Firewalling gateways and IDS's

Question

For IDS, I plan to have a Win 2008 server running on the gateway with the majority of roles disabled. I plan to firewall the Internet connection, but I'd also like to install Snort to work as an IDS. However, I am guessing that regardless of the Snort install of the promiscuous Winpcap driver, I won't be able to monitor ports that the firewall blocks. My thinking is that chain of flow is:

Internet->Firewall on Win 2008->Winpcap->Snort->internal network

Is there a way to still monitor services that the firewall will block (i.e. TCP 445 SMB) ? Perhaps run the data through Snort and then through the firewall ?

Thanks

Answer 1

Usually you keep the IDS on the inside of the firewall to keep the usual "noise" of the internet out of your IDS logs. There's no need to have an alarm for a normal portscan every firewall blocks. What you want so see with an IDS (and/or block with an IPS) is all that funny stuff that passes your firewall.

{ Internet }---[ WAN Router ]---[ IDS/IPS ]---[ Firewall ]---{ internal network }

However, I see some disadvantages for using Windows here. Am I right that you want do use a 2k8 license just to filter and forward some traffic? Sounds expencive. And somewhat insecure. There are pre-packaged Linux/BSD distros with nice web-GUIs if you have no Unix experience.

Have a look at pfSense, it's a really nice firewall. And here is an article, which describes Snort integration. You can test it using VMWare, for example.

HTH,
PEra

Answer 2

I find your choice of Server 2008 rather odd for a firewall. Why not use something more appropriate, and a lot more cost effective? There are a number of Linux based firewall distributions, both OS and commercial. My personal preference is for Smoothwall, which includes Snort and more. If you add the Guardian add-on then it will also respond to Snort alerts, making it a lot more effective than just having a bunch of static rules.

You can monitor any ports you like, whether they are blocked or not. Of course you might not actually see any traffic on a blocked port but sure, you can still monitor it.

Answer 3

Is there a way to still monitor services that the firewall will block (i.e. TCP 445 SMB) ?

Depends on the firewall of your choice -- I am assuming you're going to use a 'real' firewall engine, and not just Windows' very limited built-in functionality? All firewalls that I have seen will happily log all connection attempts, but as PEra writes, very few people do so since the logs get huge real fast.

Kerio has a nice small-business firewall with good reporting built-in. I don't really know any other "firewalls to install on top of Windows" that are left now -- years ago that was a common model, but today the firewall has moved to appliances, and it seems to be moving into the router next.