5 Using ChoiceNet       

With a ChoiceNet server you can create lists of sites to provide custom access for dial-in and network users. You can create filters that use one or more of these lists to permit or deny user access.

ChoiceNet lets you centralize the storage of packet filters. Packet filters can control inbound or outbound traffic for each interface and user. You can apply filters to users, locations, or interfaces as either input or output filters. You can filter packets for TCP, UDP, and ICMP protocols.

This chapter includes the following topics:

•   "Constructing Site Lists" on page 5-1
•   "Introduction to Packet Filters" on page 5-5
•   "Constructing ChoiceNet Filters" on page 5-7
•   "Example 1: Limiting Child Access with ChoiceNet" on page 5-10
•   "Example 2: Limiting Student Access with ChoiceNet" on page 5-15

  For more information on filters, refer to the Configuration Guide for PortMaster Products.

Constructing Site Lists

ChoiceNet site lists are simple text files that you create and store in the /etc/choicenet/lists directory on the ChoiceNet server. The filename is the list name and consists of up to 15 printable, nonspace, ASCII characters. ChoiceNet lists can be created or modified at any time.

The site list contains the IP address-in dotted decimal notation-or the hostname of sites. Any number of sites can be included in a list. The site list file must have only one hostname or IP address per line. A simple site list appears in Figure 5-1.

Grouping Sites in a List

Preventing Access. If you want to prevent access to certain sites by network or dial-in users, you can place those sites together in one list. You can give this list any name, as long as the name meets the naming requirements-for example, deny_list or no_go.

Allowing Access. If you want to specify certain sites that users are expressly permitted to access, you can place those sites together in another list. You can give this list any name, as long as it meets the naming requirements-for example, wwwok or permit_list.

Using a Site List in a Filter Rule

Resolving Site Names to IP Addresses

You must run the ChoiceNet buildlist utility if you add or change any lists in the /etc/choicenet/lists directory. This utility resolves any site names included in the lists to their IP addresses and constructs a DBM database of the resolved addresses. The structure of a DBM database enables the server to find IP addresses quickly.

To resolve the names for a specific list, run the utility on the server as follows:

To resolve the names for all lists that have changed since the last time buildlist was run, run the utility as follows:

The ChoiceNet server uses the Domain Name System (DNS) for the Internet and the Network Information Service (NIS) for intranets to resolve names to addresses when you run /etc/choicenet/buildlist. The utility formulates a query for each name in a list in the /etc/choicenet/lists directory and sends the queries to a local domain name server. The name server translates the names to addresses and returns those to the ChoiceNet server. More information on DNS can be found in DNS and BIND in a Nutshell by Albitz and Liu.

The utility creates a DBM database in the /etc/choicenet/lists.dbm directory. Depending on your system, the database will consist of one of the following:

• Two files, ListName.dir and ListName.pag, for each ListName in the /etc/choicenet/lists directory
• One file, ListName.db, for each ListName in the /etc/choicenet/lists directory

If name resolution fails and you want to rebuild the list, the DBM file(s) for the list must first be deleted.

Example: Resolving Lists

Introduction to Packet Filters

Packet filtering analyzes the header information contained in each packet sent or received through an interface. The header information is evaluated against a set of rules, which either allow the packet to pass freely through the interface or cause the packet to be discarded without being forwarded.

ChoiceNet passes the packet to permit access to a service or site, and discards a packet to deny access to a service or site. This process reduces network traffic and provides more immediate feedback to a user attempting unauthorized access.

Each interface, whether synchronous, asynchronous, or Ethernet, can have a customized set of rules. For dial-in and dial-out interfaces, packet filters are enabled when a connection becomes active on the port (the port status on the PortMaster transitions to ESTABLISHED). For an Ethernet interface, filters are enabled as soon as the name of the input or output filter is applied to the interface.

Input and Output Filters

Use an input filter to filter packets coming into a PortMaster on an interface. Use an output filter to filter packets going out of a PortMaster on an interface. Figure 5-7 shows examples of how to apply input and output filters for a network using an Office Router to access the Internet through an Internet service provider (ISP).

Figure 5-7 Examples of Input Filters and Output Filters

Filtering Methods

• Source and Destination Address. A rule can evaluate either the source or destination address of a packet-or both. You can set the number of significant bits used in IP address comparisons to filter by a specific host, subnet, or network, or by a group of hosts whose addresses are within a bit-aligned boundary. Either the source or destination-but not both-can refer to a ChoiceNet site list.
• Source and Destination Port. Rules can use the source and destination port numbers to control access to certain network services. The rules evaluate whether the port number is less than, equal to, or greater than a specified value.
• Protocol. Rules can permit or deny TCP, UDP, or ICMP packets.
• Established Session. Rules can use the status of TCP connections. Network users can open connections to external networks without allowing external users access to the local network.

Constructing ChoiceNet Filters

You can define input and output filters for Ethernet interfaces, hardwired serial ports, users, and locations. When ChoiceNet is used with RADIUS (the typical application), you can specify filters in user entries on the RADIUS server.

You can associate filters with network users configured for dial-in SLIP or PPP access. When the user makes a PPP or SLIP connection, the designated filters are applied to the interface used.

You can associate location filters to dial-out locations using SLIP or PPP connections. When the connection is established to a remote site, the designated filters are applied to the interface used.

Because filters are very flexible, you must carefully evaluate the types of traffic that a specific filter permits or denies through an interface. If possible, test filters to verify that the filter is operating as you intended. The log keyword is very useful when you are testing and refining filters. Note: Any packet that is not explicitly permitted by a filter rule is denied. However, an empty filter permits everything. If you create a filter and apply it without defining any rules, the filter will permit all packets.

Filtering Guidelines

• Use Input and Output Filters Appropriately. Both an input filter and an output filter can be applied to each user, each location, and each network interface. Having both input and output filters can decrease the number of rules needed and make it easier to design and apply your access policy.
• Write Rules as Simply as Possible. While each filter can have any number of rules, fewer rules are better. Each rule needs to include only as much information as is necessary for that filter. For example, if a rule is not based on specific source and destination addresses, those can be omitted.
• Place Rules in the Proper Order. Rules are loaded by ChoiceNet in order. If you create the filter with PMconsole or by editing a text file, the rules are processed in order of appearance. If you create the filter from the command line interface, the rules are processed according to their rule number.

Placing rules in the order you want them evaluated eliminates ambiguity about how a packet is handled. The first rule that matches the packet is applied. If the rule is a permit statement, the packet is passed. If the first matching rule is a deny statement, the packet is discarded. If the packet does not match any of the rules, the packet is discarded.

In addition, specify packets that represent the highest volume of traffic early in the list of rules, where possible. Give careful consideration to which services and sites are permitted or denied for which users or interfaces.

Creating Filters for the ChoiceNet Server

RADIUS requires that filter names must end with .in for input filters and with .out for output filters. However, you must omit the suffix from the filter name in the Filter-Id reply item in the RADIUS user entry. The PortMaster appends .in for the input filter and .out for the output filter when it applies the filter to the user.

The filter file contains the rules to be followed when the filter is applied. You define the rules with keywords and values as described in Appendix B, "Defining Filter Rules."

You can add comments to the filter by beginning each comment line with a number sign (#). Comments can be useful as the number of filters you administer increases.

Consider the example filter net.in. Figure 5-8 shows the contents of this simple filter with seven rules as stored in /etc/choicenet/filters/net.in.

Using the RADIUS Filter-Id Reply Item

The PortMaster first looks for each filter in its local Filter Table. If it does not find the filter there, and a ChoiceNet server has been set, the PortMaster sends a request to the ChoiceNet server to download the filter.

Example 1: Limiting Child Access with ChoiceNet

This example shows how an ISP might offer a custom service for individual subscribers to provide access only to Web sites suitable for children (Figure 5-10). In this example, the ISP takes advantage of Yahooligans, a service available from Yahoo, Inc., and distributed with ChoiceNet. Yahooligans is a guided service for the Web designed specifically for children ages 8 through 13.

Figure 5-10 ISP Providing Custom Access for an Individual Subscriber

Figure 5-11 Preconfiguration Worksheet for Example 1

1. Establish the ChoiceNet service in the /etc/services file on the ChoiceNet server:

choicenet 1647/udp filterd

2. On the ChoiceNet server in the /etc/choicenet/clients text file, do one of the following, but not both:

• Define a ChoiceNet client name and shared secret:

  #Client Name Shared Secret #------------------------------------------- pm3.edu.net j42xlp3PQ56x

• Define a ChoiceNet client IP address and shared secret:

  #Client Name Shared Secret #------------------------------------------- 192.168.200.28 j42xlp3PQ56x

3. On the PortMaster, specify the address of the ChoiceNet server and define the shared secret:

Command> set choicenet 192.168.200.23 Command> set choicenet-secret j42xlp3PQ56x Command> save all

4. Create the /etc/choicenet/lists/yahooligans file on the ChoiceNet server:

www.nba.com www.stanford.edu www.abctelevision.com www.aetv.com

The list contains the Yahooligans-provided sites, one per line. The list is much abbreviated in this example.

5. Resolve the names in the yahooligans list:

/etc/choicenet/buildlist yahooligans

6. Create the /etc/choicenet/filters/kids.in filter on the ChoiceNet server for the custom Yahooligans access:

permit tcp estab permit udp dst eq 53 permit tcp dst eq 53 permit 0.0.0.0/16 =yahooligans tcp dst eq 80 permit icmp deny log notify

7. Install the user notification pop-up on each user's PC or Macintosh, if desired.

Refer to Chapter 4, "Installing User Notification."

8. Associate the kids.in filter with individual users on the RADIUS server.

To associate the filter with user joey for example, define the Filter-Id reply item in joey's RADIUS user entry as the filter name, stripped of the suffix .in:

joey Auth-Type = System Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Routing = None, Framed-MTU = 1500, Filter-Id = "kids"

When joey dials in to the PortMaster, RADIUS will apply the kids.in input filter on the interface coming into the PortMaster from the user.

9. Start the filter daemon using the following command:

/etc/choicenet/filterd

With this ChoiceNet filter in place, subscribers to the Yahooligans service can gain Web access to only the sites that are specified in the yahooligans list. The subscribers can only use DNS, HTTP, and ICMP services.

When a subscriber to this service attempts to connect to a site that is not listed in the yahooligans list, or tries to access a service not listed, such as FTP, the notify keyword in the rule opens a pop-up window on the subscriber's computer to inform the subscriber that access is denied. Because of the log keyword in the rule, the failed access attempt is also logged to the auth.notice facility of the client's loghost.

Example 2: Limiting Student Access with ChoiceNet

Figure 5-12 ISP Providing Custom Access for a School

The ISP can apply filters at one or more interfaces to limit access by students at the school. Figure 5-13, Figure 5-14, and Figure 5-15 show several alternative methods.

School's Ethernet Interface. Figure 5-13 shows an input filter students.in and an output filter students.out applied on the Ethernet interface of the school's Office Router. The students.in filter evaluates packets coming into the Office Router from students on the school network. The students.out filter evaluates packets going out from the Office Router to students on the school network.

Figure 5-13 Filters Applied on the School's Office Router Ethernet Interface

This configuration cannot be used with a dynamically downloaded file, but can be used with a site list.

Figure 5-14 Filters Applied on the School's Office Router Serial Interface

In Figure 5-15, the ISP has applied an input filter kids.in on the interface coming into the ISP's PortMaster from the school, and an output filter kids.out on the interface going out from its PortMaster to the school. The kids.in filter evaluates packets coming into the PortMaster from the school. The kids.out filter evaluates packets going out from the PortMaster to the school.

Figure 5-15 Filters Applied on the ISP's PortMaster Serial Interface

Figure 5-16 shows an example of a preconfiguration worksheet containing all the information needed to configure ChoiceNet for this example. Appendix D, "Preconfiguration Worksheets," has blank worksheets you can use to collect information before installing and configuring ChoiceNet.

Figure 5-16 Preconfiguration Worksheet for Example 2

1. Add the ChoiceNet service in the /etc/services file on the ChoiceNet server:

choicenet 1647/udp filterd

2. On the ChoiceNet server in the /etc/choicenet/clients text file, do one of the following, but not both:

• Define a ChoiceNet client name and shared secret:

  #Client Name Shared Secret #------------------------------------------- pm1.com.net 56mjq312YTM

• Define a ChoiceNet client IP address and shared secret:

  #Client Name Shared Secret #------------------------------------------- 192.168.225.3 56mjq312YTM

3. On the PortMaster, specify the address of the ChoiceNet server and define the shared secret:

Command> set choicenet 192.168.190.5 Command> set choicenet-secret 56mjq312YTM Command> save all

4. Create the /etc/choicenet/lists/yahooligans file on the ChoiceNet server:

www.nba.com www.stanford.edu www.abctelevision.com www.aetv.com

The list contains the Yahooligans-provided sites, one per line. The list is much abbreviated in this example.

5. Resolve the names in the yahooligans list:

/etc/choicenet/buildlist yahooligans

6. Create the /etc/choicenet/filters/kids.in filter on the ChoiceNet server for the custom Yahooligans access:

permit tcp estab permit udp dst eq 53 permit tcp dst eq 53 permit 0.0.0.0/16 =yahooligans tcp dst eq 80 permit icmp deny log notify

7. Install the user notification pop-up on each user's PC or Macintosh, if desired.

Refer to Chapter 4, "Installing User Notification."

8. Associate the kids.in filter with individual users on the RADIUS server.

To associate the filter with user masumi, for example, define the Filter-Id reply item in masumi's RADIUS user entry as the filter name, stripped of the suffix .in:

masumi Auth-Type = System Service-Type = Framed-User, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Routing = None, Framed-MTU = 1500, Filter-Id = "kids"

When masumi dials in to the ISP's PortMaster, RADIUS will apply the kids.in input filter on the interface coming into the PortMaster from the school.

9. Start the filter daemon using the following command:

/etc/choicenet/filterd

With this ChoiceNet filter in place, students at the school service can gain Web access to only the sites that are specified in the yahooligans list. The students can use only DNS, HTTP, and ICMP services.

When a student attempts to connect to a site that is not listed in the yahooligans list, or tries to access a service not listed, such as FTP, the notify keyword in the rule opens a pop-up window on the student's computer to inform the student that access is denied. Because of the log keyword in the rule, the failed access attempt is also logged to the auth.notice facility of the ISP PortMaster's loghost.