoofing
Some network services use a security mechanism based
the IP address of a client.
For example, this is the case with rlogin and NFS (Network File System).
An attacker might beguile this security mechanism using IP spoofing,
a technique based on falsification of source IP address.
This attack is usually combined with TCP SYN flooding
or with source routing. The attacker might endanger the correct
function of the service or even gain unauthorized access to it.
The anti-spoofing test is performed upon the arrival of a packet. It it possible to define what IP addresses may appear in packets received by each interface. Packets with source addresses other than the allowed ones are discarded and optionally information about the packet is logged.
The method of anti-spoofing setup in WinRoute is as follows:
It is evident that it is impossible to name all addresses that may appear in packets incoming to the interface connected to the Internet. A packet is allowed to pass through if its source address does not fall among the addresses allowed for the interfaces which lead to the protected network. So any address other than the addresses accepted by the local area network interfaces is allowed. This ensures that no packets with a falsified source address (packets which look as if sent from a computer inside the protected network) are allowed to pass through.
|
Anti-spoofing may be configured in the menu: Settings => Advanced => Anti-Spoofing => Edit button
|
Anti-spoofing Configuration Example
The example bellow shows three networks:
The anti-spoofing is configured according to the following figure:
The configuration rules are:
The configuration dialogs are as follows:
Named Address Groups And Time Intervals
Named address groups and time intervals may used on various places
throughout the configuration.
Named Address Groups
Named address groups may be used anywhere source or target address
has to be specified, ie. in packet filtering, advanced NAT configuration,
etc.
The advantages of named address groups are:
|
The named address groups are configured in the menu:
Settings => Advanced => Address Groups
|
|
Time interval are configured in the menu:
Settings => Advanced => Time Intervals
|