NuFirewall Open-source authenticating firewall NuFirewall - RMLL - - PowerPoint PPT Presentation

▶
nufirewall
SMART_READER_LITE
LIVE PREVIEW

NuFirewall Open-source authenticating firewall NuFirewall - RMLL - - PowerPoint PPT Presentation

Apr 01, 2023 794 likes •1.06k views

NuFirewall Open-source authenticating firewall NuFirewall - RMLL 2010 NuFirewall - RMLL 2010 Who's that guy ? Eric Leblond CTO EdenWall Technologies NuFW project leader Netfilter developper Ulogd2 maintener Regit

slide-1
SLIDE 1

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

NuFirewall

Open-source authenticating firewall

slide-2
SLIDE 2

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Who's that guy ?

  • Eric Leblond

– – CTO EdenWall Technologies – NuFW project leader – Netfilter developper

  • Ulogd2 maintener
  • Regit

– http://home.regit.org/ – @Regiteric on twitter

  • French

– activate your babelfish to deal with my accent

slide-3
SLIDE 3

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Discovering NuFirewall

  • NuFirewall at a glance
  • Fontionnalities
  • NuFW at an another glance
  • Architecture
  • Demonstration
  • Planned evolution
slide-4
SLIDE 4

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

What is NuFirewall ?

  • A ready-to-use Linux firewall gateway

– Standard Netfilter firewall – Authentication via NuFW – Fully manageable throught a graphical GUI

  • A free distribution

– Based on debian Lenny – Configuration via a QT-based GUI

  • A free version of EdenWall appliance

– Software – Free

slide-5
SLIDE 5

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Fonctionnalities

  • System and network configuration
  • Firewalling

– Netfilter configuration – NuFW setup and configuration

  • Directory handling

– LDAP (posix) – Active Directory

  • Logs analysis
  • Ipsec VPN
slide-6
SLIDE 6

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

NuFW

  • Brind identity to the network

– Filtering rules with group match – Ability to do QoS and differenciated routing (via marks)

  • « exclusive » algorithm

– authentication on multi-users computer – Resist to basic attack (IP and arp spoofing)

  • Développed by EdenWall Technologies
  • Available under GPLv3 licence
slide-7
SLIDE 7

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Software architecture (1/2)

  • Heavy client configuration

– Python-QT GUI – Communication with firewall via XML-RPC over HTTPS

  • Server Architecture

– Server developped in python twisted – Core

  • Common functions
  • Transport

– Components

  • Responsible of a function (network, filtering)
  • Dependance handling, ...
slide-8
SLIDE 8

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Software architecture (2/2)

NuCentral component 1 Compoent n Composant 1 Component 2 ... Service 1 Service 1 Service 2 Service n System Service 2 Configuration Transport XML-RPC Software Appliance

slide-9
SLIDE 9

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Components of the solution

  • NuFirewall
  • NuFirewall Administration Suite (NFAS)

– Same version as EAS – But different icons (Nupik inside)

  • Authentication Agents

– Nutcpc : Console client for Linux and Unix – Nuapplet : Graphical Client written in QT – NuAgent : Windows Agent (freely available but proprietary) – EdenWall Agent : extended version of NuAgent

  • Documentation
slide-10
SLIDE 10

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

System configuration

slide-11
SLIDE 11

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

System configuration

  • Network

– Ethernet Interface – Vlan – Bonding – Routed network

  • Authentication

– Kerberos, kerberos/AD, password, radius, certificat

  • Groups

– LDAP, AD

slide-12
SLIDE 12

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

NuPKI, PKI made simple

slide-13
SLIDE 13

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Firewall rules management

slide-14
SLIDE 14

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Firewall rules management

  • Drag&Drop based interface
  • Ipv4 and Ipv6 filtering

– Netfilter – NuFW

  • SNAT and DNAT
  • Fonctionnalities

– Coherence tests – Display filtering – Wizards

slide-15
SLIDE 15

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Logs analysis

slide-16
SLIDE 16

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Logs analysis

  • Firewall log analysis

– Netfilter (via ulogd2 pgsql and mysql output) – NuFW

  • Graphical display

– Bar – Pie – Table

  • Dashboard
  • Basic report
slide-17
SLIDE 17

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Conclusion

  • NuFirewall

– Is a free authenticating firewall – Simple and friendly user interface

  • Planned evolution

– 1.0 this summer – Some components will be separately available :

  • Nuface : rules management
  • Nulog : log analysis
  • NuPKI : PKI

– Update to follow EdenWall Appliance

slide-18
SLIDE 18

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

NuFirewall will not evolved without them

  • Pierre Chifflier (aka pollux, aka Mr Pare-feu

Openoffice)

  • Victor Stinner (aka Haypo)
  • Feth Arezki, Pierre-Louis Bonicoli, Laurent Defert,

Nicolas Frisoni, Kamel Messaoudi, Francois Toussenel

  • Olivier Carrere, Julien Miotte
  • Harmony Igolen
  • ...
slide-19
SLIDE 19

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Questions ?

  • More infos : http://www.nufw.org/
  • Contact : eleblond@edenwall.com
  • EdenWall Technologies : http://www.edenwall.com/
slide-20
SLIDE 20

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Annexes

slide-21
SLIDE 21

NuFW

Algorithmes

slide-22
SLIDE 22

Principe de fonctionnement

Phase 1: Identification des utilisateurs et groupes associés Ouverture d’un tunnel chiffré de signalisation vers le firewall par l’agent de l’utilisateur Vérification des informations d’identité par le module d’authentification auprès d’un référent d’organisation (LDAP, Radius)  et  Récupération des groupes utilisateurs auprès d’un référent d’organisation (annuaire LDAP) Association entre l'identité de l'utilisateur et ses groupes par le module d’authentification

slide-23
SLIDE 23

Principe de fonctionnement

Phase 2: Identification du premier paquet de connexion Interception du premier paquet de connexion par le module de filtrage  à Analyse par le module décisionnel

 Validation de l’identité de la source  Validation de l’accès à l’application cible

slide-24
SLIDE 24

NuFirewall - RMLL 2010 NuFirewall - RMLL 2010

Differences between EdenWall/NuFirewall

  • EdenWall is an hardware solution
  • High availability
  • Centralised Administration (multi firewall)
  • Multi-user adminitration (profil, external authentication)
  • UTM fonctionnalities
  • Professional support