Http tcp port 80 to your webserver Network Syslog udp port 514 NTP Server Requests udp port 123 Reverse Proxy Setup Same as a standard Proxy Setup Except for the FollowingД¬hanges Proxy Listens on Port 80 (or redirect to proxy port) Static local DNS entries are setup on reverse proxy External DNS servers point protected hostnames at theД®xternal IP of the Reverse Proxy Proxy is heavily firewalled, usual precautions apply Firewall Rules, no outbound connections allowed except for Http Proxy uses a local DNS for Name Resolution Http Proxy Utilises External DNS Servers for Name Http Proxy / Reverse Http Proxy Identical Http Proxy serves to protect clients Http Reverse Proxy serves to protect servers Http Proxy can access any Server from a few clients Http Reverse Proxy can access few servers and isДЄvailable to any client. Stunnel Decrypts the Request & forwards to Reverse Proxy Proxy Limitation Cant Reverse Proxy SSL / TLS Settings :( However one can use Stunnel to decrypt the SSL Traffic RFC Compliance Checking Blocking non http protocols running on port 80 Disable Certain Dangerous Requests Block Content 2 Connections for each Accepted RequestДЎ Connection for each Rejected Request HTTP Firewall (understands http) What is a Proxy It a service that accepts connections from a client and in Proxies allow fine control over specific protocols :) Limitations are not a problem for inherently safe protocols For unsafe protocols proxies help can provide some Ssh sessions Https Ipsec TLS Protected ConnectionsДЇirewall Limitations Dont Worry Proxies pick up where firewalls leave off. Protocol Validation / Filtration Deep packet inspection beyond the first 10 packets /Дў.5KB of data in the stream Inspection of encrypted data streams such as Protect the users / systems behind it and ItselfДЇirewall Capabilities Can Identify traffic according to the followingДestination Address (destination Address List)ДЇirewall Limitations Firewalls generally have difficulty with the following Legitimate / useful traffic for users and systems should: Not be Blocked Not be Corrupted Not be Slowed or Hampered Beyond Strict Tolerances Logging and ultimately reacting to traffic Flowing to the system Flowing through the system Flowing from the system Security objective There are multiple ways firewall systems handle trafficДЇirewall Design Objectives To implement a security policy by classifying, validating, Sources of Security Information ENISA OWASP Rits Group SANS Institute CIS Centre for Internet Security NIST Computer Security Open BSD ha. ДЇirewall Systems One or more systems combined to achieve a desired Protocol Specific Filtering Proxy Specifically Http Proxy In a security centric manner Create policy based rule sets Presentation Objectives IP v4 Firewall Systems Concepts Outline what a firewall can and can not do Discuss Prevalent Network Attacks and Mitigation We want people to be able to connect with each other eloquently efficiently and elegantly Language Ogham which is found carved in stones that mark the land of ancient tribes throughout the once vast Celtic world in northern & western Europe Support of MikroTik Powered Appliances Ogma Connect's name comes from the Ancient God ofД¬ommunications and eloquence who's name was Oghma Oghma was credited with the invention of the written Ogma Connect A Collaborative Effort involved in the development and Server Infrastructure Engineer Systems / Network Administrator IS Architect Internet Security ConsultantДЎst MikroTik Certified Trainer in June 2007 in Ireland Ireland Have been working in Industry since 2000 Mechanical & Electronic Engineering, DCU, Training Certified OEM Integrators Consultants Distributor & Value Added Reseller Irish Company Incorporated in 2006 Operate an ISP in the centre of Ireland. Location: Wroclaw, PolandDate: 1st of March Speaker: Tom SmythCTO Wireless Connect Ltd. MikroTik Router OS Network Threats and Countermeasures MikroTik Router OS Firewall StrategiesMikroTik Router OS Firewall Strategies

Mikrotik address list group