You can use ExFilter to protect parts of your network from one another, for example to protect your personnel department's computers and files from other parts of your organisation to help keep sensitive data secure while still allowing the personnel department to benefit from your corporate IT investment.
ExFilter can be used in conjunction with other commercial and PD software to produce a very secure but highly usable connection to another untrusted network.
As well as protection, ExFilter can improve the perceived performance of your links.
To do this ExFilter helps you limit how much of each type of traffic (eg mail, FTP, news, telnet) you want on your link to fairly share the link between its users. ExFilter tries to prevent the packet traffic jams that can build up on slower links that destroy interactive performance.
ExNet itself uses ExFilter to regulate and filter its connections to the Internet.
D 3 ExFilter V1.1.3 runs on Sun-3s or Sun-4s under SunOS~4.1.x (Solaris~1). E 3 I 3 D 16 ExFilter V1.1.3 runs on Sun-3s or Sun-4s under SunOS 4.1.x E 16 I 16 ExFilter V1.1.4 runs on Sun-3s or Sun-4s under SunOS 4.1.x E 16 (Solaris 1). E 3 D 6
Untar it into a temporary directory (say D 4 /tmp) and check that you have the following files: E 4 I 4 /tmp) and check that you have at least the following files: E 4
ExFilter uses the NIT (Network Interface Tap) connection, and E 4 so can attach to any device (eg Ethernet, PPP, SLIP) device which carries IP packets and provides an NIT interface. D 5 %============================================================================== E 5 D 3 \chapter{Setting Up Your Firewall System}\label{C-FirewallConfig} E 3 I 3 D 4
E 5 You will also need to load and configure trusted software to provide any application-level gateways you want to provide on the gateway, for example an SMTP email gateway and proxy versions of programs such as D 4 Telnet and FTP\@. You may also want to provide (for example) a public E 4 I 4 Telnet and FTP. You may also want to provide (for example) a public E 4 FTP service from the gateway. I 5
E 5 You should not provide any user accounts other than a non-root administrator account and root itself, and you should not allow remote access to the machine over Telnet or a similar service---once entry is gained via any unprivileged account root access can usually be obtained fairly quickly by an experienced cracker (or UNIX sysadmin). You should also turn off services such as NIS that may induce a firewall machine to believe false information supplied form an external source. ExFilter, for example, uses static routing and avoids services such as NIS as far as possible to prevent remote tampering with its configuration. I 5
E 5 Finally, you should turn off any non-essential services, such as D 4 d{\ae}mons running from \MITOK{inetd}. E 4 I 4 daemons running from inetd. E 4 D 4 \section{Modifying Your Kernel} E 4 I 4 D 7
E 5 In general do not configure into the OS kernel module, or load or enable any OS software from the distribution, that you do not D 4 absolutely need (you don't {\em need} NFS or NIS for example, life is E 4 I 4 absolutely need (you don't need NFS or NIS for example, life is E 4 somewhat tiresome without them, but only experienced administrators should be on the firewall host anyway). In particular, avoid all software that makes your host in anyway dependent on externally-provided information that may compromise your security. Again, avoid NIS and NFS (and RFS, etc), server and client, don't use D 3 \TOK{inetd}, etc. DNS is fine if you configure it properly, and E 3 I 3 inetd, etc. DNS is fine if you configure it properly, and E 3 preferably make it a primary or secondary for the network you are protecting so that it will only get data about your network directly from authoritative sources. I 5
E 5 D 4 It is {\em vital} that you completely disable packet forwarding in the E 4 I 4 It is vital that you completely disable packet forwarding in the E 4 kernel of your firewall machine else the ExFilter will be short-circuited and no filtering or protection will be provided at all. I 5
I 8 You should try to keep an eye on the security mailing lists and on Sun's current lists of publicly-available security patches (eg at Imperial College in the UK), and apply relevant patches to security holes that might otherwise allow D 15 ExFilter to be bypassed or disabled. E 15 I 15 ExFilter to be bypassed or disabled. In particular, beware of source-routing tricks that can be used to bypass ExFilter. E 15
E 8 E 5 D 4 An example \MI{firewall kernel configuration} for running ExFilter on, E 4 I 4 An example firewall kernel configuration for running ExFilter on, E 4 in this case for a Sun-3, is: D 4 \begin{verbatimlisting} E 4 I 4
E 4
# @(#) FW 1.13@(#) 94/03/06 #
#
# FIREWALL KERNEL.
# * Minimum disc-bootable kernel for Sun-3/50, Sun-3/60 or Sun-3/110.
# * Loadable PPP 2.3 is used instead and loaded at runtime.
# * IP forwarding is turned off here with IPFORWARDING=-1.
# * We can also configure udp_checksum = 1 (in_proto.c).
# * We can also expand the udp_ttl to 120 in in_proto.c.
#
# EDIT ../../netinet/in_proto.c IN ../FW BY HAND BEFORE BUILDING THE KERNEL.
#
# We allocate a little more space for file handles, etc, as we will be
# running a lot of networking daemons.
#
machine "sun3"
cpu "SUN3_50" # Sun-3/50
cpu "SUN3_60" # Sun-3/60
cpu "SUN3_110" # Sun-3/110
#
# Name this kernel:
#
ident "FW1.13"
# Expanded kernel for lots of UUCP/Sendmail/etc sessions.
maxusers 32
# Turn off all kernel IP forwarding.
options "IPFORWARDING=-1"
#options QUOTA # disk quotas for local disks
D 5
#options SYSACCT # process accounting, see acct(2) & sa(8)
E 5
I 5
#options SYSACCT # process accounting, see acct(2) & sa(8)
E 5
#options TCPDEBUG # TCP debugging, see trpt(8)
options CRYPT # software encryption
options INET # basic networking support - mandatory
options OLDSCSI # Old SCSI architecture - mandatory
options TMPFS # tmp (anonymous memory) file system
options UFS # filesystem code for local disks
options VDDRV # loadable modules
config vmunix root on sd0 swap on sd0
pseudo-device pty # pseudo-tty's, also needed for SunView
pseudo-device ether # basic Ethernet support
pseudo-device loop # loopback network - mandatory
pseudo-device win64 # window devices, allow 64 windows
pseudo-device dtop2 # desktops (screens), allow 2
pseudo-device ms # mouse support
pseudo-device kb # keyboard support
pseudo-device snit # streams NIT
pseudo-device pf # packet filter
pseudo-device nbuf # NIT buffering module
pseudo-device clone # clone device
# connections for machine type 2 (SUN3_50)
controller virtual 2 at nexus ?
controller obmem 2 at nexus ?
controller obio 2 at nexus ?
# connections for machine type 7 (SUN3_60)
controller virtual 7 at nexus ?
controller obmem 7 at nexus ?
controller obio 7 at nexus ?
# connections for machine type 4 (SUN3_110)
controller virtual 4 at nexus ?
controller obmem 4 at nexus ?
controller obio 4 at nexus ?
controller vme16d16 4 at nexus ?
controller vme24d16 4 at nexus ?
controller vme32d16 4 at nexus ?
controller vme16d32 4 at nexus ?
controller vme24d32 4 at nexus ?
controller vme32d32 4 at nexus ?
controller si0 at obio ? csr 0x140000 priority 2
tape st0 at si0 drive 040 flags 1
disk sd0 at si0 drive 000 flags 0
device zs0 at obio ? csr 0x20000 flags 3 priority 3
device zs1 at obio ? csr 0x00000 flags 0x103 priority 3
device le0 at obio ? csr 0x120000 priority 3
device cgfour0 at obmem 7 csr 0xff300000 priority 4 # 3/60
device cgfour0 at obmem 7 csr 0xff400000 priority 4 # 3/60
#device cgsix0 at obmem 7 csr 0xff000000 priority 4 # 3/60
device bwtwo0 at obmem 2 csr 0x100000 priority 4 # 3/50
device bwtwo0 at obmem 7 csr 0xff000000 priority 4 # 3/60
device bwtwo1 at obmem 7 csr 0xff300000 priority 4 # 3/60
#device bwtwo1 at obmem 7 csr 0xff400000 # 3/60
# 3/110 stuff not in 3/50 or 3/60 config.
# comment out the sc0 lines to save memory if you don't have a SCSI-2 board
controller sc0 at vme24d16 ? csr 0x200000 priority 2 vector scintr 0x40
tape st0 at sc0 drive 040 flags 1
disk sd0 at sc0 drive 000 flags 0
disk sd1 at sc0 drive 001 flags 0
# comment out the si0 lines to save memory if you don't have a SCSI-3 board
controller si0 at vme24d16 ? csr 0x200000 priority 2 vector siintr 0x40
device ie0 at obio ? csr 0xc0000 priority 3
device cgfour0 at obmem 4 csr 0xff000000 priority 4 # 3/110
#device bwtwo0 at obmem 4 csr 0xff000000 # 3/110
D 4
\end{verbatimlisting}
E 4
I 4
E 4
A feature of this configuration is that it is short, because not much
is configured in.
I 5
E 5 The setup for a Sun-4 is very similar. Start with a ``Generic'' or ``Generic Small'' configuration and cut away options from that, such as NFS server and client support. D 5 %============================================================================== E 5 D 3 \chapter{Designing Your ExFilter Configuration}\label{C-ExFilterConfig} E 3 I 3 D 4
E 5 This example is constructed for the following, realistic, configuration: I 5 E 5 D 4 \begin{itemize} E 4 I 4
E 4
# Set verbosity at just high enough to watch throttle activity, etc.
verbosity 5
# # Set verbosity just above zero; only important things will be reported.
# verbosity 1
# Throttle data to dp2 to 1100--1400B/s including all IP and other headers.
# This does not allow for (for example) TCP header compression for
# outgoing PPP/SLIP links, nor all the link-level framing overhead (though
# it does include enough to cover all the Ethernet link-level headers
# and any padding), nor does it allow for retries done at the link level
# due to corruption, etc.
#
# Raw uncompressed bandwidth available on V.32b/V.42 link is about
# 1700Bps; V.42b compression should improve this marginally.
#
# To try to avoid huge delays make around 1000--1450
throttleto dp2 1300
# Try to prevent traffic to/from our Ethernet getting out of hand!
throttleto le0 200000
# We are interested in interfaces le0 and dp2.
if le0
if dp2
# This gateway appears at address 1.2.3.254.
#
# This gateway should behave itself and decrement TTLs on all packets
# passing through it, generate ICMP error packets where appropriate,
# and discard (not route) all incoming packets addressed directly
# to the underlying interfaces on the assumption that servers on the
# host will deal with any application-level routing necessary.
# The gateway will check and generate IP header checksums for packets
# in transit and generated locally, and will not route packets with IP
# header options.
#
# We do not run in `trace' mode unless we want to debug all traffic
# through the gateway for some reason.
#
gateway 1.2.3.254 decttl icmperrs parallel chksum noopts notrace
# -----------------------------------------------------------------------------
# ROUTING DIRECTIVES
# ==================
# Drop all packets arriving for our own interface addresses or for
# broadcast addresses, etc.
# That includes ignoring all packets arriving on our Ether interfaces
# for any machines on those nets.
#
# Beware of us getting output packets getting fed back on our input
# by nit and counted as input traffic. This will distort throttling.
# (Some packet devices do this and some don't. Sun's le0 Ethernet
# interface and out modified dp2.3 PPP drivers don't.)
#
# With the `parallel' option some of these rules are redundant and the rest
# should be logged in case of nasty surprises.
#
# route deny le0 any any from any any any to 1.2.3.0 255.255.255.0 any log
#
# Remember not to route packets destined for any of the other interfaces
# since SunOS will reply for all of them on any interface, generating
# double replies potentially in some cases.
#
route deny any any any between any any any and 1.2.3.1 only any
route deny any any any between any any any and 2.3.4.5 only any
#
# Log strangely-addressed packets.
#
route deny any any any between any any any and 127.0.0.0 255.0.0.0 any log
route deny any any any between any any any and 0.0.0.0 only any log
#
# Ignore discless-client reboot attempts.
#
route deny any any any between any any any and 255.255.255.255 only any
#
# Ignore attempts to talk to our broadcast addresses.
#
route deny any any any between any and any and 1.2.3.0 only any log
route deny any any any between any and any and 1.2.3.255 only any log
# ---------
# Spoofing attempts
# =================
#
# Block packets apparently from internal hosts on our subnet coming
# in from the connected Internet and log such packets. It may be
# attempts by crackers to cripple or steal data from some of our
# machines by pretending to be our hosts.
#
route deny dp2 any any from 1.2.3.0 255.255.255.0 any to any any any log
# ---------
# NFS and other holes
# ===================
#
# Block all attempts to reach non-privileged NFS ports on our internal hosts.
#
# Log any traffic denied this way.
#
route deny dp2 le0 udp between any any any and 1.2.3.0 255.255.255.0 2049 log
# ---------
# WWW
# ===
#
# Allow WWW packets to/from safehost for calls originated on safehost,
# ie allow hhtpd packets to or from port 80 on any external machine to
# any non-priv port on safehost.
#
# Limit to 50% of traffic when throttled.
route allow dp2 le0 tcp between any any 80 and 1.2.3.5 only nonpriv throttle50
# ---------
# TELNET/FTP
# ==========
#
# Allow telnet packets to/from safehost for calls originated on safehost,
# ie allow tcp packets to or from port 23 on any external machine to
# any non-priv port on safehost.
#
# Limit to 50% of traffic when throttled.
#
route allow dp2 le0 tcp between any any 23 and 1.2.3.5 only nonpriv throttle50
#
# Similarly for ftp on port 21 (and ftp-data on port 20)
#
# Limit to 50% of traffic when throttled.
route allow dp2 le0 tcp between any any 20 and 1.2.3.5 only nonpriv throttle50
route allow dp2 le0 tcp between any any 21 and 1.2.3.5 only nonpriv throttle50
# ---------
# FINGER/WHOIS
# ============
#
# Limit to 10% of traffic when throttled.
#
# Allow users on safehost to finger any remote host.
#
route allow dp2 le0 tcp between any any 79 and 1.2.3.5 only nonpriv throttle10
#
# Similarly for whois on port 43.
#
route allow dp2 le0 tcp between any any 43 and 1.2.3.5 only nonpriv throttle10
# ---------
# MAIL
# ====
#
# Allow mail directly to the SMTP mailer on mailhost (tcp->port 25).
#
# Mail does not have to be super-high-speed and so is limited to a lowish
# bandwidth.
#
# Limit to 15% of traffic when throttled.
#
route allow dp2 le0 tcp between any any any and 1.2.3.4 only 25 throttle15
# ---------
# PING
# ====
#
# This should be nearly last on the list so as to measure worst-case
# performance from the network and ExFilter.
#
# Allow pings to and from anywhere.
#
# Note that ICMP traffic cannot be throttled.
#
route allow dp2 le0 icmp between any any nonpriv and 1.2.3.0 255.255.255.0 nonpriv
# -----------------------------------------------------------------------------
# THINGS THAT SHOULDN'T GO THROUGH...
# Block attempts to contact our internal DNS name servers.
#
route deny any any any between any any any and 1.2.3.0 255.255.255.0 53 nothrottle
# Ignore attempts to get to one interface from another; these attempts
# arise from our listing all (or most of) our external addresses for each
# application-level gateway on the firewall.
#
route deny any any any between any any any and 1.2.3.1 only any
route deny any any any between any any any and 2.3.4.5 only any
# These are packets that shouldn't be getting here at all.
#
# Log them.
#
route deny any any any between any any any and any any any log
D 4
\end{verbatimlisting}
E 4
I 4
E 4
D 5
E 5
D 4
\section{Installing and Starting ExFilter}
E 4
I 4
D 7
E 5
D 4
You should then start up ExFilter from \MITOK{/etc/rc.local} after all
E 4
I 4
You should then start up ExFilter from /etc/rc.local after all
E 4
interfaces are in place (ie after any loadable interface drivers have
D 4
been loaded and configured). ExFilter has to be run as root ({\em not}
E 4
I 4
D 9
been loaded and configured). ExFilter has to be run as root (not
E 9
I 9
been loaded and configured). ExFilter has to be run as root (not
E 9
E 4
set-uid root which might be a security hazard) to bind to the low-level
interfaces.
I 5
E 5
D 4
Suitable lines in \MITOK{rc.local} might be:
\begin{verbatimlisting}
E 4
I 4
Suitable lines in rc.local might be:
E 5
So you might start ExFilter with a configuration file of
D 3
\TOK{/etc/altExFilter.conf} rather than the default
\TOK{/etc/ExFilter.conf}, and with a verbosity level of~50\% rather
than the default~1\%, with:
E 3
I 3
/etc/altExFilter.conf rather than the default
D 4
/etc/ExFilter.conf, and with a verbosity level of 50\% rather
than the default 1\%, with:
E 3
\begin{verbatimlisting}
E 4
I 4
/etc/ExFilter.conf, and with a verbosity level of 50% rather
than the default 1%, with:
E 5
The file consists of a series of one-line records with
whitespace-separated fields. The order of records and fields is
important.
I 5
E 5
Completely blank lines are ignored.
I 5
E 5
The first field on a line (which must start in column one) determines
the type of the record that that line is.
I 5
E 5
Case of alpha characters is significant.
I 5
E 5
Records are of unlimited length, but exceeding 256 bytes is
inadvisable.
I 5
E 5
The following initial fields (ie, record types) are valid:
D 4
\begin{description}
E 4
I 4
E 5
The aim of the mechanism invoked by this record is to avoid
saturating slow connections like PPP links to ensure reasonable
responsiveness for interactive traffic. Excess traffic is quenched
where possible.
I 5
E 5
D 4
Records referring to interfaces not mentioned in an \MITOK{if}
E 4
I 4
Records referring to interfaces not mentioned in an if
E 4
record are invalid.
I 9
E 5
D 4
The interface names \MITOK{none} and \MITOK{quench} are reserved.
E 4
I 4
The interface names none and quench are reserved.
E 4
I 9
E 5
The port component is ignored for which it is meaningless, eg
EGP. It is mainly intended for UDP and TCP.
I 9
E 9
E 5
E 4
D 4
\item[\#] {\it any text}
E 4
I 4
D 5
E 9
E 5
E 4
D 4
\item[throttleto] {\it ifname} {\it Bps}
E 4
I 4
D 5
E 9
E 5
E 4
D 4
\item[verbosity] {\it percentage}
E 4
I 4
D 5
E 9
E 5
E 4
D 4
\item[if] {\it ifname}
\item[route]
E 4
I 4
E 5
(default options: fragment nolog throttle)
I 9
E 9
I 5
E 5
(default options: chksum nodecttl noicmperrs parallel noopts notrace)
I 9
E 9
I 5
E 5
The meaning of the various parameters to the record types is given below.
D 4
\begin{description}
E 4
I 4
E 17
E 4
D 4
\item[FRaddr, IPaddr, TOaddr:] a dotted-quad host or net IP address,
E 4
I 4
D 9
E 9
E 3
D 4
\item[fragment:] do packet fragmentation if required. Also allow
E 4
I 4
D 9
E 9
D 4
\item[FRmask, TOmask:] a dotted-quad mask in the style of a netmask;
E 4
I 4
D 9
E 9
D 4
\item[FRport, TOport:] port number; \MITOK{any} is any port,
D 3
\MITOK{priv} is any port~$< 1024$ (privileged), and \MITOK{nonpriv}
is any port~$>= 1024$.
E 3
I 3
\MITOK{priv} is any port $< 1024$ (privileged), and \MITOK{nonpriv}
E 4
I 4
D 9
E 9
E 5
E 3
I 5
D 9
E 9
E 5
For protocols other than TCP and UDP this field is ignored with the
D 9
following exception.
E 9
I 9
following exception.
E 9
I 5
D 9
E 9
E 5
For ICMP, if the FRaddr address matches then the FRport port value
has the following meanings:
D 4
* \MITOK{any} means any ICMP message is allowed from the given
E 4
I 4
D 5
* any means any ICMP message is allowed from the given
E 5
I 5
E 9
E 4
I 5
D 9
E 9
E 5
D 4
The names \MITOK{none} and \MITOK{quench} are reserved and should
E 4
I 4
The names none and quench are reserved and should
E 4
D 9
not be declared as interface names in an ``if'' record.
E 9
I 9
not be declared as interface names in an ``if'' record.
E 9
D 4
\item[log:] log every packet matching this rule, whether blocked or
E 4
I 4
D 9
E 9
D 4
\item[maxthpc:] the maximum throttle percentage. If a link/route is
E 4
I 4
D 9
E 9
E 3
D 4
\item[proto:] a IP protocol number, or one of \MITOK{udp}, \MITOK{tcp}
or \MITOK{icmp}.
E 4
I 4
D 9
E 9
E 4
D 4
\item[throttle:] include packets routed by this rule in any output
E 4
I 4
D 9
E 9
D 4
\end{description}
E 4
I 4
E 5
The first parameter is the address ExFilter should use on outgoing
packets it generates such as on ICMP error packets (when packets are
denied passage through ExFilter, or when Source-quench messages are
being sent to regulate traffic through ExFilter). You should allocate
an otherwise unused address from the same subnet as the firewall on one
D 5
of its interfaces for this, though you {\em may} get away with using
E 5
I 5
of its interfaces for this, though you may get away with using
E 5
one of the firewall's own addresses. ExFilter will appear as host
piggybacking an all the firewall's IP connections with this address, so
you might want to put up a DNS record for it for the benefit of remote
network administrators.
I 5
E 5
Then zero or more flags can be set to control gateway behaviour.
Although there are defaults, it is recommended that you set explicit
values for all the parameters. As an example, to allow ExFilter to
generate ICMP error messages (eg for throttling), the parameter
D 4
\MITOK{icmperrs} can be supplied. To turn it off \MITOK{noicmperrs}
E 4
I 4
icmperrs can be supplied. To turn it off noicmperrs
E 4
can be supplied instead.
I 5
E 5
The meanings of the flags are:
D 4
\begin{description}
E 4
I 4
E 10
E 4
D 4
\item[\MITOK{icmperrs}:] ExFilter sends `not-reachable' ICMP error
E 4
I 4
D 10
E 10
E 4
D 4
\item[\MITOK{parallel}:] ExFilter discards any traffic sent to the
E 4
I 4
D 10
E 10
D 4
\item[\MITOK{chksum}:] makes ExFilter check and generate IP header
E 4
I 4
D 10
E 10
D 4
\item[\MITOK{opts}:] lets ExFilter route packets with IP header
options. In fact, this is hardwired to \MITOK{noopts} for safety
E 4
I 4
D 10
E 10
D 4
\item[\MITOK{trace}:] turns on logging of all packets seen by ExFilter,
E 4
I 4
D 10
E 10
E 4
D 4
\end{description}
E 4
I 4
E 5
ExFilter will log increasing amounts of information as its
D 4
\MITOK{verbosity} level is increased. Information logged at
\MITOK{WARNING} and above relates to security and potential system
E 4
I 4
verbosity level is increased. Information logged at
WARNING and above relates to security and potential system
E 4
failures and should find its way into audit trails and logs
inspected from time to time by a human operator. For example,
warnings about packets that were `denied' transit by ExFilter are
D 3
logged at \TOK{WARING} level. Hourly stats reporting is also
done at \TOK{WARNING} level.
E 3
I 3
logged at WARING level. Hourly stats reporting is also
done at WARNING level.
E 3
I 5
E 5
D 3
Information at \TOK{INFO} is of interest but not worth storing, so
E 3
I 3
Information at INFO is of interest but not worth storing, so
E 3
should probably go to the system console (throttling messages are
D 3
logged at this level, for example), and \TOK{DEBUG} information
E 3
I 3
logged at this level, for example), and DEBUG information
E 3
will rarely be generated and you will probably want to make
D 3
temporary changes to \TOK{syslog}'s configuration to capture it if
E 3
I 3
temporary changes to syslog's configuration to capture it if
E 3
you want it at all.
I 5
E 5
D 3
The default level of \MITOK{verbosity} the system runs at is~1,
E 3
I 3
D 4
The default level of \MITOK{verbosity} the system runs at is 1,
E 4
I 4
The default level of verbosity the system runs at is 1,
E 4
E 3
which reports most important events and little else. The level can
be changes on the command line at start-up, in the configuration
file, and with signals.
I 5
E 5
D 3
In general, the volume of output increases as the \TOK{verbosity}
increases. The minimum level is~0 and the maximum~100. Anything
at~50 or above is really only for debugging the software, and~100
E 3
I 3
In general, the volume of output increases as the verbosity
increases. The minimum level is 0 and the maximum 100. Anything
at 50 or above is really only for debugging the software, and 100
E 3
will cripple the system with the amount of information generated,
up to full dumps in hex of all packets seen.
I 5
E 5
Although the exact levels may change in future, the following
D 3
\TOK{verbosity} levels below~50 are currently implemented:
E 3
I 3
verbosity levels below 50 are currently implemented:
E 3
D 4
\begin{description}
E 4
I 4
E 11
E 4
D 3
\item[1:] All of~0 plus a few extra items. This is the
E 3
I 3
D 4
\item[1:] All of 0 plus a few extra items. This is the
E 4
I 4
D 11
E 11
D 3
\item[2:] All of~1 plus description of interface configuration
E 3
I 3
D 4
\item[2:] All of 1 plus description of interface configuration
E 4
I 4
D 11
E 11
D 3
\item[3:] All of~2 plus logging of line throttling going on and
E 3
I 3
D 4
\item[3:] All of 2 plus logging of line throttling going on and
E 4
I 4
D 11
E 11
D 3
\item[4:] All of~3 plus reporting of overlong frames being
E 3
I 3
D 4
\item[4:] All of 3 plus reporting of overlong frames being
E 4
I 4
D 11
E 11
D 3
\item[5:] All of~4 plus logging of setting up of routing
E 3
I 3
D 4
\item[5:] All of 4 plus logging of setting up of routing
E 4
I 4
D 11
E 11
D 3
\item[6:] All of~5 plus logging of ICMP Source Quench messages
E 3
I 3
D 4
\item[6:] All of 5 plus logging of ICMP Source Quench messages
E 4
I 4
D 11
E 11
D 3
\item[7:] All of~6 plus logging of each packet being routed.
E 3
I 3
D 4
\item[7:] All of 6 plus logging of each packet being routed.
E 4
I 4
D 11
E 11
E 4
E 3
D 3
\item[8:] All of~7 plus logging of each ARP-table lookup.
E 3
I 3
D 4
\item[8:] All of 7 plus logging of each ARP-table lookup.
E 4
I 4
D 11
E 11
E 4
E 3
D 4
\end{description}
E 4
I 4
E 5
To change its configuration you do not have to kill it, change the
configurations files and restart it, you can just update the
configuration files and send ExFilter a signal with the
D 4
\MITOK{kill} command to get it to reconfigure itself internally,
E 4
I 4
kill command to get it to reconfigure itself internally,
E 4
dump statistics to the logs, etc.
I 5
E 5
This causes minimal disturbance to the flow of data through
ExFilter and thus to users of the filtered IP service.
I 5
E 5
D 4
Those familiar with operation of the \MITOK{named} DNS/BIND
E 4
I 4
Those familiar with operation of the named DNS/BIND
E 4
D 5
d{\ae}mon will recognise the way that signals are used for
E 5
I 5
daemon will recognise the way that signals are used for
E 5
interaction with ExFilter.
I 5
E 5
When ExFilter starts it reads its configuration information from a
D 4
file called \MITOK{/etc/ExFilter.conf}, of a format described
E 4
I 4
file called /etc/ExFilter.conf, of a format described
E 4
D 5
above. The ExFilter d{\ae}mon writes its process ID to a file
E 5
I 5
above. The ExFilter daemon writes its process ID to a file
E 5
D 4
called \MITOK{/etc/ExFilter.pid}. This makes signaling the
E 4
I 4
called /etc/ExFilter.pid. This makes signaling the
E 4
D 5
d{\ae}mon relatively painless.
E 5
I 5
daemon relatively painless.
E 5
I 5
E 5
If you want to alter the configuration of ExFilter while it is
D 3
running, edit the \TOK{/etc/ExFilter.conf} file appropriately, and
E 3
I 3
running, edit the /etc/ExFilter.conf file appropriately, and
E 3
D 5
send the ExFilter d{\ae}mon a `HUP' signal (see the UNIX manual
E 5
I 5
send the ExFilter daemon a `HUP' signal (see the UNIX manual
E 5
pages for a discussion of the different signals and their original
meanings) by issuing the shell command:
D 4
\begin{verbatimlisting}
E 4
I 4
E 12
D 4
\item[INT] causes ExFilter to exit gracefully, after tidying up a
E 4
I 4
D 12
E 12
D 4
\item[ABRT] causes ExFilter to dump some loading and throughput
E 4
I 4
D 12
E 12
D 4
\item[TERM] causes ExFilter to exit immediately, with an error
E 4
I 4
D 12
E 12
D 4
\item[USR1] increments the verbosity (debugging) level by one.
E 4
I 4
D 12
E 12
E 4
D 4
\item[USR2] sets the verbosity level to zero.
E 4
I 4
D 12
E 12
E 4
D 4
\end{description}
E 4
I 4
The solution it to ensure the MTU on all connections is either >=536
for WAN connections (since most hosts should stick to a
E 5
D 3
conservative MTU of~512 bytes plus IP header for non-local
E 3
I 3
conservative MTU of 512 bytes plus IP header for non-local
E 3
traffic), or ensure the MTU on all interfaces is the same (we
D 3
ensure it is~1500 for all connections routed by ExFilter), so it
E 3
I 3
ensure it is 1500 for all connections routed by ExFilter), so it
E 3
need never fragment.
I 5
E 5
Incoming fragments are handled correctly, but can be discarded if
D 4
the `\MITOK{nofrag}' flag is used in the appropriate route
E 4
I 4
the `nofrag' flag is used in the appropriate route
E 4
description.
I 12
E 12
D 4
\item[Hard Limits]
E 4
I 4
E 12
D 3
\item[Quenching and \TOK{throttle}ing]
E 3
I 3
D 4
\item[Quenching and throttleing]
E 4
I 4
E 5
ExFilter keeps a small hashed table of hosts/ports to which it has
recently sent quench messages to try to send a maximum of one such
quench on each `connection' each second; this table may overflow
with a large number of different end-points communicating.
I 5
E 5
ExFilter cannot easily account for traffic originating to and from
the firewall host itself, and such traffic will not be seen by the
throttling mechanism and may allow the link to be more loaded than
is desirable. Minimise the volume of traffic to/from processes on
the firewall machine to minimise this problem.
I 5
E 5
In a future release regulation by round-trip time (RTT) will be
added to help overcome some of these difficulties.
I 5
E 5
ExFilter does not specifically recognise and expedite `interactive'
D 4
packets at the moment, but the \MITOK{throttle} feature should be
E 4
I 4
packets at the moment, but the throttle feature should be
E 4
used to keep interactive performance reasonable at all times.
I 12
E 12
D 4
\item[Kernel-Directed Routing and ARP]
E 4
I 4
E 5
Note also that ExFilter relies on the kernel's ARP tables and
broadcasts packets it cannot find and entry for in the host's ARP
tables.
I 5
E 5
Port-number range support will be added to the routing rules in a
future release, in addition to the current fixed number,
D 4
\MITOK{priv} and \MITOK{nonpriv} values.
E 4
I 4
priv and nonpriv values.
E 4
I 12
E 12
D 4
\item[Multicast IP]
E 4
I 4
E 12
D 4
\item[SNMP]
E 4
I 4
E 12
D 4
\item[Copying and Efficiency]
E 4
I 4
E 12
D 4
\item[IP Header Checksum Generation]
E 4
I 4
E 12
D 4
\item[IP Header Options]
E 4
I 4
E 12
D 4
\item[ICMP Error Messages]
E 4
I 4
E 12
D 4
\item[NIT Interface Interaction]
E 4
I 4
E 12
D 4
\end{description}
E 4
I 4
E 4
EXFILTER=/usr/local/bin/ExFilter.O.sun4-SunOS-4
if [ -f $EXFILTER ]; then
echo 'Starting Exfilter.'
D 5
($EXFILTER &) > /dev/console
E 5
I 5
($EXFILTER &) > /dev/console
E 5
fi
D 4
\end{verbatimlisting}
E 4
I 4
E 4
D 4
Note that the initial \MITOK{verbosity} (debugging level) of the
d{\ae}mon can be set with the optional \MITOK{-v} flag, and the
location of the configuration file with the optional \MITOK{-f} flag.
E 4
I 4
Note that the initial verbosity (debugging level) of the
daemon can be set with the optional -v flag, and the
location of the configuration file with the optional -f flag.
E 4
I 5
E 4
EXFILTER=/usr/local/bin/ExFilter.O.sun4-SunOS-4
if [ -f $EXFILTER ]; then
echo 'Starting Exfilter in an alternative way.'
D 5
($EXFILTER -v 50 -f /etc/altExFilter.conf &) > /dev/console
E 5
I 5
($EXFILTER -v 50 -f /etc/altExFilter.conf &) > /dev/console
E 5
fi
D 4
\end{verbatimlisting}
E 4
I 4
E 4
D 5
%==============================================================================
E 5
D 3
\chapter{ExFilter Reference Guide}\label{C-Ref}
E 3
I 3
D 4
ExFilter Reference Guide}\label{C-Ref
E 4
I 4
D 7
ExFilter Reference Guide
E 7
I 7
ExFilter Reference Guide
E 7
E 4
E 3
D 4
\section{The Format and Meaning of the Configuration File}
E 4
I 4
D 7
The Format and Meaning of the Configuration File
E 7
I 7
The Format and Meaning of the Configuration File
E 7
E 4
This section describes the format of the ExFilter configuration file,
D 4
by default found in the file \MITOK{/etc/ExFilter.conf}, which should
E 4
I 4
by default found in the file /etc/ExFilter.conf, which should
E 4
be owned by, and only writable by, root.
I 5
E 4
D 4
\item[\#] (starts a comment record)
E 4
I 4
E 4
D 4
\newcommand{\OR}{$|$}
E 4
I 4
Valid record syntax, in EBNF, is (non-literal parameters are thus):
E 4
D 4
Valid record syntax, in EBNF, is (non-literal parameters are {\it
thus}):
\begin{sloppypar}
\begin{description}
E 4
I 4
D 5
E 4
D 5
\end{sloppypar}
E 5
D 5
Note that {\OR} indicates the item on the left {\rm or} the item on the
E 5
I 5
D 9
Note that ``|'' indicates the item on the left or the item on the
E 9
I 9
Note that ``|'' indicates the item on the left or the item on the
E 9
E 5
right. Parentheses indicate grouping. Square brackets indicate
optional items.
I 5
(Iif|any) (Oif|any)
(proto|any)
(from|between)
(FRaddr|any) (FRmask|any|only) FRport
(to|and)
(TOaddr|any) (TOmask|any|only) TOport
E 9
I 9
(deny | allow)
(Iif | any) (Oif | any)
(proto | any)
(from | between)
(FRaddr | any) (FRmask | any | only) FRport
(to | and)
(TOaddr | any) (TOmask | any | only) TOport
I 17
D 18
[ [no]ether[etheraddr] ]
E 18
I 18
D 19
[ [no]MACforce[etheraddr] ]
E 19
I 19
[ [no]MACforce[-etheraddr] ]
E 19
E 18
E 17
E 9
[ [no]fragment ]
[ [no]log ]
[ [no]throttle[maxthpc] ]
[ [no]decttl ]
[ [no]icmperrs ]
[ [no]parallel ]
[ [no]opts ]
[ [no]trace ]
I 17
D 18
E 4
D 4
\section{Gateway Parameters}
E 4
I 4
D 7
E 5
D 4
Note that when a \MITOK{between} routing record is used, the
E 4
I 4
Note that when a between routing record is used, the
E 4
corresponding TOport value is used for packets travelling in the
reverse direction.
D 4
\item[ifname, Iif, Oif:] an interface name, eg \MITOK{le0}; this must
E 4
I 4
D 9
Gateway Parameters
E 7
I 7
Gateway Parameters
E 7
E 4
D 4
The \MITOK{gateway} record is used to set a number of general
E 4
I 4
The gateway record is used to set a number of general
E 4
parameters for ExFilter, and is, in effect, mandatory.
I 5
E 4
D 4
\item[\MITOK{decttl}:] ExFilter decrements the `Time-To-Live' counter
E 4
I 4
D 10
E 4
D 4
\section{Logging}
E 4
I 4
D 7
Logging
E 7
I 7
Logging
E 7
E 4
D 4
ExFilter does most of its logging to the \MITOK{syslog}
\MITOK{DAEMON} facility. It logs information at five different
E 4
I 4
ExFilter does most of its logging to the syslog
D 5
DAEMON facility. It logs information at five different
E 4
internal levels (fatal, error, audit, information for tracing, and
D 3
debugging) corresponding to the \TOK{syslog} levels \MITOK{ALERT},
E 3
I 3
debugging) corresponding to the syslog} levels \MITOK{ALERT,
E 3
D 4
\MITOK{ERR}, \MITOK{WARNING}, \MITOK{INFO} and \MITOK{DEBUG}.
E 4
I 4
ERR, WARNING, INFO and DEBUG.
E 5
I 5
DAEMON facility. It logs information at five
different internal levels (fatal, error, audit, information for
tracing, and debugging) corresponding to the syslog
levels ALERT, ERR, WARNING,
INFO and DEBUG.
E 5
E 4
I 5
E 4
D 4
\item[0:] Silent about all but major problems.
E 4
I 4
D 11
E 4
D 4
\section{Signals}
E 4
I 4
D 7
Signals
E 7
I 7
Signals
E 7
E 4
One aim of the design of ExFilter is to allow it to run non-stop.
I 5
E 4
kill -HUP `cat /etc/ExFilter.pid`
D 4
\end{verbatimlisting}
E 4
I 4
E 4
The full list of signals and their effects is:
D 4
\begin{description}
E 4
I 4
E 4
D 3
\item[HUP] reloads the configuration file \TOK{/etc/ExFilter.conf},
E 3
I 3
D 4
\item[HUP] reloads the configuration file /etc/ExFilter.conf,
E 4
I 4
D 12
E 4
D 4
\section{Known Problems and Future Features}
E 4
I 4
D 7
Known Problems and Future Features
E 7
I 7
Known Problems and Future Features
E 7
E 4
There is a small number of known problems and missing features we would
like to provide in a future release. These, and workarounds, are
listed below:
D 4
\begin{description}
E 4
I 4
E 4
D 4
\item[IP Packet Fragmentation]
E 4
I 4
E 4
D 5
%==============================================================================
E 5
D 3
\chapter{Licence and Warranty Terms, and Contact Details}
E 3
I 3
D 7
Licence and Warranty Terms, and Contact Details
E 7
I 7
Licence and Warranty Terms, and Contact Details
E 7
E 3
This details the terms of the Right-To-Use (RTU) licence that you, the
Customer, have purchased directly or indirectly from us, ExNet Systems
D 3
Ltd for use of the software package called ExFilter~V1.1.3.
E 3
I 3
D 16
Ltd for use of the software package called ExFilter V1.1.3.
E 16
I 16
Ltd for use of the software package called ExFilter V1.1.4.
E 16
E 3
D 5
\begin{enumerate}
E 5
I 5
E 5
D 4
\item
E 4
I 4
E 5
D 4
\vfill
E 4
D 13
ExNet Systems Ltd, London, UK,
tel: +44 181 244 0077,
fax: +44 181 244 0078,
email: ExFilter@exnet.com,
URL: http://www.exnet.com/.
E 13
I 13
ExNet Systems Ltd, London, UK
tel: +44 181 244 0077
fax: +44 181 244 0078
email: ExFilter@exnet.com
URL: http://www.exnet.com/
E 13
D 14
Document version V%I% %M% %E%.
E 14
I 14
Copyright (c) ExNet Systems Ltd 1995--1996.
Document version V%I% %M% %E%.
E 14
E 1