Tìm hiểu hệ thống firewall trong hệ điều hành window

BTL Nguyên lý Hệ điều hành
BÀI TẬP LỚN
NGUYÊN LÝ HỆ ĐIỀU HÀNH
Đề tài 11: Tìm hiểu hệ thống FireWall trong hệ điều
hành Window
1
BTL Nguyên lý Hệ điều hành
DANH SÁCH THÀNH VIÊN
ST
T
Họ và Tên MSV Nhiêm vụ
1 Nguyễn Văn
Đức
1221050
137
Chương I: Tổng quan
về Firewall
2 Phạm Ngọc
Hùng
1221050
219
Chương II: Những
thiết kế cơ bản của
Firewall
3 Phạm Đức
Anh
1221050
155
Chương III: Các thành
phần và cơ chế hoạt
động của Firewall

4 Nguyễn
Quốc Toản
1221050
417
Chương IV: Giải pháp
tường lửa cho doanh
nghiệp
5 Nguyễn Đức
Mạnh
(Nhóm
Trưởng)
1221050
298
Lời mở đầu + Chương
V: Tổng Kết + Tổng
hợp 5 chương
2
BTL Nguyên lý Hệ điều hành
MỤC LỤC
3
BTL Nguyên lý Hệ điều hành
LỜI NÓI ĐẦU

 !"#$%
&'()*))
+,&! /0(%$#$%&
1$#23435670
8!9#:08;<=)3$> $
<$#7?@!
$#$%&?A$)*))B$?32

'C%D$#!$#
$%&$56'$>?2A0
$2(8E/:/F)E#)!-6(
EGB:$H##/?@I
H;,J%DC!KC
?')))$=&$LJ8
#J%M)2)CJ8N)$+J3
$#0')N)8;<=$#$%&!
-0;/O$<#)$D$P0;
Q<R8SJ$:T: )E%<=
 $#< 2)!U 0;  )E%V)
$%&7%:)&<C23$?3
B $1/ $ +)$#J/ $8 #
$%&$78;<=!K:
: <C2 O)N)$$%&O:(
R1?J2:2%+)#<C2/!
W86<X+H7-%Y93K:$1$
??%!-%M(8EH$ J
) &  MB /  /G C ( 8:!
K:$1$$+'863$:), 7,
-%?#!
Nhóm em xin chân thành cảm ơn!
4
BTL Nguyên lý Hệ điều hành
CHƯƠNG 1: TỔNG QUAN VỀ FIREWALL
1. Khái niệm
-+CZ1R:A.$/[+(/(
%<6 F>J#(G#!-2
JZ1R$/[+'&')2
$# 86%+))N)JB$?32A

?#(86$+)/$$
2!Z1R'$32)T7?
 \] / $83A
+)!U: 1<^/:%+)#%!
Hình 1.1 :Firewall được đặt ở giữa mạng riêng và mạng công
cộng
U$#_110?@1<?`C/a
!Y ?32<C2?00<4
Z1R!Z1R:: )N)0<4')2
>#C0<4/')2!Z1R: 
(?@)E>*H)$D$#%8
?33$>/(')3!-$0')J:)3:&
()$#J$$#$:?32J$
5
BTL Nguyên lý Hệ điều hành
$#?!Z1R: 1R%> $D
C$#J0$$#$$#
_11!UZ1R1*3!
2. Chức năng
UEF&7Z1R/ $8A.
C_11_11!-(+)*(D / <T
C$#?P_1S$#_11!U=
 b
• U)N)>$C<@=%+)P.
_1_11S!
• U)N)>$C<@=)N)%+)
P._11_1S!
• -1<^A<C2$#C_11_1!
• c $8@O%+)J$@O%+)!
• c $808;<=2%+)708;

<=!
• c $8<=% 
$#!
3. Phân loại
3.1 Firewall cứng
-0;)E$6'),(?#
<4)?3Q<R8%!KD $%+)
P188)S/<%8;<=$#HD
'::<<#L')3$J&')
0;)E?<?<1!W2<4
$0;2$#7?#: *3
2$$$%302#0%2
#7?#!9#O>0;/(d11
C$<1$)efgh$%&7?#!PYV
(#0;S!
6
BTL Nguyên lý Hệ điều hành
Hình 1.2: Firewall kết nối Enthernet giữa modem cáp/DSL và
máy tính
Đặc điểm của Firewall cứng:
• c'#Z1R$D$bPc
$EFJ$%Mi1R$D$S!
• U: 3,+)!
• Y*3J<jM)>JHJ3,!
• Z1RE#`)*Z1R$D$
P-K1R/-8)S!
• Z1RE/ / $'<7:
!
Ví dụ Firewall cứng: K-PK1R/<<188-81S!
3.2 Firewall mềm

U:D)-0;)$D$$?#:
 8;<=(?#<4)?3Q<R8%!U
):#0;/: 8;<=
Q<R8!f%<8$8)b
• _11g1%g%81$8P_ggSb9/_UdkUk1!
• K1R/818b"l11k18Z1R!
• g%$1bKk18Z1R!
• -%glR1b-%k18Z1R!
• m1h?8bm1$!
Đặc điểm của Firewall mềm: -&#:
$J?%MJEF!Z1R$D$#`
*Z1REPE<=SZ1R$D$:
/ $'<=7:P./:S!
Ví dụ về Firewall mềm: m1$JKZ1Rn
7
BTL Nguyên lý Hệ điều hành
4. Nguyên lý hoạt động của Firewall
Z1R#>oE-Uke_kJHE
%$21+G<C2+'.
E<=$#J%:&*<@=
#%EP-11Jg"-kJfKgJg"KkJKZgnS
:<C2P<)/18SA)/1%C
@O: +<#J+)#`&;(J<:
#Z1RD()/1C
8@O7V!9)/1)N)%.p$p
)/1$:+'!K:/ $?<C2 %(
@1$#<C2::G$$8+2
7)/1%/!U+2)/1%<6
     `   $p )/1 P1<1SJ  <4     )N)
%D)/1:$#!9A$b

• Y@O_)*)Pg1S!
• Y@O_k*+Pf18S!
• KC7=%DP-UkJqfkJ_U"kJ_k1nS
• UL-Ukeqfk*)
• UL-Ukeqfk*+
• f#?_U"k
• r<2)/1(
• r<2)/1
K()/1G+2'(+)7Z1RH
)/1:'% J(/GH8o?@#?G!W2
/ $8L$Z1R:/3FO:)N)$
8#/(@')N)$'2$#
=?!U,<2/ $<61<17
)/1?// $8'<
7)/1!U)/1% X: $1C
,AFM))#7/a!-
)8V8oH$ /[+ '0;!
5. Ứng dụng của Firewall
8
BTL Nguyên lý Hệ điều hành
Hình 1.3: Firewall bảo vệ máy tính
K($%&7?#/'?32J/?#/(
_11J3$#D)N)JH(
/1JsJ8 %+)%M)
7?#$%&!UV: >#$ 
i1<C2$%&!UV: 8;<=$%&
7?# $$%&/7H><
2)//(_11!"i1R: V)?#
/G: $/:(27?#!
5.1. Firewall bảo vệ cái gì ?

K2$=*?37Z1R?32CD8b
• fC  2b  KC        '  ?3  2  <
C%D&?3$+J&t
&/@)0!
• -%2!
• f(7%8`C
?32!
5.2. Firewall bảo vệ chống lại cái gì ?
Z1R2?32#C86.?
!
Tấn công trực tiếp:
9
BTL Nguyên lý Hệ điều hành
• UE<4)*))<T$+/I6()!
-*H<TH$$+/I$8
D08;<=%8JLJ@O!n
/(')2<0<4#J/a:
 <T'$+/I7?#!-$80')/3
F: uvw!
• UE8;<=p7*HE<=
?32D'8;<=.C=
X' ($%D%+)P:'
%D703@2S!
Nghe trôm:U: ?('J$+/IJ%D
$#*H)N)()
$#PK_US(+?%D
$#!
Giả mạo địa chỉ IP: hx/10<4% $#
<$%&')))B$($%DD/ H
<%2R1?$%&?@!

Vô hiệu hóa các chức năng của hệ thống (deny service):
Y%/ B$2?2/:
62EF$:'(/(!c %
/ F>'<C)*2LE
&)*2 $2%+)
$#!
Lỗi người quản trị hệ thống: y(0C&
7/ ^$72?3$+
2<j< /1!
K%%JH7/1%G*J/
:2$#XT+$#)2;,p
L7$H!YD%TG03@$#)3:/(
ED?3$+$# : CC
72!YC0<4J/
 ?((7+ 6%<6$H$Z1RJ
 ^$7?3$+
10
BTL Nguyên lý Hệ điều hành
$p!z:6H$  ?($8)T
C86*37/1!WD,
EJ/:,E )TH/3F8o
*!
CHƯƠNG II: NHỮNG THIẾT KẾ CƠ BẢN CỦA
FIREWALL
11
BTL Nguyên lý Hệ điều hành
1. Dual-homed Host
Z1R/(V/ f{ $1<8'%<6<6
$%&<{$1<8!"$%&'<{
$1<8(::&1R/1l1J:5

$%::M<$#()$#/J<
:$%&%GT1$D$!c(V<{
$1<8*3J$%<{$<8`CJ$?
'11?T#$#?P$#
'?32S!
rA$:> $8b
o k3<8?1EF7<{$1<8 $
T_k.T!
o U2??<{$1<8O:
#<{$1<8$V/#
6)'!
o f{?$<8)<@=)%811
>6()
2. Kiến trúc screenetl Host
-/(V%EF?3$+&')
?0EF)/1i1#8111!
    k/1i18111' 81)8
?88$%<%11R/$8
11: $`/((!k/1lH1)N)
12
BTL Nguyên lý Hệ điều hành
?8  8  $`   / P')  ))S    ?  P11$
1R/S!
-0k/1i6228b
o U)N)188$`/((8
11$8<@=')N)!
o U$3/(L.188
 c/1'?88H/T
$M188!
3. Kiến trúc Screened Subnet Host

-$ $)1$111R/ +)11R/
11!K+%<4/1'?88
XT$MC)3'11!U
11R/'?32<4?8
?@|($\!U<@=&+%:/3F<j?@
HD})1$111R/!988 $
#/(.bg"-k~Z-kJfKg!UT
2%+)<@=.118(811
11H'D/ 8b
13
BTL Nguyên lý Hệ điều hành
o g1))/1i131111
 )N)118%+)8118?
$6()!
o g1))%g11?88 )N)1
18%+)8118?$3()!
4. Sử dụng nhiều basion host
W$H%H)EC08;<=
?P81S$):/@3`?`
C#708;<=?$#P11
81S
14
BTL Nguyên lý Hệ điều hành
5. Kiến trúc ghép chung Router trong và Router ngoài
•1)3)N))<=+<T)/1
$p1l1!
 fN)1/(V$%$
3$)?32$#?J: :/(VN)
11B$`C/(Vg111<
8g111<g?18

6. Kiến trúc ghép chung Bastion Host va Router ngoài
c(V%O8;<=$#O:€0<
Egh_k>kkk11!
c N)9881Pd11S
%g111<g?1x8!K:)E
0)$X: )+'<
0%D)JVF71&JEF
:7%(1!
15
BTL Nguyên lý Hệ điều hành
CHƯƠNG III: CÁC THÀNH PHẦN VÀ CƠ CHẾ HOẠT ĐỘNG
CỦA FIREWALL
1. Bộ lọc gói (Packet Filting)
1.1. Nguyên lý hoạt động
c:(2<C2C$#
Z1RHD::5BZ1R#>o
E-Ue_k!WHE%$21+
G<C2'.E<=$#!%:
&*<@=#%EP-11!
g"-kJfKg!g"KkJKZg!!!S:<C2P<)/18SA
)/1%C@ : +<#!+)
#`&;(<:#Z1R
D()/1C8@O7V!
9k/1)N)%.$p)/1$:+'!
K:/ $?#<C2o%N@5#<C2
::G$$8U+27)/1%
/!U+2)/1%<6}
$p)/1P)/11<1SJ<4 )N)%D)/1
:`$#!Y:b
o Y@_k*)Pg1S

o Y@O_k*+Pf18S
o KC7=%DP-Uk!qfk!U"k!_k1JnS
o UL-Ukeqfk*)
o UL-Ukeqfk*
o f#?U"k
o r<2)/1(
o r<2)/1
16
BTL Nguyên lý Hệ điều hành
K(+2)/1'3$H)/1'% 
i1R!K(/)/18o?@?G!K0+%$Z1R:
F3'/($%7>$#:
'J>/2%+)2$#?
.C/)N)!x*C2/ $8
Z1R:/FO)N)$8#/(
@#$%7:>O:C<@
=:P-11!g"-k!Z-k!!!S')N)$#%'2
$#?!
1.2. Ưu điếm và hạn chế của hệ thống Firewall sử dụng
bộ lọc Packet
Ưu điểm:
o U)&)H*()/16'?A$
$p)$D$1!
o KJ?_)/1808;<=
V<=!H+%:/%86%2
>?23!
Hạn Chế:
o W@5()/1$2/
)E#)JTG03$# ?((
<=_11J<#)/11<1J

= : $p0!cTGD
86 J+2?`<
)E#)J/oo3,D/ !
o f$2<61<17)/1!^?
)/1//D$8':<7
)/1!P)/1%DX: $1
C,AFM)%)#7
/aI!
17
BTL Nguyên lý Hệ điều hành
2. Cống ứng dụng (Application-Ievel Gateway)
2.1. Nguyên lý họat động
Y%$#Z1R' /( F0EF
/($8#<@=!E')N)%+)
2$#!U(#7:<6E
k%811!k%811?<1>?2<>
1R%.E<=!K(0@$#/
>)%<1$E<=:J<@=*E8o
/')<:/ %(
i1R!K!)%<1: '@IHDp'
O$8> $E<=$T3@$#
I)+'/.
"A;<=0'$)
P?88S!?`H:'(/ >?2 L#86I
.?!KC?2))3$?7$
?88b
o 98  8    #%    18      P811
18S  7  U  )  $D$  2    P•)1@
g%81$S!U18%'(/(%
  $=  &    #  86        •)1

g%81$!3$?386&')i1R!
o UOC<@W=$03$#
($'>?88!*3OH
($<=/'>!:/ ?
!-0!$8?#E<=
<@=-11JfKgJZ-kJg"-k681
'>?88!
o 988: %D$E6/
!&<=81)88R<%8$<!
o "p)%'>UH )N)%+)O
$8A$%7!D%:5B?
18
BTL Nguyên lý Hệ điều hành
2> $(+)$p)%OV$
8$%7?2!
o "p)%<%H$% +/,N)#?
(7:J$p86/(!/
0/(!K+/,%:&2H$
1<(%F>/a)3#!
o "p)%D+)&)18/?8
8!YD%)N)<j<HU>$
)%$!%‚$)%:D!
2.2. Ưu điềm và hạn chể
Ưu diếm:
o U)N)03@$#D/D
'.<@=$#!?`HE<=)%?#
(?_2% @C$%7:D
%+)'?`<@=!
o U)N)03$#D/D
'C<=)N)?`H86M$>

7)%<@=*E:5
<@=%?@/!
o ULE<=)N)/($6
::+/,N)#D%+)2
!
o h+2lH1LE<=<j<
H/ $*8?)/1!
Hạn chế:
y3818%LJ>%L)
$D$>$%1%+)<@=
)%!U3#11%+)LV<=TG
? $%7E/)3$?!
-%J:$8)$D$1)N)E
<=LE<=8?B)N)
19
BTL Nguyên lý Hệ điều hành
81O$%&E/)3LE<=2
-11!
3. Cống vòng (Circuit-level gateway)
ULWT$EF>?2: 62'
?`$LE<=!ULT*3O%)
P1%S/-Uk$/62?/ƒ$
;,%)/1!
CHƯƠNG IV: GIẢI PHÁP TƯỜNG LỬA CHO DOANH NGHIỆP
1 Giới thiệu
K%%28;<=11)L?(?
<2)!YC@2$3
,2$#$%&LE{<2)$
0/<2nay :o?$+{<C2
D$H!

"C=23<=
20
BTL Nguyên lý Hệ điều hành
8;<=0.P&51RSB$/$886%+)
.?$#?<@e$#!-%
J$0;//N$J
E{<2).G!
-0')%J:o3))$?@:;,
$ EF  '), ! -( ?@?3$+ - 3
$„%)3)E%ID?3$+{<C2
7LE…<2) $ 23 $/
(D(?@MD)E#)J$$
%!
YD%+(H#_112
%%X%$1<8$%&J*H)
#M)JpL?3$+72D
E<=!
2 Giải pháp ‚rewall cho doanh nghiệp nhỏ
1 ISA Server Enterprise 2000, ISA Server Enterprise 2004
Y%$)$D$:EF&b
o 932$#._11!
o U)N)U1? $#?%+)
<@=_11J:/ $8!
Mô hình triển khai ISA Server giữa Intemal Network và
Internet
2 Sonicwall PRO 2040
Z1R<<2)#.%:)E
$%IJ<D<+%D%/%(?@
/G)J:>:?J/27J>M)/_q
21

BTL Nguyên lý Hệ điều hành
D'3!gQhhk†v‡v/(')2D$`
g•g(2$7gQhh$/(V)IE:
/3F@3J$jHVJ/
*3!
c  8;  <=J  0  <4 )3   > os $`  7
gQhh$/'D&)/(
( D ˆgk  <6 )TJ ?B3  k †v‡v
/J(+)K-<61&8/(LQK<6)T!
"><4:+k†v‡v$/2D
g•gd1<J)3 2D%H$:
1/&#L()E7(?@!L%:E
F7$LQKJhKJ%f"mJ>8$(
?@k†v‡v/<6)T!gQ/D/N$
7J:&')EF)T8
<!
k†v‡v$.TJ‰#J:'
?@$?;,$$p2$=$:28
:H/?2/<4($:dg{†Š‹%ufdg!
x#+)F>8/;
D?@F3?`Z1R%!
3 THIẾT LẬP MỘT FIREWALL CHO DOANH NGHIỆP
h63))Z1R)E>Z1R)
$D$D%<$Z1R<2)!W2(+)
Z1R<6%(8b
Trước hết cần xác định tài nguvên cần bảo vệ:
o "%#$J"%7!
o U(?@$#b9@%(P•1SJr1R%J
•1)11!!!
o U$%V.

o U*H)$D$!
o U)$#!
o -C2)<C2!
Nghiên cứu các vấn đề sau:
o 932%:/G?@)#!
22
BTL Nguyên lý Hệ điều hành
o Œ87%*1<#!"E7
A%!
o U?2)): 62 ?32%
0J‚L/N$!
o c $&8$#@/H!
Nhận dạng các mối đe doạ:
o -%+))N)bK:28;<=?E
%$/'86)N)D?@
%+))N)!
o K%*(bW2 
$$1<#!)3@^@%
#%3$7C$%!}$E2
2 $+/I%+)2:
#+'2%+))N)*
!
o <@=bU$#<4 / A
%:@$%&*8`<C
2)<@=$ $*<6!
K1<@=%/888o<X(3
`2 /< 4 *@J •I/: :
' HE .  <@=J <
%2/$8&<=D.<@=b
 x2$%?@<.H$:V/a)

#!
 "#?@<.H?@'!
 U(?@?32$#?@)G!
o U $%+)bY $%+)$0:C
08;<=)N)   2!K1  :
D $%+)H$F%*
 $#J U2:H/Vb
KC/a+)$#V0L
) #$%4 $#!U$%&7
:Tg117-11$=
23
BTL Nguyên lý Hệ điều hành
)L?(!K1$%&7/'H
$VMH28o<j?@)#!
o W8bc&)E#)7)$D$FH
)E#) 7 W8?/H2   
FJGo8o/:)$D$$/?@
j$ W8!UW8'?(( $
  )*)) )L?( (
%+))N)!K12>2$`
'?(1$H/a+):
8;<=C($%(7*H#%0
(     %+)2 `( >
%D!
o U$1<#.?bKC0
0%+)6())$D$$%&$#
D*8)E!K($0
%(@)#0:#$1
<#/ 4$#!K10:()
+<j<2H2<j?@)

#*!K0)#: <p<#%?3
$EM$?M)$D$)&
'7  E! x( E <=-Uke_k
P-11JZ-kS:*($% :
$+/I'%<<#F?^5!
+,bK(?3$%&/'D
$>+,H*()$D$: <j<?@?G
!-0)$%#$f•gJQ_Kf•QgD/
:*(?2)$D$!Y2Dq/:
03,H5+,: ?@J>(
2%(>%D$%#$?@
?GG!K://a+):#$<.$%&%
#:`#(A8:%*H
-s{18>: 62/B$
$ 2    $ =  
*!
24
BTL Nguyên lý Hệ điều hành
4 CÀI ĐẶT VÀ CÁU HÌNH FIREWALL
g%8o(>$Z1R<2)
?B)$D$ISAServer 2004 Firewall
1 Tìm hiểu về phần mềm ISA Server 2004 Firewall
-8C83)I$0;Pi1RS@0
2%H_gg11†vv‡7"8&H'D0%
& </3 F ? 22  $#$o 4 *(
3 ,  #! _g g11 †vv‡ Z1R :  ) ?3
g<<d1)81)==C$0/!
_gg11†vv‡g<<)EI?328a
?F%:%$?H!W)?3
%:%<6Z1R/ $8<C2

2$#?7%J/ $8H%
+)70<41EJ0<B$
F+2/(CR1?G</
&')!9#:T:  /2WkKg1
g1%•1$1188p'2%+).J>
<C2CF)T!Y%:
C2$%7"g11JQ1?g11
'?32+o$$0?2H_g
†vv‡)N)/4f"mP+CO4)
86SF.86*6()C0?
 ?  2! K & F? $+ 
J_g†vv‡T:22$P1SV)/(_11
*<R1?: '8••"
%5EJV)(/2$/ ?2!U&
H , <: $ 83 )$ Z1R % :    _11
g1%Ž11P?3$+F_11S!
_gg11†vv‡d1)81'8;<=$H
$#J)ED%%70<4?
2!KC&FG_g
g11†vv‡g<<J?3d1)81T)N)(+)2
$3_gg1148;<=$&8JD
25