5.4 Evading Firewalls
Key Takeaways
- Firewalls evolved through generations: packet filters (L3/L4 ACLs), stateful inspection (connection tracking), application/proxy gateways (full L7 brokering), and next-generation firewalls (NGFW: stateful + app awareness + integrated IPS).
- A packet filter is stateless and judges each packet alone on IP/port/flags; a stateful firewall tracks each connection's state in a table and permits return traffic of established sessions.
- Proxy firewalls terminate the session and open a new one on the user's behalf, inspecting full HTTP/SMTP/FTP commands; NGFWs add deep-packet inspection, app-ID, and intrusion prevention.
- Evasion exploits trusted ports (source-port 53/80), fragmentation, IP spoofing/source routing, decoys, and tunneling protocols (HTTP, DNS, ICMP, SSH) that ride allowed channels.
- hping3 and Nmap are the primary firewall-probing tools (ACK scan to map rules, source-port spoofing, fragmented scans); defenders counter with stateful deep inspection, egress filtering, and disabling source routing.
Firewall Generations and Types
A firewall enforces an access-control policy between network zones (e.g., the Internet, a DMZ, and the internal LAN). CEH expects you to distinguish the firewall generations and what each can inspect:
| Firewall Type | OSI Layer | What It Inspects | Limitation |
|---|---|---|---|
| Packet filter | L3/L4 | Source/dest IP, port, protocol, TCP flags — stateless, each packet judged alone | No connection context; spoofed/fragmented packets slip through |
| Stateful inspection | L3/L4 (+state) | Tracks each connection in a state table; allows return traffic of established sessions | Limited payload visibility |
| Circuit-level gateway | L5 (session) | Validates TCP handshakes/sessions (e.g., SOCKS) | No payload inspection |
| Application/proxy gateway | L7 | Terminates and re-originates the session; inspects full HTTP/SMTP/FTP commands | Slower; per-protocol proxies |
| Next-generation (NGFW) | L3–L7 | Stateful + application identification, deep-packet inspection, integrated IPS, user-ID, TLS decryption | Cost/complexity |
The bastion host, screened subnet (DMZ), and multi-homed firewall are common architectures. A stateful firewall is the dividing line from a simple ACL: it remembers that an internal host initiated a connection and automatically permits the matching reply, rather than needing a static rule for return traffic.
Identifying and Probing Firewalls
Before evading a firewall, an ethical hacker fingerprints it. Firewalking sends packets with a TTL one greater than the firewall's hop count to learn which ports the firewall forwards (an ICMP time-exceeded reveals an allowed path). Banner grabbing and crafted probes can identify the vendor.
Nmap rule-mapping techniques:
- ACK scan (
-sA) — distinguishes stateful (filtered) from stateless firewalls and maps which ports are filtered vs. unfiltered. - Source-port manipulation (
--source-port 53/-g 53) — many sloppy rule sets trust traffic from DNS (53), HTTP (80), or FTP-DATA (20). - Fragmentation (
-f,--mtu) — splits probes to evade simple filters. - Idle/zombie scan (
-sI) and decoys (-D) — hide the true source among forged IPs.
hping3 is the flexible packet crafter for this work: it builds arbitrary TCP/UDP/ICMP packets, spoofs source IPs and ports, sends fragments, and sets any flag — ideal for testing exactly how a firewall reacts to crafted traffic.
Evasion Techniques
CEH groups firewall-bypass techniques around exploiting trust, ambiguity, and allowed channels:
- Source-port spoofing — send traffic from a trusted port (UDP/53, TCP/80) that a permissive rule allows.
- IP address spoofing & source routing — forge the source or use loose/strict source routing (LSRR/SSRR) options to dictate a path that bypasses filtering (which is why routers should drop source-routed packets).
- Fragmentation — break the malicious packet so header fields the firewall keys on land in different fragments.
- Decoys and idle scans — bury the real source IP among many forged ones so the firewall's logs cannot single it out.
- MAC/IP duplication and tiny-fragment tricks to confuse stateless filters.
- Tunneling / covert channels — encapsulate forbidden traffic inside an allowed protocol:
| Tunnel | Carrier Protocol | Why It Bypasses |
|---|---|---|
| HTTP tunneling | TCP/80, 443 | Web is almost always permitted outbound |
| DNS tunneling | UDP/53 | DNS is rarely blocked; encodes data in queries (iodine, dnscat2) |
| ICMP tunneling | ICMP echo | Ping data field carries payload (Loki, ptunnel) |
| SSH tunneling | TCP/22 | Encrypts and forwards arbitrary ports through one allowed session |
Tunneling is the most powerful class because it rides a channel the firewall is configured to trust.
Countermeasures
Defending the perimeter against these techniques:
| Evasion | Countermeasure |
|---|---|
| Source-port trust abuse | Write rules on stateful connection state, not bare source ports; never trust 53/80 as source |
| IP spoofing / source routing | Disable IP source routing on routers/firewalls; apply ingress/egress filtering (BCP 38) |
| Fragmentation | Reassemble before inspection; drop tiny/overlapping fragments |
| Decoys / idle scans | Rate-limit and correlate in a SIEM; geo/reputation filtering |
| HTTP/DNS/ICMP/SSH tunneling | NGFW deep-packet inspection + app-ID, restrict outbound DNS to internal resolvers, block/inspect ICMP payloads, monitor for anomalous query volume |
| General | Egress filtering (most networks only filter inbound), default-deny rule base, least-privilege rules, TLS decryption, and regular rule audits |
The two highest-leverage defensive habits CEH stresses: deploy a stateful/NGFW rather than a stateless packet filter, and enforce strict egress filtering — most organizations lock down inbound traffic but leave outbound wide open, which is exactly what tunneling and C2 exploit.
Defenders also harden against firewalking and reconnaissance by dropping ICMP time-exceeded/unreachable replies at the edge (or rate-limiting them), and by placing a default-deny rule at the bottom of the rule base so anything not explicitly permitted is blocked and logged. Rule bases should be audited regularly to remove stale "any-any" permits that accumulate over time and become evasion paths. On the exam, when asked how to stop covert tunneling, the answer centers on deep-packet inspection / NGFW application identification plus tight egress control, not just port blocking.
Remember too that a firewall is only as good as its rule base: a permissive rule trusting a source port or a forgotten temporary "any" permit can undo every other control, so least-privilege rule design is itself a primary countermeasure.
An internal host opens a web request to a server; the reply returns without any explicit inbound rule permitting it. Which firewall capability allows the return traffic automatically?
An attacker exfiltrates data by encoding it inside DNS queries to an external authoritative server using tools like iodine or dnscat2. What technique is this, and what is the best countermeasure?
Which Nmap technique best distinguishes a stateful firewall from a stateless one by mapping filtered versus unfiltered ports?