42. Evading IDS, Firewalls and Honeypots – Detection Games
42.5 Firewall Types – What "Evasion" Means to Blue
Types you must recite:
| Type | Idea | Typical miss |
|---|---|---|
| Packet filter | Per-packet IP/port (classic iptables filter, simple SG) | No state; no app; fragmented/ack tricks on old gear |
| Stateful | Tracks TCP/UDP "this is a reply" (firewalld/nftables conntrack) | UDP "state" weak; policy too wide (any/any) |
| WAF | HTTP/S app rules (OWASP CRS / ModSecurity class) | Bypass via alternate encoding if parser off; still need code fix |
| NGFW | App-ID, user-ID, SSL decrypt (policy), IPS blade | Decrypt gaps; "allow the vendor" too broad – SUNBURST-class lesson |
Red "firewall evasion" in exam-language often means: policy hole, wrong direction (egress open), approved app abused, not a magic packet. Blue translation: review allow-lists, log denies, default-deny inbound and think about outbound.
# Amazon Linux lab – see what is actually allowed
sudo firewall-cmd --list-all
sudo firewall-cmd --get-log-denied
sudo firewall-cmd --set-log-denied=all
# Example rich rule: log + accept SSH only from Kali host-only (lab)
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.56.10" port port="22" protocol="tcp" log prefix="SSH-KALI " level="info" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-all
# Watch kernel log (Amazon Linux /var/log/messages; Ubuntu often /var/log/kern.log)
sudo tail -n 50 /var/log/messages
Ubuntu ufw note: sudo ufw status verbose then sudo service ufw status. Don't mix ufw + firewalld on one brain-dead VM without a plan.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Uses an allowed outbound 443 path for C2 | Egress proxy / allow-list destinations; DNS + TLS logs |
Finds forgotten public zone port (3306 on internet) |
Regular --list-all; default-deny; SG = 22 from admin IP only |
| Walks WAF with odd encodings | Enable WAF parsers; still patch the app (Chapter 41 XSS lesson) |
Ravindra Bagale's Tip
Students security group madhe 0.0.0.0/0 port 22 sodun "firewalld expert" mhantat. Cloud SG is the first firewall. Interview: show --list-all and AWS SG screenshot for the same lab. Nasel tar punha vacha.
Lab
On OWN Amazon Linux 192.168.56.40: sudo firewall-cmd --list-all before/after adding the SSH-from-Kali rich rule. From Kali, ssh (or nmap -p 22) – confirm log prefix SSH-KALI. From a different lab IP if you have one, confirm deny log. Snapshot.