How to Pen Test a Firewall Externally

A firewall is a device or software which is responsible for filtering network traffic.
It can be implemented between a trusted zone (Corporate Network Area) and an untrusted zone (Internet).
All communication between trusted and untrusted zones flows through the firewall, which decides whether to grant or reject access.
It uses different methods to filter out information.

Types of Firewalls

• Packet-filtering firewalls:
  Operate at the router level, comparing each received packet to a set of defined criteria
  (such as allowed IP addresses, packet type, port number, etc.) before forwarding.
• Circuit-level gateways:
  Responsible for monitoring the TCP handshaking between trusted and untrusted (remote) hosts
  to determine whether a session is legitimate.
• Stateful inspection firewalls:
  Examine each packet while keeping track of whether that packet is part of an established TCP session.
  Offers more security than packet filtering or circuit-level gateways.
• Application-level gateways:
  Decide whether to drop or forward a packet based on application information.
• Multilayer inspection firewalls:
  Combine multiple firewall approaches, using a packet-filtering method that examines all seven layers
  of the Open Systems Interconnection (OSI) model.

Firewall Penetration Testing

In external penetration testing, a security analyst tests the ports and services available
on the organization’s external network. A live scan of the firewall can be performed using
nmap, a network mapping and port scanning tool. Nmap offers a variety of
scanning methods that can be used to analyze firewall configurations.

What is Port Scanning?

Port scanning is the process of attempting to connect to a number of sequential ports in order
to determine which ports are open and what services are running behind them.

Using nmap, we can check which services are open on a remote host and what could
be protected by its firewall. Below are some example commands:

Useful Nmap Commands

• Scan operating system:

  sudo nmap -O remote_host

• Scan a specific port instead of all common ports:

  sudo nmap -p port_number remote_host

• Scan for TCP and UDP open ports:

  sudo nmap -n -PN -sT -sU -p- remote_host