JP3310851B2 - Filtering condition setting method for filtering device - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a filtering condition setting method for a filtering device, and more particularly to a filtering condition setting method for solving the difficulty of setting a condition when a filtering device and an application gateway are used together. .

[0002]

2. Description of the Related Art In recent years, the number of companies connecting to the Internet has been increasing rapidly, and the development of LANs at universities and research institutes has been progressing, and the number of hosts connected to the Internet is constantly increasing. Along with this, the number of cases where hosts and networks in Japan are targeted by intruders from outside is gradually increasing. One way to prevent such unauthorized access from the outside is to build a firewall.

A firewall is set to prevent unnecessary data packets from passing through a router or a gateway machine connected to the outside. The firewall includes a filtering device and an application gateway.

[0004] A filtering device generally controls packets in a network layer in order to control communication with a specific host or network. Then, when setting filtering conditions for the filtering device, a start address, an end address, a protocol, a start port, an end port, and a pass or non-pass processing method are set according to the communication restriction range. The five settings of the start address, the end address, the protocol, the start port, and the end port can be specified independently or in combination. This controls the passing / non-passing of packets inside and outside the filtering device.

[0005] The application gateway controls packets at the application layer or the transport layer. The application gateway may have a function of converting (changing) the IP address of the packet. This allows the packet I to
By changing the P address, leakage of internal network information can be prevented.

FIG. 11 is a configuration diagram of a general firewall. In the figure, 1 is a filtering device, 2 is an application gateway, 3 is a server, and 4 is a client. When the filtering conditions are set for the filtering device, if the configuration of the firewall includes only the filtering device, the start address and the end address corresponding to the communication restriction range are set as conditions.
However, when used in combination with an application gateway having a packet IP address conversion (replacement) function, it is necessary to set filtering conditions in consideration of the system configuration including the setting position of the application gateway and the conversion processing performed by the application gateway. . FIG. 12 shows a filtering condition setting of the filtering device 1 in a case where Telnet (a service using the protocol TCP and the port number 23) is permitted from the client 4 to the server 3 in the network configuration of FIG.

[0007]

As described above, the start point address and the end point address of the filtering condition setting items for the filtering device do not always match the IP addresses of the host or network for which communication is to be restricted. For this reason, setting conditions requires detailed knowledge of network security. Further, when the installation position of the application gateway is changed, it is necessary to rewrite all the filtering conditions each time. That is, there is a problem that the setting of filtering conditions when the filtering device and the application gateway are used together cannot be easily performed.

[0008]

SUMMARY OF THE INVENTION The present invention has been made in consideration of the above-described problems, and solves the difficulty of setting filtering conditions when a filtering device and an application gateway are used together. Provide a method to set filtering conditions without being aware of the installation location of

[0009]

DESCRIPTION OF THE PREFERRED EMBODIMENTS A source address having a source IP address and a source netmask, a destination address having a destination IP address and a destination netmask, a protocol, a source port, a destination port, a passing or non-passing processing method. A filtering condition setting file having setting items of the following, an application gateway definition file having service information including a protocol and a port relayed by the application gateway, and setting information of an installation position including a relative position of the application gateway to the filtering device and an IP address. Is used to set filtering conditions in the filtering device. As a result, it is possible to set filtering conditions without detailed knowledge about network security.

[0010]

1 to 10 show an embodiment of a filtering condition setting method for a filtering apparatus according to the present invention.

FIG. 1 is a block diagram of the present invention, wherein 10 is a filtering device, 11 is a filtering condition setting file, and 12 is an application gateway definition file. The filtering condition setting for the filtering device 10 is performed in the filtering condition setting file 1
1 and the application gateway definition file 12. In the filtering condition setting file 11, items of a start address, an end address, a protocol, a start port, an end port, and a process are set. In the application gateway definition file 12, items of service information and an installation position (a relative position with respect to the filtering device, an IP address) are set. Note that “relative position with respect to the filtering device” is hereinafter referred to as “relative position”.

FIG. 2 is a processing flowchart for setting a filtering condition, which will be described with reference to the flowchart. First, a filtering condition setting file in which filtering conditions are described is read (step S20).
1). It is determined whether there is an application gateway definition file (step S202). If there is a definition file, the process proceeds to step S203. If there is no definition file, the process proceeds to step S205. Read the application gateway definition file (step S20)
3). The contents of the filtering condition setting file are converted according to the contents of the application gateway definition file (step S204). The details of the conversion process of the contents of the filtering condition setting file will be described later with reference to FIG. According to the contents of the filtering condition setting file, filtering conditions are set to the filtering device (step S205).

FIG. 3 is a flowchart of a filtering condition conversion process, which will be described with reference to the flowchart. The filtering condition to be converted is set (step S301). It is determined whether the following processing has been performed for all the conditions in the filtering condition setting file (step S302). When the processing has been executed for all the conditions, this processing ends. If the processing has not been executed for all the conditions, the process proceeds to step S303. It is determined whether the protocol and the end point port of the filtering condition match the service information (protocol / port number) of the application gateway definition file (step S303). If they match, step S3
04, if they do not match, proceed to step S305. The contents of the filtering condition according to the installation position of the application gateway are converted (step S304). The details of the conversion process of the content of the filtering condition according to the installation position of the application gateway will be described later with reference to FIG. The change target is set to the next filtering condition (step S30)
5). Then, the process returns to step S302.

FIG. 4 is a flowchart of a filtering condition conversion process according to the installation position of the application gateway, which will be described with reference to the flowchart. The relative position of the application gateway is 0
(When the application gateway is located on the same machine as the filtering device) (step S401). If the relative position is 0, the process proceeds to step S402. If the relative position is not 0, the process proceeds to step S404. It is determined whether the start address or the end address seen from the client of the filtering condition does not match the IP address of the application gateway (step S402). If they do not match, the process proceeds to step S403. If they match, the process ends. The source address (the destination address seen from the server) as seen from the client is used as the outside IP address of the filtering device, and the destination address (the source address as seen from the server) as seen from the client.
Was changed to the inside IP address of the filtering device 2
(Step S403). Then, the process ends.

It is determined whether the relative position of the application gateway is 1 (when the application gateway is located inside the filtering device) (step S404). If the relative position is 1, step S405
Proceed to. If the relative position is not 1, the process proceeds to step S407. It is determined whether or not the starting address seen from the client of the filtering condition matches the IP address of the application gateway (step S405). If they do not match, the process proceeds to step S406. If they match, the process ends. Change the start point address seen from the client (end point address seen from the server) to the IP address of the application gateway (step S40)
6). Then, the process ends.

It is determined whether the relative position of the application gateway is -1 (when the application gateway is located outside the filtering device) (step S407). If the relative position is -1, step S4
Proceed to 08. If the relative position is not -1, the processing ends. It is determined whether or not the destination address seen from the client of the filtering condition matches the IP address of the application gateway (step S408). If they do not match, the process proceeds to step S409. If they match, the process ends. Change the end point address as viewed from the client (start point address as viewed from the server) to the IP address of the application gateway (step S40)
9). Then, the process ends.

FIG. 5 to FIG. 10 show a general example of a commonly used network configuration, a corresponding application gateway definition file, a filtering condition file, and a filtering condition setting of the filtering device by the above-described filtering condition setting process. .

FIG. 5 is a diagram showing a network configuration when an application gateway is not used. Client 4 (IP address = 123.1.1.1) is LAN
-1 via the filtering device 1 (inner IP address =
123.3.3.3.3). The filtering device 1 (outside IP address = 123.4.4.4) is a server 3 via LAN-2, a router, and the Internet.
(IP address = 255.6.6.6).

FIG. 6 shows the setting of the filtering conditions of the filtering apparatus 1 when the client 4 permits the server 3 to use Telnet (a service using the protocol TCP and the port number 23) in the network configuration shown in FIG. In this case, since the application gateway definition file 61 does not exist, steps S203 and S204 of the filtering condition setting processing flowchart of FIG. 2 are not performed, and the contents of the filtering condition setting file 62 are directly used as the filtering condition setting 63 of the filtering device 1. Become.

FIG. 7 is a network configuration diagram when the application gateway is located outside the filtering device. Client 4 (IP address = 1
23.1.1.1) is connected via LAN-1 to the filtering device 1 (inner IP address = 123.3.3.3). The filtering device 1 (outside IP address = 123.4.4.4.4) is connected to the server 3 (IP address = 255.
6.6.6), and the filtering device 1 (outside IP address = 123.4.4.44) is L
Application gateway 2 (IP
Address = 123.5.5.5).

FIG. 8 shows the filtering condition setting of the filtering device 1 in the case where the client 4 permits Telnet (service using the protocol TCP, port number 23) from the client 4 to the application gateway 2 in the network configuration of FIG. In this case, since the application gateway definition file 81 exists, the contents of the filtering condition setting file 82 are changed by the processing of steps S203 and S204 of the filtering condition setting processing flowchart of FIG. This is changed to the IP address of the application gateway), and becomes the filtering condition setting 83 of the filtering device 1.
The changed portion is the underlined portion, and the destination address of the condition for passing the packet from the client to the server is 255.6.6.
From 5.5.0.0 to 0.0.0.0, the starting address of the condition for passing the packet from the server to the client is 255.6.6.6 from 0.0.0.0 to 123.0.0.
5.5.5 It is changed to 0.0.0.0.

FIG. 9 is a network configuration diagram when the application gateway is located on the same machine as the filtering device. The client 4 (IP address = 123.3.1.1.1) is filtered via the LAN-1 by the filtering device 1 (inner IP address = 123.3.3.3).
Is connected to Filtering device 1 (outside IP address = 123.4.4.4) is LAN-2, router,
Server 3 via the Internet (IP address = 25
5.6.6.6) and the application gateway is in the filtering device 5.

FIG. 10 shows the filtering condition setting of the filtering device 5 when the client 4 permits Telnet (service using the protocol TCP, port number 23) from the client 4 to the application gateway in the network configuration of FIG. In this case, since there is the application gateway definition file 101, the contents of the filtering condition setting file 102 are changed by the processing of steps S203 and S204 of the filtering condition setting processing flowchart of FIG. This is decomposed into two conditions in which the IP address outside the device and the end point address seen from the client are changed to the IP address inside the filtering device), and the filtering condition setting 103 of the filtering device 5 is obtained.
The changed part is underlined, and the condition for passing the packet from the client to the server is that the destination address seen from the client is 255.6.6.60.
The condition changed from 0.0.0 to 123.3.3.3 0.0.0.0, and the start address as seen from the client is 123.1.1.1 from 0.0.0.0 to 123.0.0. 4.
The condition is changed to 4.4 0.0.0.0.

As can be seen from these three examples, without changing the contents of the filtering condition setting file,
By simply changing the contents of the application gateway definition file, it is possible to set filtering conditions for filtering devices having various network configurations.

[0025]

The present invention is embodied in the form described above, and has the following effects. Eliminating the difficulty of setting filtering conditions when using a filtering device and an application gateway together, it is also possible to easily set filtering conditions without being aware of the installation location of the application gateway,
Filtering condition setting work can be greatly reduced.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of the present invention.

FIG. 2 is a processing flowchart for setting a filtering condition.

FIG. 3 is a flowchart of a filtering condition conversion process.

FIG. 4 is a flowchart illustrating a process of converting filtering conditions according to an installation position of an application gateway.

FIG. 5 is a network configuration diagram when an application gateway is not used.

FIG. 6 is a diagram illustrating filtering condition settings of a filtering device in a case where Telnet (service using a protocol TCP, port number 23) is permitted from a client to a server in the network configuration of FIG. 5;

FIG. 7 is a network configuration diagram when an application gateway is located outside a filtering device.

FIG. 8 shows a Telnet from a client to an application gateway in the network configuration of FIG. 7;
This is a filtering condition setting of the filtering device when permitting (service using protocol TCP, port number 23).

FIG. 9 is a network configuration diagram when the application gateway is located on the same machine as the filtering device.

FIG. 10 shows a Telnet from a client to an application gateway in the network configuration of FIG. 9;
This is a filtering condition setting of the filtering device when permitting (service using protocol TCP, port number 23).

FIG. 11 is a configuration diagram of a general firewall.

FIG. 12 shows a network configuration of FIG.
This is a filtering condition setting of the filtering device when t (a service using the protocol TCP and the port number 23) is permitted.

[Explanation of symbols]

 10 Filtering device 11 Filtering condition setting file 12 Application gateway definition file

Claims (1)

(57) [Claims] 1. Setting of a source address having a source IP address and a source netmask, a destination address having a destination IP address and a destination netmask, a protocol, a source port, a destination port, a passing or non-passing processing method. Filtering condition setting file with items (11)
And the application gateway definition file (12) having service information including a protocol and a port relayed by the application gateway, and setting information on an installation position including an IP address and a relative position with respect to a filtering device of the application gateway. A filtering condition setting method for a filtering device, characterized by setting conditions.