Firewall: Ubuntu OS Security Design, Implementation, and Analysis

This report provides a comprehensive analysis of firewalls, particularly focusing on their implementation within the Ubuntu operating system. The study delves into the core concepts of firewall technology, including the utilization of Netfilter and IPtables as fundamental components for network security. The report examines the historical development of firewalls, their classification based on the OSI model, and the various topologies such as DMZ and VPNs. It explores the methods employed in firewall design, including the configuration of kernel settings, the creation of shell scripts, and the management of filtering rules. The experimental work and analysis section details terminal usage, rule manipulation, and application profiles. Furthermore, the report investigates the evolution of firewalls, advanced security functionalities, and the importance of firewall logs for tracking and auditing network activities. The conclusion summarizes the findings, emphasizing the critical role of firewalls in safeguarding network infrastructure and information security.

Running head: FIREWALL
FIREWALL
Name of the Student
Name of the University
Author Note

1FIREWALL
ABSTRACT
Firewalls are the most used systems of security in order to make sure networks. With the
stable development of innovation of network, network not only shows itself as a talented and
beneficial life but they are also joined by a variety of problems of network security. The
firewall is a primary technique in order to avoid the weaknesses of network and they are used
frequently in order to foresee the union that is illegal and it also isolates the network that is
situated inward from the networks those are not certain, in order to safeguard the security of
the Systems of Linux that are used in the medium and the little sized attempt.
The main content is to end the firewall capacity that depends on the working framework of
Ubuntu. The Netfilter is used as the design of firewall and the IP table. This assessment
evaluates the design of Netfilter/IPtable and the process of working of the innovation of
discovery of state that is at the point and then organizes the firewall. The functionality of the
firewall that is the firewall explore is used for checking the safety and the feasibility of the
firewall.

2FIREWALL
Table of Contents
1. INTRODUCTION..............................................................................................................4
2. HISTORY AND LITERATURE REVIEW.......................................................................4
2.1 Inside and Outside firewalls.............................................................................................5
2.2 Firewall Limitations.........................................................................................................5
3. Methods..............................................................................................................................6
3.1 Classification of Firewalls................................................................................................7
3.2 Firewall Topologies.........................................................................................................8
3.3 The Logs of Firewall........................................................................................................8
3.4 Initialization of Firewall...................................................................................................8
3.4.1 Configure kernel........................................................................................................9
3.4.2 Create a Shell Script..................................................................................................9
3.4.3 Delete Existing Filtering Rules.................................................................................9
3.4.4 Change Default Policy............................................................................................10
3.4.5 Reset and Stop Firewall..........................................................................................10
4. EXPERIMENTAL WORK AND ANALYSIS...............................................................10
4.1 Terminal Usage..............................................................................................................10
4.2 Working with Rules...................................................................................................12
4.3 Application Profiles.......................................................................................................17
5. Evolution of firewall........................................................................................................19

3FIREWALL
5.1 Inspecting Your Firewall................................................................................................19
5.2 Review Advanced Security Functionalities...................................................................22
6. Conclusion........................................................................................................................22
7. BIBLIOGRAPHY............................................................................................................24

4FIREWALL
1. INTRODUCTION
With the rapid development, there are many issues of network security that are come across
in the day-to-day activities. There are large varieties of actions that break out incessantly. The
attackers use a large number of hosts in order to use the Distributed Denial of Service attack
and large numbers of hosts that are present on the network are continuing the attacks of
Distributed Denial of Service. It is a standard approach in order to prevent the attacks of
network. These are used daily in order to avoid the illegal association and then divide the
network from the networks that are not reliable. For independent organizations and
companies, there is a requirement of the firewalls of network in order to assure the security of
information of the servers. The framework of Linux is a framework that is used for open
working and it has many central points.
The primary motivation that are at the back of the channel regulations of firewalls is to make
sure the security of large business framework of Ubuntu under the working framework of
Ubuntu by using the Netfilter as then design of firewall and IPtable as a module apparatus of
space of client in order achieve the state acknowledgment capability, contrasting the attacks
of Distributed Denial of Service and records of call of the firewall of Ubuntu. This article
splits the principles of engineering of IPtable/Netfilter and the working process of the
modernism of state detection and then defines the security and sufficiency of the firewall plan
via ordering the Netfilter module of the firewall, creating the record of content, organizing
the IPtables of the firewall and many more.
2. HISTORY AND LITERATURE REVIEW
The problems of network security that has troubled the folks, the rapid development of the
network improvement of PC. The firewall is to assure the improvement of the structure and
security of network of the tools of PC or the programming systems of PC. The objects of the

5FIREWALL
business firewall, the highlights those are not common of the programming those are normal,
they are directed on is not a great benefit. In this situation, it would need plan of inside
framework and the development of the firewall. The Netfilter/IPtables combines the working
systems of open source Linux in order to use a respond for the firewall. The Netfilter is run in
the work components of the Linux firewall.
The Linux is an open source innovation of firewall that has practised development.
2.1 Inside and Outside firewalls
The inner side interface of the firewall is observed regularly as they are confided in the
interface of the network, the outside of the firewall i not trusted. The class firewall that is
known as Soho that allows traffic that is going out and squares the ones that are coming. The
firewalls that are individual allow the traffic that is going out. In this way, in order to
examine the firewall, it needs to done filtering.
2.2 Firewall Limitations
It is known about firewalls that they can strengthen a strategy of network security but they
have some limitations. The main problem that climbs when the firewall are introduced is that
a large amount of time is required in order to put assets into requests in order to arrange the
approach of security properly of the network that are present nearby (Csubak and Kiss 2016).
Another problem that firewalls face is expanding and traffic that are complicated by protocol.
In spite of the fact, the goal of gag of a firewall can entirely notice at the incoming and large
number of traffic can hamper the outgoing traffic and the activity of a firewall.
Another problem, that appears is the framework those are wireless of a network situated in
the neighbourhood. In this situation, various weaknesses come up because of the objective of
association that cannot be validated as the network those are wired. Some of the firewalls

6FIREWALL
deploy the problems of encryption. The packets of data that are encrypted deploy headers yet
the firewalls demonstrate limitations in dealing and perceiving with the data packets.
The File transfer protocol for example does the work by initial association from the client to
the server and vice versa. The firewalls know the way of handling those protocols but several
tasks reside as dangerous and vulnerable.
3. Methods
The firewalls are the methods of security that are planned in order to meet the objectives
those are unambiguous. At the start, the topology of network of a company requires to be
configured together in order to pass the traffic via the firewalls. The point of choking hides
the network through the approaches of security, thus, outlining the packets that are permitted
or need to be dropped. The firewall can hide an entire network and it can create a barricade
for the hackers and the attempts of hacking The operations of firewall depends on the
unambiguous controls that actualizes the structure of the network in order to do the
characteristics. These administrations deploy control of service, behaviour, direction and the
user.
The control of management is a functionality of firewall that selects the administrators that
are permitted admittance from outside of the network to the outside and vice versa. The
control of bearing deals with the traffic that is going out or coming in. This type of control
evaluates the packet’s limit, the type of administration this packet manages, the terminal that
try to reach or select to decay or permit the stream of data packets (Diekmann et al 2016).
The control of client is a functionality of firewall that controls the right to entry to the clients
that work inside the network of an organization. Sometimes, on the clients that enter an
internal structure of network from exterior.

7FIREWALL
Figure 1: DMZ Architecture
Source: Created By author
3.1 Classification of Firewalls
The classification of firewalls can be done by the OSI model into two various categories. The
application and network layer firewalls. The firewall of the network layer in the layer of
network in the OSI model is legally routed via the layer of network. The channels of the data
packets have a means of thinking of operations that stretch out on the features of IP data
packets (Voronkov et al 2018).
In the occasion, the data packets approval to the regulations that are characterized by the
policies of local security, the trespassing is permitted. The packet is unused and the entry on
the network those are local are clogged-up. The packet header of the IP deploys the
evaluation of the features that are accompanying IP address of source, IP address of
destination, review of protocol, the port verification UDP and TCP and the flag evaluation of
TCP.

8FIREWALL
The channels of the packet are separated in to various categories of filtering. The first is the
stateful and the next is the stateless. In the filtering of packets those are stateless, the firewall
takes the decision to permit or disallow a packet by evaluating the features of the packets.
The packet filtering those are stateful is an upgraded version of the stateless filtering. The
main comparison is that it has unambiguous features of the protocol of TCP/IP.
The filtering of packets those are stateful go together with the filtering of packet hose are
dynamic, an help in which the firewall has the capability to ping the IP those are at the source
of the data packets, which is under evaluation and the examination is very good. There are
also the firewalls those are known as the Higher-layer firewalls and in this category of
firewalls, it can monitor or track the traffic of the network on the model of OSI. The
gateways those are Circuit Level and Application Level find out deployment in this group of
firewalls. The filtering of packets is a type of firewall that has an extra operation on the Layer
of Session of the OSI model. This memorizes the surveillance of handshaking that are present
between the packets for the demand in order to evaluate and select if the solicitation is legal
or illegal (Zerkane et al 2016).
3.2 Firewall Topologies
There are different kinds of topologies that can be used in order to install a firewall. The most
essential ones are the DMZ, NAT and the virtual private networks. The Demilitarized Zone is
a topology of firewall in which a detachable network is added in between the interior and the
exterior of the network (Dadheech, Choudhary and Bhatia 2018). With the help of the
architecture, the DMZ directs to provide the exterior visitors any inbound management, for
example, a server of Web. The virtual private networks are the networks those are shared and
these networks work on the networks those are open. On the machines those operate on

9FIREWALL
VPNs, they direct to exchange the packets those are encrypted via the network and they are
decoded just in the time they reach the end of the network (Csubak and Kiss 2016).
3.3 The Logs of Firewall
A log is known as several operations of the objects those are defined earlier of framework
and it is a collection of outputs of operations that arrange chronologically. Every document of
log records various frameworks. A log is records that are present in a book and the client can
read the logs legally. It includes a stamp of period and other kinds of information and they are
of one type to the subsystem (Caprolu, Raponi and Di Pietro 2019). The log is essential for
the security of the framework. The client easily can check the reason of the harm that has
happened and can recuperate the hints that are left by a hacker. The main components of log
are mainly tracking and auditing.
3.4 Initialization of Firewall
The starting processes of firewall mainly have 5 stages. They are described below:
3.4.1 Configure kernel
As the table of IP is separated into the component of kernel and the segments program that
belongs to the management of the client layer, the install of the table of IP consists of
compiling and installing of kernel of Linux and the program that belongs to the level of
client. This article uses Linux-3.6.tar.bz2 in order to build up the Netfilter and then construct
the framework of Linux. The installing of the table of IP consists of compiling and installing
of the kernel of Linux and the program that belongs to the level of client.
3.4.2 Create a Shell Script
The firewall of Linux consists of the Tables of IP and its command lines and the lines of
commands are run only once. The firewalls have different regulations in order to use them.
The regulations of filtering of firewalls are composed together in to the scripts of shell

10FIREWALL
programming and it is then saved in the way for the /and so on/rc.d/rc.fw and permission for
the shell script are set.
[root@localhost linux-3.6]# touch/and so forth/rc.d/rc.fw
[root@localhost linux-3.6]# chown root:root/and so forth/rc.d/rc.fw
[root@localhost linux-3.6]# chmod u=rwx/and so forth/rc.d/rc.fw
3.4.3 Delete Existing Filtering Rules
When the arrays of channels are characterized, the first step is to delete the regulations that
already exist in the chain of standards. If this is not done then the regulations that are added
recently will get added to the rules that already exist. This will make the data packets to
match with the filtering that is already existing before matching with the regulations of
channel to the settings those are latest. This will affect the filtering of packets and the result
that will given to us will be incorrect.
3.4.4 Change Default Policy
The policy of the default firewall is to delete a message. After using this strategy, in adding
together to data packets permitted expressly by the regulations, the other packets of data will
be deleted. Differentiated to the packets that are kept as default, the policy that constructs the
packets of data should be deleted and it is successful and very safe.
3.4.5 Reset and Stop Firewall
There are some cases where the use of firewall, should be stopped not permanently but
temporarily. The firewall will stop working permanently when stop parameters will be added
to the scripts of firewall.

11FIREWALL
4. EXPERIMENTAL WORK AND ANALYSIS
Ubuntu implements the firewall that it has, it called as ufw, and the full form of ufw is
uncomplicated firewall. The firewall that is uncomplicated is very easy to use for the
commands of IPtables of Linux. The ufw can be easily controlled by an interface those are
graphical. The firewall of Ubuntu is planned in such a way that it can execute the activities of
firewall without the tables of IP. It does not provide all the commands of the benchmark
IPtables but it is not complex.
4.1 Terminal Usage
The firewall is not enabled from the first. In order to start the firewall, the command must be
executed from some terminals.
sudo ufw enable
It is not required to enable the firewall first. The user can add regulations even if the firewall
not online.

12FIREWALL
Figure 2: Enabling Firewall
(Source: Author)

13FIREWALL
Figure 3: The firewall is active
(Source: Author)
4.2 Working with Rules
The user wants to permit traffic of SSH on port number 22. The user can execute one of the
commands that are written below.
sudo ufw allow 22 ( permits both the traffic of UDP and TCP)
sudo ufw allow 22/tcp (pemits only the traffic of TCP on the port number 22)
sudo ufw allow ssh ( it checks the other files on the computer for port that is required by SSH
and then permits it. Various services those are common are on this file).
Figure 4: Permits the traffic of UDP and TCP
(Source: Author)

14FIREWALL
Figure 5: Permits the traffic of TCP
(Source: Author)

15FIREWALL
Figure 6: Checks other files on computer
(Source: Author)
The firewall that is uncomplicated presumes that the user want to set benchmark for the
traffic those are coming in and then the user can easily determine a direction for the traffic.
Figure 7: Rejects the files with more traffic
(Source: Author)
The user can easily see the regulations that have been developed with the commands written
below:
sudo ufw status

16FIREWALL
Figure 8: Checking regulations
(Source: Author)
In order to discard a regulation, the following command is to be used.
sudo ufw delete reject out ssh

17FIREWALL
Figure 9: Discarding regulations
(Source: Author)
The syntax of ufw permits for the regulations that are fairly compound. Like for example, this
regulation reject the traffic of TCP from the number of port IP 12.34.56.78 to port 22 on the
system those are local:
sudo ufw deny proto tcp from 12.34.56.78 to any port 22
in order to reorganize the firewall to a state that is default, the command that is written below
should be executed.
sudo ufw reset

18FIREWALL
Figure 9: Reorganizing the firewall
(Source: Author)

19FIREWALL
Figure 11: Resetting the firewall
(Source: Author)
4.3 Application Profiles
There are many applications that need ports those are open and that escort the profiles of ufw
in order to create this considerably easier. In order to view the profiles of application that are
available on the structure those are local, the following commands that are written below
should be executed.
sudo ufw app list

20FIREWALL
Figure 12: Viewing the profiles of applications
(Source: Author)
In order to see some information about some profile and the regulations that are included in,
the command that is written below should be executed.
sudo ufw app info Name
The name that is written here is CUPS
sudo ufw app info CUPS

21FIREWALL
Figure 13: Seeing information about some profiles
(Source: Author)
With the help of the command allow, the user can permit a profile of application.
sudo ufw allow Name
In the firewall, the logging is not enabled by default, the user can easily enable logging by
typing the command that is written below:
sudo ufw logging on
Figure 14: Enable logging in
(Source: Author)
5. Evolution of firewall
5.1 Inspecting Your Firewall
It is very hard to examine about the firewalls. The firewall is a barrier against the worms of
the internet. Every day there will be right to entry solicitation in order to agree, run and then
support.

22FIREWALL
Stage 1: Understanding of Environment
The user should hold back the investigation extent in order to ensure that has user has some
alternatives in order to end the work. There are various places where there are two distinctive
types of firewalls that are safeguarding the door (Neupane, Haddad and Chen 2018). There
are one kind of firewall and a good deal of doors thereby making it equal for few firewalls in
order to re-examine. Some of them have one DMW while others have few layers and DMZ
have firewalls in them. Some them can think of servers that are at the intermediate level.
Stage 2: Checking of Network
The firewalls are dependent on the management of network. Various companies have
administration of firewalls separated from the activities of networking. The management of
firewalls are sometimes outsourced, there can be separation from the activities of
management of network, and it develops several limitations. Before evaluating the
regulations of firewalls, evaluating the arrangements of firewalls (Surana et al 2017). The
checking of the network should be started by taking in account few points:
 Allocation of IP address
 Translations of IP address
 Default route
1. IP address Allocation
Finding out the gathering is always answerable to the management of address of IP, generally
the management brunches of the router should take care of the address translations of the
network and the interior and the exterior routes. The user must decide the addresses of
network that are seen as DMZ, intranet and many more (Waheed et al 2017). The firewalls
should reflect the layout of the network and the presumed activity that Company offers for
every domain.

23FIREWALL
2. IP Address Translations
Finding out which interior address of IP are translated to the IP address or an address those
are solitary if the address translations of the ports are used. The user has to know which
address of IP will come in the domain and it consists of the address of Ip those are original
(Say et al 2017).
3. Default Route
To do the work with the gathering of router to make a decision of the default route of the
Company
Stage 3: Check the configuration of baseline
Generally, a firewall is properly planned to be a gadget of security that is controlling the
network. There are various organizations that presume that someone whose task is to do
routing it works very well with the firewalls. The firewall is basically for routing the data
packets and it can take part in the plans of routing.
Case 1: Fragmented Traffic
There is various attacks payload partition that is present among the fragments of data packets
the pieces of which overlap with the bytes of keys. As the data packets are taken together and
assembled together at the network server, the payload is developed again and the attack
results (Brown, Carlin and Torres-Negron 2017). There are some places in the chain of
network between a hazard that is very high and domain that is at the lower domain, there
should be a gadget that does the reassembling of the data packets and then checking of the
data packets.
Case 2: Source-Routed traffic of IP
The early use of Internet protocol was not very easy. The failure problems of routers cause
various issues. The designers of Ip developed some means in order to determine the routers
path in the header of the data packets. The routing at the source needed the data packets to go

24FIREWALL
to every IP address that is present in the rundown. The routing of free source importantly had
the data packets to go to every address that is present at the rundown. The affect that is got
after was overlooked (Frahim, Santos and Ossipov 2014.) The gatecrasher has some
technique that it uses in order to fake the addresses of IP that are attached to the packets of
data. The reason behind faking the IP address is that there are some applications of server that
verify some commands by the address of IP of source presuming that the data packets can
just be created from the recorded device in the address header of the IP that is present at the
source.
Case 3: Spoofing
The firewalls can give an idea about state by questioning the traffic and then attempting to
come in the intranet to view if the traffic is verified. This is an arrangement that can interact
some attacks of network that are incidental by the means of dropping the data packets and
that is out of the firewall setting.
5.2 Review Advanced Security Functionalities
The firewalls that are installed in a system need maintenance and it has a good understanding
of the hacks of security and the protocols of networking of cloud. The manufacturers have
developed selected settings that do many works for the user. Smart controllers choose the
functionality of firewall that does not enable forwarding until the interface is controlled by
the firewall (Zhang 2017).
An important functionality that several firewall run is guarantee against the attacks of SYN.
Earlier in this article, it was spoken about the attacks that attack on the association of
framework of TCP thereby keeping the system busy and then making the system unusable to
the users (Sobeslav et al 2017).

25FIREWALL
6. Conclusion
This report speaks about the security of networks and the firewalls that are used as a security
of network. The report also speaks about the Netfilter of Ubuntu and the IPtables of the
innovations of firewalls. Despite all these complexities, the tables of IP are displayed to be
very strong and full of trust. There are two various features that have been evaluated in this
report, first is the routing and the second is the security. Without the legal configurations of
Linux and tables of IP, there are no virtual machines that can get the right to entry to the web
and there are no trusted visitors that would have got access to the to the administrators of
network. The great performance of the traffic of routing all through the network those are
virtual, the tables of IP have been configured in order to characterize if the traffic that is in
the network is legal around the destination and the source of routing.
With the use of framework of kernel logging, the tables of IP that are used in this case study
was displayed in an effective way in order to track the exterior and the interior traffic by
differentiating the destination and sources of the data packets and essentially it spoke about
the simulations of attacks that are harmful and that was executed at the RouterFW. Some
challenges can be easily found on the ways that lies on the fundamentals of the applications
those are arranged. The sites that are not wanted of the clients of the department of
production must have no right to entry are they are characterized by the use of unambiguous
hashes of keywords.
On the newer versions of Netfilter there are some patches that intensify the sufficiency and
the options of the tables of IP. The applications of commercial and the arrangements of
hardware can be differentiated to the improvement configuration of the tables of IP, skills and
the regulations. The essential feature about the tables of IP is that is open source and free and
it operates on an environment that is straightforward, upgradation and improvement.

26FIREWALL

27FIREWALL
7. REFERENCES
Csubak, D. and Kiss, A., 2016, July. OpenStack firewall as a service rule analyser.
In International Conference on Human Aspects of Information Security, Privacy, and
Trust (pp. 212-220). Springer, Cham.
Dadheech, K., Choudhary, A. and Bhatia, G., 2018, April. De-Militarized Zone: A Next
Level to Network Security. In 2018 Second International Conference on Inventive
Communication and Computational Technologies (ICICCT) (pp. 595-600). IEEE.
Diekmann, C., Michaelis, J., Haslbeck, M. and Carle, G., 2016, May. Verified iptables
firewall analysis. In 2016 IFIP Networking Conference (IFIP Networking) and
Workshops (pp. 252-260). IEEE.
Voronkov, A., Iwaya, L.H., Martucci, L.A. and Lindskog, S., 2018. Systematic literature
review on usability of firewall configuration. ACM Computing Surveys (CSUR), 50(6), p.87.
Zerkane, S., Espes, D., Le Parc, P. and Cuppens, F., 2016, May. Software defined networking
reactive stateful firewall. In IFIP International Conference on ICT Systems Security and
Privacy Protection (pp. 119-132). Springer, Cham.
Csubak, D. and Kiss, A., 2016, July. OpenStack firewall as a service rule analyser.
In International Conference on Human Aspects of Information Security, Privacy, and
Trust (pp. 212-220). Springer, Cham.
Caprolu, M., Raponi, S. and Di Pietro, R., 2019. Fortress: an efficient and distributed firewall
for stateful data plane SDN. Security and Communication Networks, 2019.

28FIREWALL
Neupane, K., Haddad, R. and Chen, L., 2018, April. Next Generation Firewall for Network
Security: A Survey. In SoutheastCon 2018 (pp. 1-6). IEEE.
Surana, J., Singh, K., Bairagi, N., Mehto, N. and Jaiswal, N., 2017. Survey on Next
Generation Firewall. Int. J. Eng. Dev. Res., 5(2), pp.984-988.
Waheed, M.S., Al Mufarrej, M., Sobhieh, M., Al Barrak, A., Baig, A. and Al Mazyad, A.,
2017, May. Implementation of virtual firewall function in sdn (software defined networks).
In 2017 9th IEEE-GCC Conference and Exhibition (GCCCE) (pp. 1-9). IEEE.
Say, T., Alkan, M., Dörterler, M. and Doğru, İ.A., 2018, September. CPU Performance Test
of A Home Firewall. In 2018 3rd International Conference on Computer Science and
Engineering (UBMK) (pp. 509-513). IEEE.
Zhang, H., 2017. Naked singularity, firewall, and Hawking radiation. Scientific reports, 7(1),
p.4000.
Sobeslav, V., Balik, L., Hornig, O., Horalek, J. and Krejcar, O., 2017. Endpoint firewall for
local security hardening in academic research environment. Journal of Intelligent & Fuzzy
Systems, 32(2), pp.1475-1484.
Frahim, J., Santos, O. and Ossipov, A., 2014. Cisco ASA: All-in-one Next-Generation
Firewall, IPS, and VPN Services. Cisco Press.
Brown, S., Carlin, S. and Torres-Negron, I., 2017. Next-Generation Defensive Cyber
Operations (DCO) Platform. Journal of Information Warfare, 16(2), pp.43-55.