Copyright © 1996 Institute of Electrical and Electronics Engineers. Reprinted from The Proceedings of the 1996 Symposium on Network and Distributed Systems Security.

This material is posted here with permission of the IEEE. Internal or personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution must be obtained from the IEEE by sending a blank email message to info.pub.permission@ieee.org.

By choosing to view this document, you agree to all provisions of the copyright laws protecting it.

• Abstract
• Introduction
• The SURF Security Policy
• Request-Response Policy
  • Packet Filtering and Host Filtering
  • Application-Level Proxies for Ill-Behaved Application Protocols
• Exposing a Secure Public Image
  • Information Dissemination
  • Insecure Software
  • Supporting Guest Users
• Secure Non-Local Access
  • Secure IP tunnelling
  • Remote Login and Remote Execution
• Experiences in Designing and Deploying a Firewall
  • Off-The-Shelf Software and Hardware
  • Vulnerabilities of the SURF Firewall
  • User Acceptance
• Protocol Design Issues
  • TCP Back-Channels
  • Connectionless Protocols
  • Multicast traffic
• Conclusion
• Acknowledgements
• Filter Rules
• References
• About this document ...