5.4 Evading Firewalls

EC-Council Certified Ethical Hacker CEH

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 CEH Exam Format, Cost & Eligibility 1.2 The Five Phases of Ethical Hacking 1.3 Information Security Fundamentals 1.4 Ethical Hacking Concepts, Scope & Legal Framework 1.5 The CEH Domains & Your Study Priority Map

2 Reconnaissance, Footprinting, Scanning & Enumeration

2.1 Footprinting & Reconnaissance Concepts 2.2 Footprinting Sources & Techniques 2.3 Network Scanning Concepts 2.4 Banner Grabbing, OS Fingerprinting & Scanning Beyond IDS/Firewall 2.5 Enumeration 2.6 Vulnerability Scanning & Countermeasures

3 Vulnerability Analysis & System Hacking Phases

3.1 Vulnerability Analysis Concepts 3.2 System Hacking Methodology Overview 3.3 Gaining Access: Password Attack Concepts 3.4 Privilege Escalation Concepts 3.5 Maintaining Access: Backdoors, Rootkits & Persistence 3.6 Covering Tracks, Anti-Forensics & Blue-Team Detection

4 Malware Threats, Sniffing & Social Engineering

4.1 Malware Concepts and Taxonomy 4.2 Malware Analysis and Detection 4.3 Sniffing Concepts and Layer 2 Attacks 4.4 Sniffing Countermeasures and Detection 4.5 Social Engineering Types and Human Psychology 4.6 Social Engineering and Insider Threat Defenses

5 Network & Perimeter Hacking

5.1 Denial of Service and DDoS Attacks 5.2 Session Hijacking 5.3 Evading IDS and IPS (Defensive Focus) 5.4 Evading Firewalls 5.5 Evading Honeypots and Defensive Deception 5.6 Network Security Controls and Architecture 5.7 Packet Analysis and Secure Protocols for Defenders

6 Web Server & Web Application Hacking

6.1 Web Server Attacks & Hardening 6.2 OWASP Top 10 Overview 6.3 Injection: SQL Injection & Command Injection 6.4 Cross-Site Scripting (XSS) & CSRF 6.5 Authentication, Session & Access-Control Flaws 6.6 API & Web App Security Testing Concepts

7 Wireless Network Hacking

7.1 Wireless Concepts and Standards 7.2 Wireless Encryption 7.3 Wireless Threats and Attack Concepts 7.4 Wireless Security Countermeasures

8 Mobile Platform, IoT & OT Hacking

8.1 Mobile Platform Threats & Security Models 8.2 Mobile Attack Vectors & Risks 8.3 Mobile Device Management & Enterprise Defense 8.4 IoT Hacking Concepts & Defense 8.5 OT, ICS & SCADA Security

9 Cloud Computing & Cryptography

9.1 Cloud Computing Concepts 9.2 Cloud Threats & Attack Surfaces 9.3 Cloud Security Controls 9.4 Cryptography Fundamentals 9.5 PKI & Cryptographic Applications 9.6 Cryptanalysis, Crypto Attacks & Best Practices

5.4 Evading Firewalls

Key Takeaways Explain This Topic AI

Firewalls evolved through generations: packet filters (L3/L4 ACLs), stateful inspection (connection tracking), application/proxy gateways (full L7 brokering), and next-generation firewalls (NGFW: stateful + app awareness + integrated IPS).

A packet filter is stateless and judges each packet alone on IP/port/flags; a stateful firewall tracks each connection's state in a table and permits return traffic of established sessions.

Proxy firewalls terminate the session and open a new one on the user's behalf, inspecting full HTTP/SMTP/FTP commands; NGFWs add deep-packet inspection, app-ID, and intrusion prevention.

Evasion exploits trusted ports (source-port 53/80), fragmentation, IP spoofing/source routing, decoys, and tunneling protocols (HTTP, DNS, ICMP, SSH) that ride allowed channels.

hping3 and Nmap are the primary firewall-probing tools (ACK scan to map rules, source-port spoofing, fragmented scans); defenders counter with stateful deep inspection, egress filtering, and disabling source routing.

Last updated: June 2026

Firewall Generations and Types

A firewall enforces an access-control policy between network zones (e.g., the Internet, a DMZ, and the internal LAN). CEH expects you to distinguish the firewall generations and what each can inspect:

Firewall Type OSI Layer What It Inspects Limitation

Packet filter L3/L4 Source/dest IP, port, protocol, TCP flags — stateless , each packet judged alone No connection context; spoofed/fragmented packets slip through

Stateful inspection L3/L4 (+state) Tracks each connection in a state table ; allows return traffic of established sessions Limited payload visibility

Circuit-level gateway L5 (session) Validates TCP handshakes/sessions (e.g., SOCKS) No payload inspection

Application/proxy gateway L7 Terminates and re-originates the session; inspects full HTTP/SMTP/FTP commands Slower; per-protocol proxies

Next-generation (NGFW) L3–L7 Stateful + application identification , deep-packet inspection , integrated IPS , user-ID, TLS decryption Cost/complexity

The bastion host , screened subnet (DMZ) , and multi-homed firewall are common architectures. A stateful firewall is the dividing line from a simple ACL: it remembers that an internal host initiated a connection and automatically permits the matching reply, rather than needing a static rule for return traffic.

Identifying and Probing Firewalls

Before evading a firewall, an ethical hacker fingerprints it. Firewalking sends packets with a TTL one greater than the firewall's hop count to learn which ports the firewall forwards (an ICMP time-exceeded reveals an allowed path). Banner grabbing and crafted probes can identify the vendor.

Nmap rule-mapping techniques:

ACK scan ( -sA ) — distinguishes stateful (filtered) from stateless firewalls and maps which ports are filtered vs. unfiltered.

Source-port manipulation ( --source-port 53 / -g 53 ) — many sloppy rule sets trust traffic from DNS (53), HTTP (80), or FTP-DATA (20).

Fragmentation ( -f , --mtu ) — splits probes to evade simple filters.

Idle/zombie scan ( -sI ) and decoys ( -D ) — hide the true source among forged IPs.

hping3 is the flexible packet crafter for this work: it builds arbitrary TCP/UDP/ICMP packets, spoofs source IPs and ports, sends fragments, and sets any flag — ideal for testing exactly how a firewall reacts to crafted traffic.

Evasion Techniques

CEH groups firewall-bypass techniques around exploiting trust, ambiguity, and allowed channels:

Source-port spoofing — send traffic from a trusted port (UDP/53, TCP/80) that a permissive rule allows.

IP address spoofing & source routing — forge the source or use loose/strict source routing (LSRR/SSRR) options to dictate a path that bypasses filtering (which is why routers should drop source-routed packets).

Fragmentation — break the malicious packet so header fields the firewall keys on land in different fragments.

Decoys and idle scans — bury the real source IP among many forged ones so the firewall's logs cannot single it out.

MAC/IP duplication and tiny-fragment tricks to confuse stateless filters.

Tunneling / covert channels — encapsulate forbidden traffic inside an allowed protocol:

• Tunnel Carrier Protocol Why It Bypasses
• HTTP tunneling TCP/80, 443 Web is almost always permitted outbound
• DNS tunneling UDP/53 DNS is rarely blocked; encodes data in queries (iodine, dnscat2)
• ICMP tunneling ICMP echo Ping data field carries payload (Loki, ptunnel)
• SSH tunneling TCP/22 Encrypts and forwards arbitrary ports through one allowed session

Tunneling is the most powerful class because it rides a channel the firewall is configured to trust.

Countermeasures

Defending the perimeter against these techniques:

Evasion Countermeasure

Source-port trust abuse Write rules on stateful connection state , not bare source ports; never trust 53/80 as source

IP spoofing / source routing Disable IP source routing on routers/firewalls; apply ingress/egress filtering (BCP 38)

• Fragmentation Reassemble before inspection ; drop tiny/overlapping fragments
• Decoys / idle scans Rate-limit and correlate in a SIEM; geo/reputation filtering

HTTP/DNS/ICMP/SSH tunneling NGFW deep-packet inspection + app-ID , restrict outbound DNS to internal resolvers, block/inspect ICMP payloads, monitor for anomalous query volume

General Egress filtering (most networks only filter inbound), default-deny rule base, least-privilege rules, TLS decryption, and regular rule audits

The two highest-leverage defensive habits CEH stresses: deploy a stateful/NGFW rather than a stateless packet filter, and enforce strict egress filtering — most organizations lock down inbound traffic but leave outbound wide open, which is exactly what tunneling and C2 exploit.

Defenders also harden against firewalking and reconnaissance by dropping ICMP time-exceeded/unreachable replies at the edge (or rate-limiting them), and by placing a default-deny rule at the bottom of the rule base so anything not explicitly permitted is blocked and logged. Rule bases should be audited regularly to remove stale "any-any" permits that accumulate over time and become evasion paths. On the exam, when asked how to stop covert tunneling, the answer centers on deep-packet inspection / NGFW application identification plus tight egress control , not just port blocking.

Remember too that a firewall is only as good as its rule base: a permissive rule trusting a source port or a forgotten temporary "any" permit can undo every other control, so least-privilege rule design is itself a primary countermeasure.