| HTTP Application Layer Gateway implemented
| | Change: |
As of v8.40.00, Clavister Firewall includes an HTTP ALG,
which supports:
| » | Stripping javascript/vbscript
| | » | Stripping java applets
| | » | Stripping ActiveX components (including flash)
| | » | Stripping cookies
| | » | Pattern-based URL blacklisting
| | » | Pattern-based URL whitlisting (exclusion from all above checks)
|
The new "http-outbound" service uses the HTTP ALG by default.
|
| Generic Routing Encapsulation support
| | Change: |
As of v8.40.00, Clavister Firewall supports GRE tunnels, which is
a standardized way of encapsulating, among other things, IP packets
inside IP packets. There are no security benefits of doing so,
but GRE may aid in certain routing situations.
| | Note: |
This does not mean that Clavister Firewall supports PPTP. Even though
PPTP makes use of GRE for parts of its functionality, PPTP
encompasses much more functionality than just encapsulation.
|
| Schedules implemented
| | Change: |
As of v8.40.00, schedules may be created to control different
aspects of the firewall - firewall policy, routing and traffic shaping.
A schedule contains a start and stop date, and may also be configured
on a per-hour-per-weekday basis.
| | Note: |
It may be advisable to set up time synchronization on the
firewall, and also to make sure that the local time zone
settings are correct, before making use of schedules.
|
| Auto-selection of VPN interface addresses improved
| | Issue: |
As with all other interfaces, VPN interfaces also have IP addresses.
They are used as source address when the firewall itself is communicating
over the tunnel, as source address in automatic NAT rules, and may also
be used to communicate with the firewall (ping, remote administration, etc.).
| | |
The IP address of VPN interfaces may be configured manually, or
picked automatically. Previously, the auto-select function has been
restricted to attempting to pick IP addresses of other firewall
interfaces, which in some cases would mean picking and address
outside of the local network, which could not be used in communicating
across the tunnel.
| | Change: |
As of v8.40.00, the auto-select function will always pick the first
IP address of the local network, plus one. Auto-selected addresses
will however not be reachable; they are only used as source
addresses. Hence, they will never block someone from reaching the
host that actually has the address that the firewall picked.
| | |
Manual configuration of the VPN interface IP address is still possible,
and will result in the firewall becoming reachable on that address.
|
| Support for more transparent tracerouting
| | Issue: |
As a protection against firewalking, Clavister Firewall has previously
refused to set the "TTLMin" setting below 2, and has refused to
send ICMP errors of its own.
| | Change: |
As of v8.30.02 / v8.40.00, the "TTLMin" setting can be set to 1,
and for traffic passing through rules/services with the "Pass
returned ICMP error messages from destination" flag set, the
firewall will also generate ICMP TIME_EXCEEDs for packets
whose TTL reach 0 when passing through the firewall.
These two changes, when used in combination, enables completely
transparent tracerouting through the firewall.
| | Note: |
If "TTLMin" is lowered below the depth of the internal network (plus 1),
and ICMP errors are allowed outbound (by e.g. allowing inbound
pings via the "ping-outbound" serviec), it will be possible to
use firewalking to map out the structure of private networks.
Use with care.
|
| DNS server IP addresses may now be learned via DHCP/PPPoE
| | Change: |
As of v8.40.00, the DHCP and PPPoE clients can now assign
received DNS IP addresses to symbolic names, which may then be
used in the settings section to tell the firewall which
DNS servers to use, as well as in other places in the
configuration.
|
| DHCP server now supports custom (user-specified) DHCP options
| | Change: |
As of v8.40.00, the DHCP server supports configuration of custom
DHCP options -- in other words, any existing and future DHCP option
may be configured without needing specific support in the firewall manager.
|
| Support for time synchronization via SNTP
| | Change: |
As of v8.40.00, the firewall time sync client supports the SNTP protocol
in addition to time/udp, which allows synchronization against a wider
range of time servers.
|
| Time servers may now be given using DNS names
| | Change: |
As of v8.40.00, the addresses of time servers (both types), may be
given using DNS names, given that the DNS client of the firewall
is configured.
|
| Option to remove own interface IPs from PBR tables
| | Issue: |
In "virtual firewall" scenarios, it may be useful to remove the firewall's
own IP addresses from a (policy-based) routing table, so that it does not
occupy address space that may be in use elsewhere in the network.
| | Change: |
As of v8.40.00, each policy-based routing table has a "Remove
Interface IP Routes" option. Checking it means that the firewall
is completely transparent to connections using that PBR table.
| | Note: |
To specifically make the firewall reachable on certain IP addresses,
add single-host routes via the "core" interface in that PBR table
(with no gateway set). Publishing such routes via proxy ARP on
relevant interfaces may also be useful.
|
| Support for local time zone time conversion
| | Issue: |
Local time on the firewall itself has previously been somewhat
unimportant, as its clock was only used to stamp shutdown messages.
However, with the advent of schedules (see above), keeping correct
local time is important.
| | Change: |
As of v8.40.00, local time zone data (base offset, DST offset,
start and end) may be configured under "Advanced Settings" ->
"Timesync".
|
| Interface health monitor for Intel e1000 NICs implemented
| | Issue: |
It has come to our attention that, in some setups, Intel e1000 NICs
experience intermittent packet loss problems. This would manifest
itself as the NIC working fine for anywhere between a few hours
or several few weeks, and then suddenly causing 10% packet loss
or worse. As far as we can tell, it only affects a minority of
users. We have not been able to ascertain specific reasons for
this occurence, and have implemented the health monitor as a
countermeasure.
| | Change: |
As of v8.30.02 / v8.40.00, an interface health monitor has been
implemented, currently targetting only e1000 NICs. It works by
measuring the sent/received packet rates compared to the input/output
error rate.
| | Details: |
The "IfaceMon" advanced settings section
controls the details of the monitor and defaults to triggering if the
error rate exceeds 20% outbound or 7% inbound for 10 consecutive seconds.
If triggered, the interface health monitor will emit a log entry
with category "IFACEMON" and reset the NIC. The log message is also
repeated after 10 seconds.
|
| Changed DHCP client default: use 0.0.0.0 rather than 169.254.x.x
| | Issue: |
DHCP clients are allowed to use 169.254.x.x addresses before they
have received a lease. This has been the default mode of operation
in Clavister Firewall until now. It has however come to our attention
that this default causes problems with some DHCP relayers, and that
0.0.0.0 is more likely to work.
| | Change: |
As of v8.40.00, the default for Advanced Settings -> DHCP Client ->
DHCP_UseLinkLocalIP is NO, meaning that the default is for the
firewall to use 0.0.0.0 until it has gotten a DHCP lease.
|
| Connection byte counters now only include IP headers+data
| | Issue: |
Previously, the connection byte counters (sent/received) shown
in the logs have included all plaintext data that the state
engine sees. For data received on physical interfaces, this
has included the Ethernet header. For data received via
VPN tunnels, it has only included the IP header and data.
| | Change: |
As of v8.40.00, the connection byte counts only include
IP headers and data, not media layer headers.
| | Note: |
Note that for small packets sent on Ethernets, the bandwidth
discrepancy can be as high as 50% since the minimum Ethernet
packet size is 60 bytes. Per-interface statistics for physical
interfaces however do still include media layer headers and
padding.
|
| Added statistics for DHCP server
| | Change: |
As of v8.40.00, the built-in DHCP server provides a full array
of statistics values that may be viewed via the Real-Time
Monitor or accessed via fwctl.
|
| Screen saver / status bar disabled (software firewalls only)
| | Change: |
As of v8.40.00, the screen saver and status bar (viewable only
by software firewall users) are disabled by default, as this
gives a noticeable increase in zero-loss throughput. The
new settings "ScrSave" and "StatusBar" in the "Misc" setting
section control this behavior.
|
| Changes to "httpposter" console command
| | Change: |
As of v8.40.00, the "httpposter" console command will show the
time remaining until the next URL re-post. A new switch "-repost"
has also been added to force a re-post ahead of time.
|
|