Securing Networks with MikroTik Router OS
Zagreb,Croatia,
March 14th 2013
Presenter
Tom Smyth
CTO Wireless Connect Ltd.
http://wirelessconnect.eu/ Copyright 2007 -2013
Wireless Connect Ltd.
Irish Company Incorporated in 2006
Operate an ISP in the centre of Ireland.
Good Infrastructure Expertise.
Certified MikroTik Partners
Training
Certified OEM Integrators
Consultants
Value Added Reseller
Speaker Profile:
Studied BEng. Mechanical & Electronic Engineering,
DCU,Ireland
Has been working in Industry since 2000
Server Infrastructure Engineer
Systems / Network Administrator
Internet Security Consultant
1st MikroTik Certified Trainer in June 2007 in Ireland
Security Information sources
ENISA http://www.enisa.europa.eu/
OWASP http://owasp.org
Rits Group http://www.ritsgroup.com/
ISAS http://www.isas.ie/
SANS Institute http://sans.org
CIS Centre for Internet Security http://cisecurity.org/
NIST Computer Security http://csrc.nist.gov/
Open BSD http://OpenBSD.org/
Spamhaus.org http://spamhaus.org
nmap.org http://nmap.org
ha.ckers.org http://ha.ckers.org/
Router OS
Highly Versatile
Highly Customisable
Highly Cost Effective
Allows one to manage Security Threats in many Ways
What Can MikroTik Router OS Do ?
It is a Stateful Firewall
It is a Web Proxy
It is a Socks Proxy
It is a DNS Cache / Proxy
It is a Router
It is an IPSEC Concentrator
It is an IDS Intrusion Detection System
It is an IPS Intrusion Prevention System
Ways to Contact Tom
Email Info /a+/ wirelessconnect.eu
Phone
+353876193172
+35312916265
Skype
Tomwirelessconnecteu
http://wirelessconnect.eu/ Copyright 2007 -2013
Previous MUM Presentations
See my presentations from previous mums for more
information
MUM New Orleans 2012 -> MikroTik Advanced Security
MUM Dubai 2012 --> Blackhole Routing Techniques
MUM Budapest 2011 --> Advanced Firewall Strategies
MUM Poland 2010 --> Web Proxy as a Web application firewall
Check out My good friend Maia Wardner of MD Brazil's
Many Presentations on Network Security lots of examples
and brilliant illustrations
Overview
New IP Kernel hardening settings available in Mikrotik
Implementing Port isolation in Bridges to acheve private vlan
Functionality
http://wirelessconnect.eu/ Copyright 2007 -2013
IP Security Settings
New Security Hardening settings are available in Mikrotik Router OS v6
They set various fundamental Linux Kernel parameters to reduce
security risks to your router and your networks
The Settings Include:
IP Forward
Send Redirects
Accept Secure Redirects
Accept Redirects
Allow Fastpath
Reverse Path filtering
TCP Syn Cookie
http://wirelessconnect.eu/ Copyright 2007 -2013
10
IP Forward
According to Industry best practice (NSA/ CIS) that systems
that do not have router functionality should have IP
forwarding disabled.
Examples of Dedicated Systems that dont Require IP
forwarding Capability
Usermanager
Proxy
NTP
DNS Servers
Linux Kernel Parameter = net.ipv4.ip forward = 0
Disable the ability of the router to route packets from one interface
to another based on IP
http://wirelessconnect.eu/ Copyright 2007 -2013
11
Why Disable IP Forward
Prevents Servers / Appliances becomming unauthorised
routers
Prevents circumvention of firewall rules that block traffic
based on incomming interface.
http://wirelessconnect.eu/ Copyright 2007 -2013
12
Send Redirects
A Router can send redirects to request that a computer with
a sub optimal routing table can be temporarly corrected to
allow traffic to flow.
Redirects are Expensive computationally for the Router and
the Device Receiving them
End Devices do not require Send Redirects
Linux Kernel Parameters
net.ipv4.conf.all.send redirects = 0
net.ipv4.conf.default.send redirects = 0
http://wirelessconnect.eu/ Copyright 2007 -2013
13
Why Disable Send Redirects
A Router could in advertently give an attacker information
about the topology of the network
The Database Subnet is reachable via 10.1.2.3, not me.
http://wirelessconnect.eu/ Copyright 2007 -2013
14
Accept Redirects
Redirects inbound allow suboptimal routing tables on the
router to be temporarly overridden to allow communications
to occur
They are computationally expensive redirected traffic
increases load on the router dramatically
http://wirelessconnect.eu/ Copyright 2007 -2013
15
Why Disable Accept Redirects
Accepting Redirects allows your Routing Table to be
temporarly over ridden
Denial of Service
Vastly Increased Resource Usage
Potential for Redirecting Traffic through unauthorised devices (Man
in the Middle)
http://wirelessconnect.eu/ Copyright 2007 -2013
16
Secure Redirects
Accepting secure_redirects setting linux network interfaces
to accept ICMP redirect messages only from default
gateways in the routing table
Kernel Parameters that control this setting
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
http://wirelessconnect.eu/ Copyright 2007 -2013
17
Why Disable Secure Redirects
Accepting even secure redirects allows your Routing Table to
be temporarly over ridden by ICMP traffic comming from
Gateways in your routing table
Denial of Service
Vastly Increased Resource Usage
Potential for Redirecting Traffic through unauthorised devices (Man
in the Middle)
http://wirelessconnect.eu/ Copyright 2007 -2013
18
Allow Fastpath
Fastpath is a software optimisation of the kernel to allow
significantly increased forwarding speed
Fastpath optimises Throughput on a number of layers
Layer3 (Ipv4 and Ipv6)
Layer 2.5 (MPLS)
Layer 2 (Bridging)
http://wirelessconnect.eu/ Copyright 2007 -2013
19
Why not enable Fastpath?
The Dramatic increase in throughput is achieved at the
expense of firewall inspection and control
If Traffic control and security is your priority, one may have to
sacrifice some throughput.
http://wirelessconnect.eu/ Copyright 2007 -2013
20
Reverse Path Filter / Verification
Kernel level check of ingress traffic against IP
Routing Table
Strict RPF -> Only accept traffic entering on the
interface that the Best / most specific route
matching the packet uses
Loose RPF -> Accept traffic entering on any
interface that has a route that could be used to
route to the IP
Can be combined with Blackhole routes to allow
bi-directional Enforcement of policy
http://wirelessconnect.eu/ Copyright 2007 -2013
21
Alternatives to Firewall Filtering
If we want to filter traffic going towards a destination for
example
Let us take a look at the Kernel where, MikroTik Router OS
Does its Magic
22
MikroTik Kernel -Packet Flow
It Seems all packets flowing to / through the router are
processed using the routing table
23
Filtering Using Routes
Most people are familiar with Routing as a tool to help traffic
reach its destination,
These Normal routes are called Unicast routes
24
Enter the BlackHole Route
BlackHole the name from the astronomical phenomena
where any object placed into the BlackHole will never leave.
BlackHole Discard the Packet Route
25
Why Enable Fastpath
RPF + Black Hole Routes + Fastpath = Could mean
Accelerated Filtering :)
As long as RPF does not affect fastpath
http://wirelessconnect.eu/ Copyright 2007 -2013
26
TCP Syn Cookies
Enabling Syn Cookies prevents the Age old Syn attack
Denial of Service Attack
http://wirelessconnect.eu/ Copyright 2007 -2013
27
IP v6 Kernel Parameters
http://wirelessconnect.eu/ Copyright 2007 -2013
28
Bridge Horizon & Protected ports
http://wirelessconnect.eu/ Copyright 2007 -2013
29
Bridge Split Horizon
Bridge Port Split Horizon is a feature that allows the effecient
management of Traffic flow between ports
Bridge Port Split Horizon was primarly developed as a loop
avoidance Technology on VPLS meshed Layer 2 Networks
Horizon values are only significant locally
Horizons must be configured to avoid loops manually!
Split Horizon allows or disallows communication according to
the following rules
Frames are allowed flow between ports with different Horizon
Values
Frames cannot Flow between ports with the same Horizon
http://wirelessconnect.eu/ Copyright 2007 -2013
30
Create the Bridge
http://wirelessconnect.eu/ Copyright 2007 -2013
31
Disable STP
http://wirelessconnect.eu/ Copyright 2007 -2013
32
Identify Ports physical and their Policy
Clients cant talk to each other
Clients can talk to servers
Servers can talk to each other
http://wirelessconnect.eu/ Copyright 2007 -2013
33
Set Port Horizon Value according to
policy for servers
http://wirelessconnect.eu/ Copyright 2007 -2013
34
Set Bridge port Horizon value for Clients
http://wirelessconnect.eu/ Copyright 2007 -2013
35
Configured Bridge / Switch with Pvlan
Protection
http://wirelessconnect.eu/ Copyright 2007 -2013
36
Thank You
I hope you enjoyed the Presentation as Much As I Did :)
Come over and Chat with me about security, networking and
other exciting technologies, over a cup of tea!
Thanks to Mikrotik Support Staff for dealing with so many of
my requests... and keep pushing the developers!
http://wirelessconnect.eu/ Copyright 2007 -2013
37
