Testing a Firewall

Before you can start logging access to your firewall, you need to ensure that you
have configured it correctly in the first place. Even if you have extensive experience
configuring firewalls, you will have to test your implementation when you
first install it. In fact, experienced professionals know that they have to continually
test a firewall to ensure that it is properly configured, and that its current
configuration protects the network. It is not enough to just check or read the
Ipchains/Iptables rules and then think that you have properly tested the firewall.
You need to actively send packets and monitor your firewall and internal network
to be sure.
Before you learn about applications that can help you test your firewall, you
first need to consider some of the actual attacks, problems, and issues to look for.
When testing your firewall, consider the following:

• Internet Protocol (IP) spoofing Many hackers outside of the firewall
  try to imitate internal network hosts in order to bypass authentication.
• Open ports/daemons Many firewalls and/or routers allow unnecessary
  ports to remain open, which can expose your firewall to threats
  unnecessarily.
• Monitoring system hard drives, RAM, and processors If your
  firewall runs out of disk space, or begins to run low on memory, your
  network may become incapacitated. Check your server’s performance
  regularly using standard tools (df, vmstat, top, and so forth).
• Suspicious users, logins, and login times Even if you allow only
  interactive login at your firewall, monitor it carefully to determine who
  has logged on. It is vital that you know exactly who is controlling the
  flow of packets on your network.
• Check the rules database One of the common moves by a hacker is
  to alter the rules database in subtle ways that make it easier for the
  hacker to gain access to the network. Check your rules and compare
  them carefully to ensure that no unauthorized changes have occurred.
• Verify connectivity After you have configured or reconfigured
  your firewall, make sure that these changes do not cause problems for
  management and employees.
• Remain informed concerning the operating system Bugs may be
  discovered in the kernel and/or daemons that you are using. If you do
  not keep current concerning the tools you are using, you may end up
  exposing yourself to hackers.
• Port scans If you are relatively new to securing firewalls, you will be
  amazed to find out how many times your firewall will be scanned.
  Logging all scans can consume an unnecessary amount of hard drive
  space and processor time. Still, the proper amount of logging will help
  you remain informed and will help you document scans that may be
  preludes to an attack.