User datagram protocol firewall
In a UDP firewall, a flow of packets is received from a public communications network, the flow of packets being sent into a private communications network. The firewall forwards a threshold amount of the flow of packets into the private communications network and validates the flow of packets in response to receiving a packet from the private communications network. In response to the validation failing the firewall blocks the flow of packets. In response to the validation succeeding the firewall allows the flow of packets to continue to be forwarded into the private communications network.
1 . A method performed by a system implementing a User Datagram Protocol (UDP) firewall comprising:
receiving, by the UDP firewall, a UDP flow of UDP packets from a public communications network, the UDP flow defined by a 5-tuple comprising source IP address, source port, destination IP address, destination port, and UDP transport protocol, the UDP flow of UDP packets being sent into a private communications network;
forwarding, by the UDP firewall, only a threshold amount of UDP packets of the UDP flow of UDP packets into the private communications network;
validating, by the UDP firewall, the flow of UDP packets only in response to receiving a UDP packet in a reverse direction having the same 5-tuple on the same flow;
in response to the validation failing, blocking, by the UDP firewall, the UDP flow of UDP packets; and
in response to the validation succeeding, allowing, by the UDP firewall, the UDP flow of UDP packets to continue to be forwarded into the private communications network.
2 . The method of claim 1 , wherein a lack of any packet being received in the reverse direction on the same flow is taken as validation failing.
3 . The method of claim 1 , wherein the reverse direction is from the private communications network towards the public communications network.
4 . The method of claim 1 , wherein the threshold amount is a number of packets received during a length of time taken to establish a voice over internet protocol (VOIP) call between a node in the private communications network of the communications network and a node in the public communications network of the communications network.
5 . The method of claim 4 , wherein the threshold amount is about one hundred packets.
6 . The method of claim 1 , wherein the threshold amount is a number of packets expected to be received during a length of time taken to establish a 5th generation (5G) voice over internet protocol (VOIP) call between a node in the private communications network of the communications network and a node in the public communications network of the communications network.
7 . The method of claim 1 , further comprising forwarding the threshold amount to a node in the private communications network, the node having denial of service defense functionality.
8 . The method of claim 1 , further comprising dynamically adjusting the threshold according to a number of flows that have been blocked by the firewall.
9 . The method of claim 1 , further comprising receiving periodic RTCP packets on a flow where media is expected to be unidirectional, the periodic RTCP packets being received from a node in the private communications network.
10 . The method of claim 9 , wherein the periodic RTCP packets are received at the same RTP port of the firewall as the flow where media is expected to be unidirectional, further comprising receiving the periodic RTCP packets at port N of the firewall and, in response, validating a flow on port N+1 of the firewall.
11 . The method of claim 9 , further comprising receiving one of the periodic RTCP packets, inspecting a payload of the received RTCP packet and in response to the payload being a specific payload, dropping the received RTCP packet.
12 . The method of claim 1 , wherein the firewall is stateless.
13 . The method of claim 1 , further comprising, in response to receiving more than a threshold number of flows in a given time period, triggering instantiation of another firewall.
14 . The method of claim 1 , further comprising tracking source internet protocol (IP) addresses of flows which have had multiple ports banned and blocking flows from these source IP addresses.
15 . The method of claim 1 , further comprising, in response to the threshold amount being exceeded within a specified time, blocking the flow.
16 . The method of claim 1 , wherein the packets are any of: simple traversal underneath network address translator (STUN) packets, real-time transport (RTP) packets, real-time transport control protocol (RTCP) packets, or session initiation protocol (SIP) packets.
17 . The method of claim 1 , further comprising, in response to a specified time elapsing after blocking a flow, unblocking the flow.
18 . A system implementing a user datagram protocol (UDP) firewall comprising:
a processor;
a memory storing instructions that, when executed by the processor, perform operations comprising:
receiving, by the UDP firewall, a UDP flow of UDP packets from a public communications network, the UDP flow defined by a 5-tuple comprising source IP address, source port, destination IP address, destination port, and UDP transport protocol, the UDP flow of UDP packets being sent into a private communications network;
forwarding, by the UDP firewall, only a threshold amount of UDP packets of the UDP flow of UDP packets into the private communications network;
validating, by the UDP firewall, the UDP flow of UDP packets only in response to receiving a UDP packet in a reverse direction having the same 5-tuple on the same flow;
in response to the validation failing; blocking, by the UDP firewall, the UDP flow of UDP packets; and
in response to the validation succeeding, allowing, by the UDP firewall, the UDP flow of UDP packets to continue to be forwarded into the private communications network.
19 . A computing device implementing user datagram protocol (UDP) firewall comprising:
a processor;
a memory storing instructions that, when executed by the processor, cause the UDP firewall to perform operations comprising:
receiving, by the UDP firewall, a UDP flow of UDP packets from a public communications network, the UDP flow defined by a 5-tuple comprising source IP address, source port, destination IP address, destination port, and UDP transport protocol, the UDP flow of UDP packets being sent into a private communications network;
for each packet in the UDP flow of UDP packets:
in response to validation, by the UDP firewall, of the UDP flow of UDP packets, pass the packet through the UDP firewall into the private communications network;
in response to lack of validation of the UDP flow of UDP packets, check a count of forwarded packets and,
in response to the count being lower than a threshold, incrementing the count and forwarding the packet through the UDP firewall into the private communications network; and
in response to the count reaching the threshold, blocking a source of the UDP flow of UDP packets.
20 . The UDP firewall of claim 19 , instructions that, when executed by the processor, perform operations comprising:
for each packet received from the private communications network, in response to a flow of the packet being unvalidated, validating the flow.