OT - rule based system for a fire wall

OT - rule based system for a fire wall

[Ishwar Rattan]

It is a little off-topic but some one here may
know something about.

I have seen an idea being floated:

- A firewall uses a set of rules to filter packets (a fact)

- Proposal: possibility of desigaingn a rule based system
  (call it rule-system) that will insert correct rules in the
  firewall (sounds ambiguous)

- Is there such a thing out there? if the propser won't
  part with any more details, what kind of gusses can be
  made?

  1. Rule-system can interact with a user and then insert
     rules in the firewall -- I think this has already been
     accomplished??

  2. Rule-system could look at logged information (firewall
     logs) and come up with better/new rules?

  3. Is there any other facet/issue that I am missing here..

It still bugs me to think of a rule-system that will insert
rules into another rule based system :-|

Any feedback will be appreciated.

-ishwar

Re: OT - rule based system for a fire wall

[John A. Sullivan III]

On Fri, 2004-10-15 at 12:16, Ishwar Rattan wrote:
> It is a little off-topic but some one here may
> know something about.
> 
> I have seen an idea being floated:
> 
> - A firewall uses a set of rules to filter packets (a fact)
> 
> - Proposal: possibility of desigaingn a rule based system
>   (call it rule-system) that will insert correct rules in the
>   firewall (sounds ambiguous)
> 
> - Is there such a thing out there? if the propser won't
>   part with any more details, what kind of gusses can be
>   made?
> 
>   1. Rule-system can interact with a user and then insert
>      rules in the firewall -- I think this has already been
>      accomplished??
> 
>   2. Rule-system could look at logged information (firewall
>      logs) and come up with better/new rules?
> 
>   3. Is there any other facet/issue that I am missing here..
> 
> It still bugs me to think of a rule-system that will insert
> rules into another rule based system :-|
> 
> Any feedback will be appreciated.
> 
> -ishwar
I'm not entirely sure I understand you.  Are you looking for something
that will dynamically change a running rule set based upon events or a
user interface to alter an existing rule set?

There are some very good rule configurators available such as fwbuild
(http://www.fwbuilder.org), shorewall (http://www.shorewall.net) and
several other that have been recommended on this list.  For a policy
rather than rules based approach, take a look at ISCS
(http://iscs.sourceforge.net).  Hope this helps - John
-- 
John A. Sullivan III
Open Source Development Corporation
Financially sustainable open source development
http://www.opensourcedevel.com

Re: OT - rule based system for a fire wall

[Jose Maria Lopez]

El vie, 15 de 10 de 2004 a las 18:16, Ishwar Rattan escribió:
> It is a little off-topic but some one here may
> know something about.
> 
> I have seen an idea being floated:
> 
> - A firewall uses a set of rules to filter packets (a fact)
> 
> - Proposal: possibility of desigaingn a rule based system
>   (call it rule-system) that will insert correct rules in the
>   firewall (sounds ambiguous)
> 

Maybe what your are looking for it's something like guardian
that uses snort to insert the proper rules into iptables when
it detects an attack.

> - Is there such a thing out there? if the propser won't
>   part with any more details, what kind of gusses can be
>   made?
> 
>   1. Rule-system can interact with a user and then insert
>      rules in the firewall -- I think this has already been
>      accomplished??
> 
>   2. Rule-system could look at logged information (firewall
>      logs) and come up with better/new rules?
> 
>   3. Is there any other facet/issue that I am missing here..
> 
> It still bugs me to think of a rule-system that will insert
> rules into another rule based system :-|
> 
> Any feedback will be appreciated.
> 
> -ishwar

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"

Re: OT - rule based system for a fire wall

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 694 bytes --]

On Fri, 2004-10-15 at 18:16, Ishwar Rattan wrote:
> - Is there such a thing out there? if the propser won't
>   part with any more details, what kind of gusses can be
>   made?
> 
>   1. Rule-system can interact with a user and then insert
>      rules in the firewall -- I think this has already been
>      accomplished??

Better things can be done. The NuFW system based on Netfilter allow you
to define policy based on user. You're even able to define policies such
as :

"John can connect to internet website if he uses Firefox on windows XP
SP2"

More informations at :
	http://www.nufw.org/
BR,
-- 
Eric Leblond
Nufw, Now User Filtering Works (http://www.nufw.org)

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

RE: OT - rule based system for a fire wall

[Hudson Delbert J Contr 61 CS/SCBN]

all,

	good idea, but not original thought cisco and  other
	firewall pros have  been  doing reflexive acl and other
	stateful related thingsz awhile now.

	q&a,,,

	what are the correct rules?

	wouldn't  those be security policy and as such cnt be canned
	by a vendor.

	netsec is always a work in progress and IMHO anything that starts
	to point to a 'set it and forget it' mind set is dangerous to
	a firms information assurance efforts.

~piranha


riginal Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of Jose Maria
Lopez
Sent: Saturday, October 16, 2004 10:53 AM
To: netfilter@lists.netfilter.org
Subject: Re: OT - rule based system for a fire wall


El vie, 15 de 10 de 2004 a las 18:16, Ishwar Rattan escribió:
> It is a little off-topic but some one here may
> know something about.
> 
> I have seen an idea being floated:
> 
> - A firewall uses a set of rules to filter packets (a fact)
> 
> - Proposal: possibility of desigaingn a rule based system
>   (call it rule-system) that will insert correct rules in the
>   firewall (sounds ambiguous)
> 

Maybe what your are looking for it's something like guardian
that uses snort to insert the proper rules into iptables when
it detects an attack.

> - Is there such a thing out there? if the propser won't
>   part with any more details, what kind of gusses can be
>   made?
> 
>   1. Rule-system can interact with a user and then insert
>      rules in the firewall -- I think this has already been
>      accomplished??
> 
>   2. Rule-system could look at logged information (firewall
>      logs) and come up with better/new rules?
> 
>   3. Is there any other facet/issue that I am missing here..
> 
> It still bugs me to think of a rule-system that will insert
> rules into another rule based system :-|
> 
> Any feedback will be appreciated.
> 
> -ishwar

-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"