So, our packet filtering firewall is trying to protect an internal network and also control what the internal users can do to the outside network. So, our firewall looks at the packets that go through it and based upon the packet information it accepts or drops those packets to implement some policy. So we talk about accept and drop as the actions to take on particular packets and the main information or the simple information we're looking at for each packet is the IP addresses, source and destination, the source and destination port numbers which will identify applications, the protocol number which identifies the transport protocol, TCP or UDP there are others as well. For example, ICMP has protocol number one so if we want to block pin packets we could look at the protocol number, sometimes we'll also look at which direction from the firewall the packets coming from, the interface and based on that information we create some rules and those rules tell the firewall which packets to allow through and which not. So, let's go through some examples and look at a new feature. Here's our simple network, we have a firewall, connects an internal network, the inside to some outside network and to keep the example simple we'll let's just look at two computers but there are many computers imagine, that is there are many computers inside and of course many networks outside so this is the internet on the outside but we'll use computer one and computer two as some examples here. So let's say we have the task of configuring the firewall so we need to create rules in the firewall table and that's what we'll draw here. The rules we'll use those five protocol header fields of source destination IP, source destination port and protocol, transport protocol and based on those rules we'll perform some action. Let's say as the first case we are going to have a default policy of accept everything. So with a firewall we normally create rules and for the packets that don't match those rules we take some default action and for the first example let's say our default action is accept everything, we're very open, we want to allow all the traffic through but for a simple case let's say we want to block computer two from accessing the web server on computer one. So create a rule that does that so try and think of a rule that will stop computer two from accessing the web server on computer one and the default policy, so a firewall table will often think about what do we do if we don't have a rule that matches let's say in this case it's accept. So now create a rule let's say rule number one that will block computer two from accessing computer one. What do we do? Any suggestions? This is what your quizzes and homeworks will require you to do and the exams is given a policy, given a requirement, block computer two from accessing the web server on computer one. So let's set up the firewall, source IP is 2.2.2, so here this column of source actually to save a little bit of space I'll say the source will specify both the source IP and the source port number, source IP which computer did it come from and the source port which application does it come from. So if we need to block computer two then we need to specify the source IP would be 2.2.2 and just to do it in shorthand the column to separate what port number doesn't matter with a, so this is the source application. We want to block the application here from accessing the web server. What application accesses a web server, a web browser? What port number does a web browser use? We don't know in advance, that is the firewall doesn't know. How does a web browser get a port number, the operating system on this computer assigns one, usually within some range, above 30,000 up to 65,000. So the firewall won't know what port number it uses. So let's say any value, doesn't matter what source port it is. We can write star or some other notation, star meaning matches any value. That's the source information, destination. We want to block it from accessing computer one so the destination IP. So imagine there are other computers on the internal network, I just didn't draw them. So we should specify the destination, port for web browsing port 80 because the web server on computer one should use port 80 and the firewall would know that. Protocol for web browsing we use TCP, action, default action is accept, we should drop the packet. So there's our simple firewall rule. So it should stop all the traffic between the web browser on computer two and the web server on computer one. Question? Okay, what does star mean? They have the web no port already. So I see what you're getting at. Star means all possible values in some range. Port numbers are 16 bit values so their possible values are zero up to around 65,000. So that's the possible range. Star means any of those 65,000 values if they match here then this is match. We could be more specific and say a range of values. Any value between 10,000 and 50,000, any value within some range that we want. So yes we can be more specific. In this case, well let's leave it at this and let's see another example and see what we can do to deal with other port values. But star is okay here means anything that this one says sends, doesn't matter what port that web browser uses, port one, port 100, doesn't matter what one it will be dropped if it's sent to the web server. If we were more specific, if we reduce the range then it may mean the computer 2 could use a port outside that range. Does it work? Well I think you can see that if computer 2 creates a packet, so remember most applications are client server based. Someone initiates the communications. Web browsing, computer 2 initiates the communications, it creates a packet. Source address is 2222, if it's sending the web server. Destination IP is 1111, destination port is 80 and let's say the source port is 40,123. So the browser has a port of some random number within a range of say 40,123. That packet is sent, it reaches the firewall. The protocol being used is TCP because web browsing uses TCP and this rule would match with a port number of 40,123. This star matches that value. The conditions match therefore the action is taken for that packet to drop it. So that would work and that stops the web browsing because if we stop the first packet there will be no response. So we will never get a response from the web server from computer 2's perspective. That's easy that one. Let's try a different one. Any questions on that rule? Let's say we want to do something different. We want to have a default policy of, I'll just note it down the bottom, of drop. Which is better normally. That is drop all packets that don't match our rules and we'll create some rules to accept some. Now let's say a different case where we want to allow our web browser on computer 1 to access the web server on computer 2. So computer 2 is an important web server that we need to allow our user to access. So we want to allow them to access that web server, nothing else. Create a rule or rules to do so. Now computer 1 to access the website on computer 2. Source, source IP 1111, source port, don't care. We don't know in advance. The firewall doesn't know what port number the web browser will use because today it uses 40,000, tomorrow it uses 50,000. So we cannot configure it in advance to know the port number so let's say any value, any port. Destination, easy. Destination port, web server port 80, again using TCP. Action, accept. Okay so in this case something different, default policy is to drop packets. Anything that doesn't match is dropped. So let's draw and let's, given this rule, allow computer 1, any port to contact computer 2 on port 80. What's, is it going to work? What's the problem? The policy, the requirement was allow computer 1 to access the web server on computer 2. Let's, any ideas of, here's the hint, it won't work. Any ideas why? What's wrong? I want to drop. I want that. I'm not going to change that because that's a good security approach to drop everything that we don't create rules for. So what's wrong with that? Alright let's go to the details and see, we have web browsing. So the protocol we're using is HTTP but actually before we transfer any HTTP data we actually have to set up a TCP connection. So we need to establish a connection. Let's draw what happens when we establish a connection. Computer 1 is sending something to computer 2 and they open their browser and they type in the address of computer 2 and that triggers TCP to go to work and TCP creates a connection and it sends a TCP SIN segment. If you remember TCP, we've got a 3-way handshake to establish a connection SIN, SINAC, AC. This TCP SIN segment, the source address is of course of computer 1 and let's say our web browser chose a port, I'll just choose a random number 540561. Where does that come from? The operating system chooses a port number within some range. So my browser triggers a connection to be created from client to server where the source IP is 1111, source port is 40561 and the destination IP is going to be 2222 and the destination port we know is 80, the web server. So this TCP segment has a source port, a source IP and source port and a destination IP and destination port. Is it accepted by a firewall? So this segment is created by computer 1, it goes to the firewall, does it match this condition? Well, IP address matches, port matches because it's any value. It matches, destination port matches, the protocols TCP, this packet is accepted, it gets out. The server receives it, computer 2 receives this TCP SIN and what does the server do? It replies with a SINAC and the SINAC, the source is IP 2222, it's coming from computer 2. Port is 80, the destination IP is 1111, destination port is 40561 and it's a SINAC, a TCP segment. What's our firewall do with this packet? It drops it because if the source is these two values, it doesn't match the first rule and we've only got one rule so therefore if it doesn't match the first rule, we take the default action of dropping this packet. The firewall drops this response, so the packet goes from computer 2 across the network, it gets to the firewall, compares the source values to this rule, doesn't match, therefore moves on to the default action of dropping the packet. Therefore we don't get to set up a connection and therefore our computer 1 doesn't get to browse to the website of computer 2. We didn't achieve our aim. Our aim was allow computer 1 to access computer 2 web server, allow it to browse the website. What do we do? Add a new rule. So therefore remember we need to be careful, even though we allow the 1 packet out, most protocols are request response. We send 1 packet out, 1 comes back. So our firewall should be configured to allow in both directions. So let's add a rule to allow the response. Any suggestions? What should the source be? Okay, the response comes from computer 2. Port number? Okay, because it's going to come from a web server. Destination is going to be computer 1. Port number? Again, we must configure this firewall in advance. So in this instance the port number is known but the firewall doesn't know that. So when we configure the firewall we must say any number and the protocol is still TCP. So then with this second rule, this response packet, the CINAC, doesn't match the first one but it should match the second rule and therefore would be accepted. So the response would come back and with TCP connection set up, there's a CINAC and another AC, but that third AC would match the first rule, it's the same conditions as the first packet, and then we send the HTTP GET request, again it matches the first rule, same source values, still using TCP. So the HTTP GET request would be allowed, the response would be allowed to come back because of this second rule. So we'd allow now our web browsing to work. So we need to be careful with making sure that we allow the request and the response or both directions. Any problems? So now our web browsing works from computer 1 to computer 2. We've got a problem though. What is it? Sorry? HTTP still uses TCP, so in our packet filtering firewall we're not looking at the application layer protocol, all we're looking at is the addresses and the transport layer protocol. So if we keep drawing out our sequence here, I think you'll see that it will allow the web browsing to work because the CINAC would not be dropped but it would come back because of the second rule, and then if we kept going the TCP connection would be set up, the AC would be allowed again, the source port and the destination values match, and then we send a HTTP request, the web page request, which is really just TCP, a TCP segment, TCP data. And again, because the source IP is still 1111, source port matches out any value, destination IP and the destination port still match the first rule, this one would be allowed or accepted by the firewall. And the response would be accepted to come back, so our web browsing would work. With these two rules, we've achieved our goal of allowing computer 1 to browse to computer 2, but we've created another problem. Anyone see it? Our original goal was allow only computer 1 to browse to computer 2, drop everything else, don't allow other applications, that means. We didn't allow computer 2 to browse to computer 1, we didn't allow secure shell or other applications, but there's another problem we've introduced. This second rule means that if computer 2 creates a packet and the source port is 80 and the destination is computer 1, with any port, that packet will be accepted. So this rule that we just added to allow the response actually allows computer 2 to send a packet to computer 1. And it may not be a web browsing packet, it may be some other packet. Anything that comes from this source port of 80, what comes from port 80, well normally it's a web server uses port 80. But if computer 2 was a malicious user, there's nothing to stop them from creating their own application that uses port 80. The ports are controlled by the user of the computer. Although port 80 is normally used by a web server, there's nothing to stop me from starting an application on my computer that uses port 80, an application for some malicious purpose. So what a malicious user could do then is on computer 2 start their own application that uses a source port of 80 and therefore send a packet to computer 1. Because computer 1, this rule accepts on any destination port and the firewall would allow that packet to come in. And the firewall would allow the response to go out. So if a malicious user uses computer 2, they can control the ports that they use. So we have a problem now. We created this rule to allow the response but it allows this case of a malicious user now sending packets through our firewall and defeating our purpose of controlling access to the network. Any questions on that concept? So we need to be careful with our rules that by creating a rule we don't allow something else in. And this one does allow other unintended packets in. We really just wanted it for the response. What can we do to overcome that? Yeah, we'll see that one thing we can do is allow the firewall to keep track of the port numbers that it uses. Before we get to that, what's another thing? Well, a related thing to do is we could look at the TCP flags, whether it's a SIN segment or a SIN Act. We know that a TCP SIN segment should be the first segment that comes. So this first rule, we could start to add more rules. This first one, we could add another condition that allow it if it's a TCP SIN. Now this response, if it's a SIN Act, so add another condition that looks not just at the addresses and whether it's TCP, but looks at the details of the TCP segment and looks at the flags. And maybe create further rules that have these extra conditions as what type of TCP segment it is. And that can allow us to now, if we have this condition, malicious user on computer 2 creates their own packet to send to computer 1. The first packet that that application sends is always a TCP SIN, whereas this one says the condition must be at a SIN Act. So the firewall would detect that if computer 2 creates a packet to send to computer 1, it wouldn't match this rule because it's not a SIN Act, it's just a SIN segment and therefore the firewall would drop it. So by adding further conditions, we can start to again achieve our goal of allowing just web browsing. But then we'd need conditions to allow the SIN to go out. The SIN Act to come back and then the Act to go out, maybe another rule for that and then special conditions for the data as well. It gets complex just to allow web browsing. Our firewall table of rules becomes harder and harder to create. Well, there's a simpler way around that in that people, essentially there's an extension that allows the first packet and then another part of the firewall keeps track of that connection. It keeps track of, okay, a connection has now been established or is in the process of being set up and established, allow any packet related to that connection only. That's what we want going back to, there we have it. Just look at the first rule, assume the second rule is no longer there. That allowed our SIN segment to go out but we had a problem that their SIN Act wouldn't come back. But what we do is we add another feature of the firewall that says if we allow a SIN to go out, record the addresses involved, record the source IP and source port, record the destination IP and destination port, store them in some table and any packets that come back which use those addresses, let's automatically allow them because they're all related to that one connection. Instead of having to create separate rules to allow the request and response, allow just the first packet and then add this extra feature of the firewall that will keep track of all related packets. The related packets are those which have the same five values of IP port, IP port and transport protocol TCP. Because of the way TCP creates connections, there will be subsequent packets all using those same values. And the concept is called stateful packet inspection. We go back to our lecture slides to discuss and then extend our example to see that. Normally a simple packet filtering firewall doesn't keep track of the past packets, it's stateless. But as we saw, things get complex if we want to create rules to allow simple applications like web browsing. Therefore to make it simpler, we use stateful packet inspection which really stores information about the past packets, especially the past packets which have been accepted. So if we allow that first SIN segment out, then the concept is allow all other packets which use those same pair of addresses, store information about the ones allowed and then make decisions based upon that. So store some state and then we get stateful packet inspection, SPI. It's really an extension of a very simple packet filtering firewall. It adds an extra feature. It requires some memory to store the state information, which can be an issue when there are thousands of connections happening at the same time through the firewall. Let's go back to our example and see how we could use that. Let's go back to the start. So come back to our first rule that we created. We want to allow computer one to browse to computer two. Nothing else. That's our aim. So we have our firewall table. Our default policy was drop and we'll come back to that first rule that we created. If the source is one, one, one, one, source port any value, if it comes from computer one, going to computer two, port 80, TCP, accept. And let's say we also use this feature of stateful packet inspection. The firewall is set up to use that. What that means is actually the firewall maintains another table of any connections that have been set up or established. So let's see if we can see what happens. Let's draw our SPI table, our stateful packet inspection table. Think of it, another table. It looks like similar to our firewall table, source, destination, protocol, and state, not action. So we have a second table stored in the firewall, initially empty. Now our web browser starts to contact the server. So what happens? We'll draw that exchange again. Computer one is trying to contact computer two. What does it do? It sends the TCP SIN segment. Again the source IP address and the browser chose some port number, 50,167. It changes. Sends the TCP SIN and the destination is computer two, port 80. So that's the first packet created. Is it accepted by our firewall? Now we have two tables to look at. So we see the packet information. We actually, when a packet comes in, one, the concept is think about you compare the packet to the stateful packet inspection table. If it matches any entry in here, we can accept it. There's no entries in here at the start. So let's ignore this table. Or we compare it against our original firewall rule. Doesn't match the rule? Does this packet match rule number one in our firewall? Yes, source port, source IP, OK, source port, OK, destination, OK, TCP, OK, therefore we accept it. So we're going to accept this packet. And what we do now is that the firewall, because it accepts this packet, it adds an entry to the SPI table. It records these values of the addresses in the table. Let's add them. The source, and it record the specific port number as well. And the destination, port 80, TCP. So we record the values of that packet that has been accepted out. So the intention that if we accept this SIN packet out, we should accept subsequent packets related to this connection. And how do we know a packet's related to this connection? Because of the addresses. There shouldn't be another application on computer one that uses the same port number. Because the computer assigns unique port numbers to each application. So on computer one, no one else is going to use 50,167. And similar, there's no other applications on computer two that use port 80, because it's the web server there. Actually what is the state here? I think the state is that the connection is being set up. We're in the state of setting up this connection. I want to write it down, because we're going to change it in a moment. But the state, let's say, setting up is the state, meaning the firewall knows that the SIN segment is being sent out. That was allowed. Computer two responds with a SIN act. And instead of looking at the firewall rule, look first at the SPI table. And even though we listed them as source and destination, the SPI table is used in that any packet that includes these four addresses and is using TCP, we will process and accept. So this packet is SIN act, source address is 2222, source port is 80. And therefore it's related to this connection. So this specifies a connection. Because even though this is the destination, that's the destination of the first packet, meaning we should allow to that destination and also allow back. So we should allow anything with this source, this destination, and also anything with this source and this destination, because we need to allow both way communications. So this packet, the addresses match what's already in the table. And the state would have said being set up. So the firewall would know if there's a SIN act coming back, let's accept it automatically. Let's not worry about the other rules. So accept this SIN act packet because of the SPI table, not because of the firewall rules. I'll just note that the SPI accept here. And the same concept that the next packet, actually the firewall accept, the SPI table processes at first, source, OK, destination, OK, protocol, TCP. It's related to setting up the connection, so we'll accept this one out as well. And at that point, the state will change from setting up the connection to established. And that's what we'll often see in firewall tables, in SPI tables. That this connection is established as the state of our connection. We've established through the three-way handshake and TCP. It would have went through an initial state of setting up. Now it's in the established state, which means any packet that comes to the firewall, which has these five values will be allowed, automatically allowed. That is IP import as either source or destination. IP import as either destination or source and using TCP. Because we have this entry in the SPI table, we'll automatically accept it. We don't check the firewall rules. So really the SPI table keeps track of the connections that we've allowed and allows any subsequent packet related to that connection. So the HTTP request will be allowed out because of this, the response allowed and the closing of the connection will be allowed because of the SPI table. Once the TCP connection is closed, the state will change to closed. And packets related to those using those same addresses will not be allowed. TCP goes through a connection, a state of opening established and then the applications close the connection. Once it's closed, then you think this entry will be deleted from the table. And any packet using these values will not be automatically allowed. We have to go back to the firewall rules. So that's the concept of stateful packet inspection. We now have two tables, a set of rules in our firewall and we think we create them to allow the initial packet. And then once that initial packet is allowed, the firewall automatically adds entries to the stateful packet inspection table which allows subsequent packets related to that connection. It greatly simplifies the setting up of the firewall. The creation of this SPI table is done by the firewall software. The creation of the rules is done by you. It's done by the administrator. So all you need to do is create this one rule. The firewall software will keep track of the connections for you. Questions on SPI. It's a little bit more complex but it relies on the fact that all internet applications, we can keep track of those connections, the communications using really these five values. The two IP addresses, the two port numbers and the protocol. No other application is going to use those same set of values. So they identify some application communications from a web browser to a web server. If you open your browser or open up another tab and contact the visit the same website, then most likely you'll get a different port number here, 50168. Or if you contact a different web server, then there'll be a different IP address here. Or if you contact the email server on the same computer, there'll be a different port number here. So those five values uniquely identify connections in the internet. Any questions on SPI? Sorry, how many resources are used here? Yeah, because you would use it at a different point. Correct. So the administrator sets up the firewall. In this case, our goal, allow web browsing to computer two. Maybe another rule, allow web browsing to computer three. Allow email to computer four. We'd add our rules. As those rules, as packets go through and accept packets, the firewall automatically adds entries here. So you can imagine with a large firewall with many rules, this and many people connecting, this can be quite large. Because the rule may not be allow computer one. It may be allow all computers internally to access computer two. So star as the IP address here, which mean computer one accesses, an entry will be added. Another computer internally accesses, an entry will be added. So this staple packet inspection table can grow quite rapidly. So that's the limitation. You need enough memory to store all of those values. So to store the addresses and the state. The entries are deleted either when the connection's established or after some timeout. If there are no packets, which are seen by the firewall that match these values after two minutes, delete the entry as an example. So we can clean up this table. Let's have a look at an example. This is an example of a firewall on a computer. We will not go through the format of this. Not in this course. Some of you may see it in the lab. So in our example, I drew the table using some general format, like star meaning any value. But different applications will use different syntax. So when you look at a real firewall, there are different implementations of this concept. Here's one of them. And without looking at all the details, you can notice some things. Think of these as the rules. Some action, except if the protocol is TCP. Some source address, meaning any value in this case. This special case meaning any source. Some destination and some other features like the destination port. So here are some rules, some example rules. Destination port 80 for web serving, 25 for email, 22 for secure shell. So some rules have been added to this firewall table. And this firewall table has been set up to use stateful packet inspection. And the specific way this software did it was using this rule here, saying anything to this network record the established connections, which tells the firewall in another table, record this SPI information. So whenever a packet matches, say, this rule here, destined port 80 to this IP address, then this firewall will add the entry into the SPI table. Let's have a look at the SPI table. It's hard to see because it's quite large, but we'll try. Essentially, the firewall tracks connections. So there's this file connection track. Hard to see, but let's zoom in on one. There are many entries here. Just focus on one line here. This is one connection that's been tracked. There are many. And it's keeping track of TCP. The connection state is established. The source address was this IP. The destination was this IP. The source port was 80. The destination port was 53968. There's other information, but not relevant at this point. So this is the SPI table. It's keeping track of who has recently communicated through the firewall. Any packet that matches these combinations of addresses and port numbers will be automatically allowed through this firewall. It's in the established state. Keeps other statistics of how many time this has been used and something about a time as to when to stop using it. And there are many rules, many entries in this table. So this will be updated over time. In a rather small firewall, there are probably hundreds of entries. So a firewall needs the administrator to create the rules. And then the firewall automatically keeps track of connections. And that's common in most firewalls today. Without it, it would be very hard to set up a useful firewall. Our diagram here, I think, just captures the fact that a stateful packet inspection, we store some extra state information about the connections. We've covered this, that we keep track of the connection state, maybe other things like sequence numbers in the TCP connection. It's very useful for TCP connections, but also used for UDP. It's a bit harder in that case. Packets arriving that belong to an existing connection can be automatically accepted without looking at the firewall rules, what's remaining. So we said that there were four types of firewalls. Packet filtering, we've gone through. Stateful packet inspection just extends upon that. And let's look at two other types, application and circuit level proxies. Just briefly look at these. Our packet filtering firewall, packets pass through it, whether they're accepted or dropped, they just don't go through. In the simplest form, it doesn't worry too much about what the content is. It just looks at the IP and transport layer headers. An application proxy or an application level gateway acts as some form of relay. So this diagram tries to capture it. Here's our internal network on the left, external on the right, so computers over there. The idea is that our application on our internal computer, when it wants to access an external application, say web browser to external web server, it actually contacts and connects to the application proxy, which is really running a web server here or a cut down web server. And that proxy is running both a web server for our internal application to contact and the proxy is also running a simplified browser or web client that then contacts the real server. So the proxy is doing the communications on behalf of the two nodes that are intending to communicate. The packet filtering firewall, even with SPI, doesn't deal with the application and it just has to filter packets based upon the headers. An application proxy actually has to implement part of the application server and client. So if it's a web proxy, it implements a simple or possibly a cut down web server and a web client. Now not a graphical browser, but an application that can send requests. So it is not a browser here, even though we say it's a web client, it's just some piece of software that can send a get request out. So it acts as a go between the client and the source. Now for this to work, the proxy must implement those applications or has to have code for them. So it's usually only for specific applications, say for web browsing. So we have a web application proxy. We cannot have a proxy for all possible applications. There's too much effort to create. And it may restrict some features of those applications. So if it's a proxy for a web browser, to keep the proxy simple, it may not implement all features of a normal web server. But it allows very fine grain control over that application. So what can happen is that I open my browser internally. I try to contact some external website. My request goes to the proxy. The proxy can then look at the request, not just looking at the IP headers and the TCP headers, but looking at the HTTP request, all the fields in the request, what the URL was for the request, and make some decision whether to allow that or not, or even modify the request. So it can look at the application-level information. And if it allows it, then essentially creates a request to the real server on the behalf of the internal client. And the response comes back. So we can do more inspection of the content using a proxy. But there's more overhead of processing. We need some software to do that. And it takes time. Imagine the SIT application proxy, web proxy. Every time a student accesses a website, the request doesn't go direct to that website. The request goes to the proxy, which does some processing on that request, and then goes out. So add some delay to the request, and say a delay to the response. Because the response that comes back is processed by the proxy. Maybe one thing is that the proxy could filter out some content. So not just looking at the headers. Similar is what's called a circuit-level proxy. Same concept. We have this intermediate proxy between internal and external. But it deals at the transport level. So what happens is, say, my web browser creates a TCP connection to the proxy. And the proxy creates a separate TCP connection to the real web server. So similar features to the application-level proxy, but it's doing it at the transport layer as opposed to the application layer. And it can monitor the connections. So again, it's just looking at the transport information and can determine, do you allow a connection to go out or not. Not so common, or we don't see so many, but still used. One way is that internal user's traffic that goes out, which is generally trusted, allow everyone to access out, goes through this proxy. But allowing to come in, which we want to control much more, we may want to inspect the data that comes in, we may use application-level proxy, which may have more overhead, but can provide more security. So in some practical networks, they'll combine them in different directions. So just to understand the idea of a proxy in general, some intermediate device that works or that behaves on behalf or operates on behalf of the two users that want to communicate. Now a proxy, a web proxy implements a web server and a web client and allows us to communicate between internal, external, or other way and communicates on behalf of the intended source and destination, allowing the proxy to do some processing and to check whether the content should be allowed. However, both of these proxy approaches not necessarily transparent to the users. That is, the user's data may be changed by the proxy. I make a request to Facebook, the proxy filters out some of that request. Or the response that comes back, the web page that comes back, the proxy changes it. You may have seen that some ISPs maybe have done that you request a web page. The web page comes back, but they modify the content before it gets to your browser. Maybe they insert an ad in there, an ad for their ISP. So it's not coming from the original web server. It's coming from the proxy. So it's not transparent to the users. Something's changed in the content. To finish, questions? Yes, we said with SPI, the firewall automatically creates this list of connections. So we need memory on the firewall to store this list of connections. Now, imagine a rule again that is not per device but allows all devices in the network contacting out. So there may be many connections, thousands, tens of thousands of connections happening to be stored. Therefore, if the amount of memory allocated for the firewall is small, and we fill up that memory, then subsequent connections will not be allowed out. So if we could, as an attacker, fill up this table, use up all the memory, then any other connections would not be allowed through the firewall, providing some form of denial of service attack. How do you overcome that? Well, make sure you have enough memory for the typical number of connections that you need in the network. Where do we put a firewall? Last two slides, I think. Well, either on the end-user computer or in a network device. End-user computer is not very convenient. So if I put a firewall on all computers inside SIT, it would protect those computers. But I have to, as the administrator of the network, I must set up that firewall, make sure it's installed and up-to-date and configured correctly. So rather than putting firewalls on the end computers, put just one firewall on a device that all of the data goes through for those computers. And that's more practical, so on network devices. Firewalls are located on network devices, devices that connect internal and external networks. We may arrange them in different ways. And these diagrams try to capture some examples. So here's our external network in the top diagram, an internal LAN with all the office computers. But we have maybe some servers, a web server, an email server, a database server, which are supposed to be accessible from people outside. This green box is our firewall. So this red box is a router that connects us to the rest of the world. So traffic comes in to the red one and reaches the firewall. And the firewall should have rules that control who can access our web server, our email server, and our other servers here. Who can access them? So if it's a public web server for SIT, essentially everyone should be able to access the SIT web server, although we may create restrictions and block some people. So the firewall would be configured to allow people to access these publicly accessible servers, but nothing should be able to come into the internal internet, the internal intranet is called here, the internal network. There should be no reason for someone outside to try and contact a web server running on my computer in the office. Because that web server should not be publicly accessible. The organization, if there's any web servers available to the public, put them in this other special area. And this area will call the demilitarized zone, DMZ. It's the zone of the network that we sort of keep separate from the special internal and the external. So the firewall would need to be configured to allow some people to access the servers in this zone. And it can be configured to block all access coming out towards the internet. But of course, allow those inside to access out to the public websites. Another arrangement is to use two firewalls, these two green blocks in the bottom diagram. Similar setup, why use two firewalls? What can we gain there? It can add more security, especially in the case that some attacks take place or there's some misconfiguration. What we can do in this case, we have a physical separation of our network. So this first firewall can be configured that all traffic originating from outside must go into the DMZ. So it redirects everything that comes from outside into here. It will not let it go here because there should be no need for outside traffic, say people on web browsers outside, to access anything internal. Of course, we need to allow some traffic to go out and the responses. So these firewalls would be configured to allow connections to be established from internal out and the responses to come back. If there's a misconfiguration, we essentially have two lines of defense here. Or if something goes wrong on one of them, then we still have a backup protection here. That is, it's very easy to configure this first firewall. Everything that comes in goes into here. And it's very hard to make a mistake with setting up the rules in that case. Whereas this firewall may have hundreds or thousands of rules in there to allow specific applications out or specific computers out and also into this network. So this one can be very complex. Therefore, to avoid security compromises due to errors, make this simplify wall just redirect everything to here. Nothing can come in there. And therefore, even if we make a mistake on this one, still nothing will get in. So it's a way to add this extra line of defense that if something goes wrong, we're still protected in most cases. Whereas in this one, one firewall, if we make a mistake in the configuration, then it may allow traffic into our internal network. If we make a mistake on the configuration in one firewall here, then the second one should block it. Now if we make a mistake on both, we're in trouble. But the idea is that the configuration of the first one is so simple that if you make a mistake, you should get fired. So it's about managing the complexity of setting it up. In theory, you could keep adding firewalls. The more you add, the more protection you have. OK? Yep? Can I add a public picture? Thought I had a picture. Yeah, you could have a second zone if you wanted to say have a honeypot that was separate from here. We mentioned honeypots in the previous intrusion detection topic. We could have a separate zone, maybe. But normally, honeypots need to look like real servers and therefore direct it to the same. Of course, every firewall we add, we need more equipment. We need more setup. And we have more processing overhead of our packets. So there's some performance disadvantage of having multiple firewalls and a cost. But maybe more secure. I think that one's just an extension of the second diagram there. Control traffic in and out of our network, our firewalls, or a computer. But we will focus mainly on organizations for networks. We control based upon the servers, port numbers, which direction the traffic's going in, which users. We can identify users by IP addresses. But there are also other ways to identify users. And the behavior, for example, looking at the content of the data. And we've gone through some detailed examples for packet filtering, where we accept or reject packets based upon the headers of those packets. And we can extend that with stateful packet inspection, which keeps track of pass connections. And we've mentioned briefly that we can have proxies as an even better measure, a level of security by essentially running the application separately, server and client, but more costly. The main thing, setting up firewalls, is hard because it involves a human writing these rules. And if you've got hundreds of rules to write, if you make a mistake, you may allow traffic into the network that should not be. So that's a problem. Managing the complexity is a problem. People can bypass firewalls. So the firewall may allow secure shell. And in one of our later topics, we'll see that we can use this to create what's called a tunnel, that we send our normal traffic via this secure shell connection. So the firewall is set up, say, to allow web browsing and secure shell. It doesn't allow email, for example. Therefore, to bypass this rule that blocks email would be to create a secure shell tunnel through the firewall and send our email via this secure shell connection. There are ways to bypass tunnels, bypass firewalls using tunnels. And other ways is to use other network connections that don't direct the traffic through the firewall. That ends this topic. What's next? Next, we'll move on to aspects of web security.


Hey friends tonight We are hanging out at Disney Springs and we are gonna be checking out all the Christmas festivities They have to offer this year. Jack Lindsay's hangar bar has transformed into the holiday bar And they have a lot of cool holiday themed drinks and food items there and then also the Christmas tree trail is back So we're gonna drink some drinks eat some food and have a joyful Disney Springs kind of night Anyhoo, let's go do this. I Have to say it is the perfect day to be checking out holiday offerings at Disney Springs The temperatures in the 50s and they say that it might actually drop to the 40s tonight So 40 degree weather in Orlando, and it's only November. I Always come out to Disney Springs every single month to show you guys all the new offerings And I already did the month of November about two weeks ago But since then they added all of the amazing Christmas like festivities So I wanted to come out and show you but we will come back in December And we'll try the Gideon's cookie of the month and all the things we normally do today. It's all about the holidays Two of my absolute favorite things to do at Disney Springs during the holidays are back this year Like I mentioned the Christmas tree straw and then the Jack Lindsay's holiday bar and I'm so excited I seen some of the menu items and they are so incredible looking I can't wait to try them and then also a lot of other things all around the springs that we're gonna explore as well The Christmas tree stroll is free and you can pick up the maps for it at different locations all around Disney Springs And it's so cool because you go around and you try to find these themed Christmas trees And they added a lot of new ones this year and I'm excited I'm gonna show you a couple of them But a couple I'm gonna leave out because it's kind of like a scavenger hunt So I don't want to ruin it for you and then we're gonna eat some food To give you a brief summary You go around Disney Springs and you try to find the theme tree and when you do you put the sticker on it So they have like a black panther one They have a guardians of a galaxy one a Disney wish one and then you put the sticker on up when you find it And if you find them all at the end you get a special little holiday surprise I was walking through the springs and I came across this tree And I couldn't figure it out right away what it was Because it kind of looks like a little like cat tree and then a bunch of regular ornaments But then I noticed the sheriff badge, but really what gave it away was the big one Look at this. I love that. It's a toy story tree And I love that it's got to be one of my favorite ornaments the big one If you guys remember the movie that is so awesome. What a cool ornament You don't need a reservation for jock lindsay's holiday bar. In fact, they don't even have reservations It's all just walk up and right now they're a little bit full So we're going to come back and now we're going to go around look at some of the christmas trees And then also head over the dock side because I think they have a candy cane margarita And that just sounds like so interesting a candy cane margarita And here is the candy cane margarita. Look at it. It actually looks really really good It comes with a peppermint syrup, lime juice, silver patron, and then a splash of grenadine on the top there And then it's got like the candy cane rim there and I'm excited We're going to dive on in and I like how they give you like a little candy cane like candy But I would have thought they would add like an actual candy cane But it's like a candy candy cane a candy candy cane All right, here we go. Let's give it a go Oh, that's got a strange taste at first Kind of kind of tastes like a mojito and then you get the tequila. It's really strange Not gonna say I don't like it because I think I do You can definitely taste that peppermint simple syrup there Maybe if you mix it around a little bit, I mean it actually is like a really really good margarita Now it is $16.50 though, so I gotta throw that out there. $16.50 margarita. It's more expensive than Mexico Maybe I need to get a little bit of the candy cane salted rim there That makes a wow that makes it really really delicious I'm not the biggest fan of margaritas, but I feel like it can definitely appeal to a margarita fan Now what I am a fan of is old-fashioned and at the boathouse They have a Christmas old-fashioned, which is my all-time favorite They used to have it on the menu year-round and now they brought it back So hopefully I'll be able to get back out here and try that I mean not today because we're going to go to the holiday bar and they have good drinks too But for the margarita, I think I might pass Right next to dockside margaritas They also have a nice little like waffle stand where you can get a santa mickey cookies and cream waffle sundae And it's the bubble waffles and this is actually really cool looking I mean if we weren't going over to the holiday bar where we're going to try a lot of other You know desserts and food items. I think I might get this, but it does look fun. Look at that Something else you could do with disney springs that doesn't cost anything is go meet santa claus There's an actual santa claus photo opportunity here and it's all done through the virtual queue and it's free It's like absolutely free. So i'm gonna show you where it's at and maybe we'll get a chance to see the big jolly man himself Right here at once upon a toy is where santa is actually meeting a greeting guest Oh, I actually heard him just say ho ho ho. I wonder if we can get a peek-see from them in the inside there The store is open, but I think you have to wait for the virtual queue There he is look at that Oh, ho ho ho. I heard that ho ho ho from out there. I got excited Yeah, I hope you have a great christmas See you soon That was really cool santa said hi to me I did get a virtual queue, but it's like two hours from now So i'm not too sure if we're gonna go back for it But I was able to at least say hi to him real quick I heard his ho ho ho literally standing outside the building and I thought that was funny A couple of other trees I wanted to show you and these are some of my personal favorites And we have the nightmare before christmas tree right here. Look at this This one is really cool I mean because I like a nightmare before christmas and then right next to it over there They have the hanat mansion one which I think is usually everyone's favorite. I feel like it's a big crowd pleaser, you know It's funny because the hanat mansion tree that was here last year It looks like the same But it is a different tree because I had the opportunity to actually buy the exact one that was here last year But they did take all the hanat mansion stuff out of it and uh this year I feel like they made the trees a little bit bigger Look at that. Isn't it so cool? I don't know. I can't see the bride's heart though Usually she has like a little red heart there, but look at these santa books Look at this. I don't hanat mansion tree That is so cool looking. I like this a lot And enough of the tree business. Let's make our way back on over to the holiday bar I'm sure it's probably a less busy at this point. I mean never know the holiday bar is pretty poppin Especially during the season I also want to point out. I love all of the christmas decorations. They have at disney springs Look at these little snowmen made of bobs. They're snow bobs I like it. It's really fancy. It's right outside the boathouse. So it kind of fits. The theming is uh impeccable All right, here we go. It's time to head on in the holiday bar and look how festive it is in here Merry christmas I love it. You can see the lighting already The music It's seriously a good time Look at all these decorations and the presents up there. Oh, wow. That's a little creepy You see the ventriloquist the ventriloquist uh santa claus there That is funny Very nice snowman up there Here is a look at the hanger happy holidays menu from jock and reggie You guys know who reggie is. Let me know in the comments. I always love asking people Actually, if anybody knows what jock lindsay's actually is like where it came from it's always a fun little trivia question But uh, the holiday food actually looks really cool a lot of the stuff they had last year But they did add a couple of new things and here we come a croquette is one of the things I'm excited for I was never much of a singer But who doesn't love a good carol turkey croquettes with sweet potato puree Bacon cranberry jam turkey gravy and sugared rosemary sprig. Doesn't that sound amazing? And then they've got grandma's revenge venison sliders a naughty or nice deviled eggs And everything's like 15 12 dollars. Not too bad. And then down here they have the drinks They have a hot cocoa grail flight. They've got the uh, milk and cookies were cook, uh, coquito And also a closmo.  I like all the sayings on it too. It's very cool I'm not too sure if I'm pronouncing croquettes, right or if I'm calling it the like the game that you play in the yard But on top of those I got the hot cocoa flight, which honestly looks really cool And it's different than like the hot cocoa float flight that you would get at hollywood studios So I'm excited to try both of them I love just sitting in here listening to the music and looking at all the decorations. You got frosty. Oh, yeah, a little snap You got the defender motor oil can up there. It's just so pretty in here I like it a lot. Do you know that ice machine over there actually makes ice christin? That's the inside of an ice machine if you ever wonder what it was That's an ice machine and it actually makes ice every once in a while. I'll go off I'll show you guys a look inside there Yes, it shows you how ice is made You have chosen wisely. Wow, which one is which holy moly Do you get to keep this? I wish right? All right, here is the hot cocoa flight and this looks amazing I love the presentation. You have chosen wisely. I feel like I did It says jock lindsey's hanger bar back there and it just looks so cool This might be the best hot chocolate flight. I think I've ever seen this one right here Is the spiced caramel with captain morgan in it And then this one is the cookies and cream with white chocolate and vanilla stolli And then this one has to be the peppermint with barely's irish cream and creme de ment And this just looks amazing. Like I'm I'm so excited to dive in If they sold this as something you could buy I'm pretty sure I would buy it like the the board and the cups all together It cost $22 on its own, but if they sold it for like 50 bucks, I think I would do it I think I would definitely get it and we're gonna dive in so I'm gonna start off with The salted caramel captain morgan one. Look at this Oh wow That is good. Holy moly. Oh boy. Oh now I can't wait to try the white chocolate one. Look at that This looks so good The white chocolate one all the way for me that white chocolate one's gonna be hard to beat but a little peppermint Much too good Honestly, it's hard to rank these because I Sincerely love them all I really really do But I think I'm gonna have to go with the white chocolate one the cookies and cream It's just so good cookies and cream and then the peppermint and then the captain morgan But this is honestly one of the best things I think I've ever purchased. I love it so much Enough for the hot cocoa business. Here are the turkey croquettes croquettes I don't know which way I'm saying it if I'm saying it right Maybe I am saying it right and just kind of think of leftover Thanksgiving because it has stuffing turkey sweet potato puree A little bit of everything in there and I'm so excited last year They had a sweet potato empanada here and it was so amazing misty Who is the chef here never fails to just Astonish me with the dishes and I come every single time.  Look at that. It's gonna be so good one meatball All right, here we go I Am gonna have to say Everything that I've had here so far is probably some of the best food offerings or the holidays that I've had so far And uh misty you just did a great job. I know you watch the video So I want to say I absolutely love it and also Uh, Kristen got the brie flatbread. Look at that flatbread with pomegranate seeds, which I think is Ah chef's kiss. Ah And uh, yeah the hot cocoa flight. What about you shan, what'd you get? I um He just got here It's freezing today in central florida isn't it chili's 65 degrees of nature in shorts and short sleeves I don't even own pants his name was through new york city. We're just shorts I'm just gonna keep on uh drinking my uh Cookies and cream because it is so good Also, I didn't realize but I missed the gravy so I'm coming back. I'm coming back for you, baby Now we got a little bit of everything in one bite Cheers everyone everyone looks all cozy and festive look at this We got a christmas gear on. Yep sipping some hot cocoa This is nice jingle bells is playing right now. This is minty. Yep.  It's the right time to rock the night away Jingle bell time. It's a swell time to go riding in a one-horse sleigh Hey It is really gonna be hard to top Uh, jockelynsie's holiday bar because that was just such an awesome experience You guys definitely have to check it out and also they had doubled eggs in there that look so festive They're like naughty or nice. You have to choose which ones you want and I would have gotten them But the cookies were just so good Now we've made our way over to the boat house because I had to come get the christmas old fashion This is my all-time favorite drink and we're going out to the dock sidebar. Look how beautiful it is out right now Look at this and then look at that right there What a shot, right? We're getting a christmas old fashion, but it doesn't seem like it It is just so absolutely beautiful out right now. I love it The sunset is just looking immaculate. You can see the ducks in the water the ampere cars and the balloon And uh, we're gonna drink a little old fashion. This is so beautiful. Oh the headlights are on too And here it is the christmas old fashion looks like we got a mistletoe in a glass This is so good though and look at enjoying it with a nice little view Got the ampere car out there. This is such a beautiful. This is a beautiful time Definitely if you are an old fashion fan, you're gonna want to get this one. It is so good With the rosemary in there all Much too good And look at this here comes the ampere car All right, I feel like I have been influenced because that sunset is just so remarkable I don't think sitting on the dock is going to do with justice So I think we're gonna hop in one of the ampere cars and go out and get up close look There she is we're taking the red one, huh?  Oh like michael scott. We're gonna drive the gps Thank you captain jim does anybody know where the clutch is where the clutch is Are we ready we're ready It's happening We're dropping straight down guys Anybody want to change their mind? Nope, I'm ready to go Look at us holiday festive Look at this we're awesome. Awesome. It's amazing The sunset is remarkable How you doing Look at as we hit the water now every single uh ampere car comes with uh Like jacket and umbrellas. How many ampere cars are in the world? About 400 of them That's so awesome gotta say hi to everyone Oh Look at paddle fish And it was actually a shopping district too, isn't that cool before it was a restaurant It was like a bunch of different shops. Look at that. Isn't she a buttoe? Merry christmas Look at this This is the best isn't it Look at this. We're gonna we're coming back to this sunset now Look at that view right there That is amazing. Look at that Happy holiday happy holiday a single christmas song a little bit Look at this view right here Look at that What the view here? It's amazing. Oh awesome. It's amazing. Look at this I think we're heading in now are we? Oh boy We're heading in we're gonna drive right up on this ramp We're ready Some was bad I haven't done that in forever the last time I did it. I actually did it with my mom I I think I've only done it maybe two or three times I've done it with adam adam the woo and my mom and my sister and it was great to actually do it again And fun fact if you guys get your little christmas tree stroll There is a coupon on in here that'll save you 25 dollars So you save 25 dollars on the actual amputee car experience And I think it's about 125 dollars per 20 minutes So you're saving a very good chunk there and it fits up to three people Well, you could do four people if it's a young child like three in the back seat But it's a lot of fun the views are amazing try to catch the sunset because as you've seen it was just It's kind of breathtaking actually it was surreal being out there It's going to be hard to top the amputee car, but look at this. It's got a little live entertainment happening Yeah, we could use these guys in the boat How the festive live entertainment is kind of taking over the spring And now we're going to keep moving along keep our eye out for some more trees And hopefully maybe a little snow Even though there's lots of little christmas trees all around disney springs They do have a main christmas tree and that's it right here. That's the one Isn't she a beaut clark and this is where it normally snopes too I don't know if they're doing it tonight, but usually they have snow and it's so pretty over here. Look at this I don't think this is a part of the christmas tree trail though. I think this is just its own thing I'm its own thing david s pumpkins Look at that. Isn't she a beaut clark? I already said that Yeah, isn't she a beaut clark It is very nice though I feel like they definitely added a lot more lights to the springs like every single palm tree is covered And i'm here for it Look at how pretty this is Look at all the palm trees all lit up with care and they're sparkling and shining This is nice. Oh and also I think we're gonna see a couple of more trees As we start to make our way out here because uh, they're a little bit more lit up now Oh, yeah, some of them look very beautiful from here This tree right here is the disney plus tree. It's all lit up with the blue and then I believe this one I'm not too sure what this one is. You don't know this one. What is that one? Oh, it's frozen It's frozen. I see it now Look at that. I think they need glasses. What's the qr codes for? Well, that's an olaf tree. I don't know what the qr codes are for But let it go would you And with that, I think we are done here today. It was a fun festive day I wish we could have went back and met fana claus We already missed our return time, but I don't know. I'm pretty sure you have all the time Maybe an hour after your return time is called But we still got a lot accomplished and jock lindsay's was fantastic going in the ampute car was so much fun I really enjoyed my time here and we'll be back for gideons when they do Release the new december cookie, which I hear that you're doing it actually on november 25th So that's going to be an added benefit and I feel like all of walt Disney world is going to be 100 for christmas on november 25th Because that's also when uh epcot starts all of its festivities. So it's going to be interesting But I had a lot of fun today.  I forgot to get the pup cakes. I forgot to get the pup cups I'm so sorry. I do Have a cookie to offer you if you don't mind. I'll trade you a cookie for some love Look at how she likes to sit underneath this. This is a polynesian desk actually from the polynesian resort And she likes to sit under here. I got like a little living room set up for But do you want the cookie? Is the cookie not good enough for you? There you go. Where are you taking this? Where you going?  I add gracey at the end.  So I figured maybe She'll brighten up your day too Listen to that. She loves it She also loves Chewbacca and santi claws Oh, she has one. Oh my god. Give me this one There Oh, okay I love you


I don't think that was bad, but I probably wouldn't eat a bunch of them. It was just the fact that I'm biting it like this. I just ate it. Train is a really, really popular way to travel. Even, oftentimes, more than a plane for a couple of reasons. One, because it's cheaper. Two, you don't have to deal with going all the way out to a far-off airport. The times are guaranteed. It's fast. It goes like 340 or 345 miles per hour, or kilometers per hour, so... And not only that, I actually think, Andrew, this is the best way to connect with more of, like, an average person. On the train ride, we are going to be ordering everything we possibly can. Everything off the menu. I don't care what it is. And we're going to rank it. And we are in the economy class, so, by the way, this is not maybe even the top-level food that they have on the train. This will be the regular food. In Chinese, a train is 火车. Yo, man, this kid is so curious. He's all up in that. He says, Hey, mom, mom, mom, let me try to help. Now, I know we just boarded the train, but the most important question right now is, how is the food? So, we're about to do a Feng Rose Food Train in Shanghai to Beijing episode right here. All right, guys, we are about to start on our train food extravaganza. All right, we wanted to start off with the fruit, because, you know, fruit oftentimes is the appetizer or the dessert, but, you know, in this case... This is the fruit. And we wanted to get fruits that you could not find in America very easily. So, we found the mini bananas. We found the peeled jackfruit from Thailand. In Chinese, it kind of smells like a surprise they had in the train. Yeah, jackfruit. Between the train and the platform, what do you get off? Mmm, I'll watch the seed. Always a big fan of jackfruit. Tastes very Asian. Meaty fruit with just the right amount of funk.  Pretty dry. Pretty good though. Tastes different. Justin, you are actually dressed just like the fruit. You're dressed exactly the same color as the fruit that we're eating, bro. These are dry flavored tofu. It's pretty cheap for the pack. It was about $3 each. This one's spicy. This one's a little bit spicy. So, I'm going to start with a little bit spicy one. It just has different colors. It's probably all the same flavor.  Just the fact that I'm biting it like this. I just ate it. Trying to ball off flavor. Covered in red oil. Compressed gluten. Mmm, this one's definitely gluten-proof. If you guys have ever had the fried gluten, like sometimes you eat it with your kanji and stuff like that, that's not too hot, but it's definitely got a kick. That was good.  Mala gluten, good to go. Give it a four out of five. What do you give the first one, the tofu? I bet a two. I knew you were going to say two. I knew it. I knew you was going to say two. Felt like a two. Do you need to add some meat to the cold tofu? It's cold. Heat it up. Heat it up a little bit. Heat it up a little bit. Okay. Be careful. Thank you. I'll send this to you later, okay? It's going to secure the bag. We secure the fine. Beef mushroom stew. The mushroom was actually really good. That beef is super tender. Look at this. So far this tastes like pretty above-average Chinese airline food. Look at these shrimps. Look how beautiful those are. Normally, you wouldn't want to eat shrimp on a train. Beef? Actually, the beef, I got to give it a four out of five and the shrimp, I actually give it a 3.5 out of five, too. Beef stew, four out of five. Here's the shrimp, I give it a 2.5 out of five. Here's what happened with the chicken. So she gave us gloves to eat the chicken with because the chicken is piping hot right now. All right, this is so weird. That was so tender. Braised chicken on a train. Very tender, juicy. A little bit smoky. Look at that. Oh my goodness. I give this a solid three and a half out of five. Huge points for just serving it. There's nothing really bad about it, but it's not amazing. Right. This right here, we got chicken wings right there. So is this eggplant? It's gotta be.  Let me try it. It's eggplant. Hell yeah. Stewed chicken. Little fishy.  After having that beef and that chicken, I got to give this like a two and a half. Yo, I have secured the bag. David, it was a journey man, I'm telling you. So I asked the lady if I could buy something and she said, no, you got to go back there and there's this whole little shop. I got this feynial, feynial font. This is like fatty beef. Oh my gosh, David. This might be the Zion. Who you? Bro. Enokis are. This is not your average trained food. Why is that as a point? So the word ma la is actually two types of spice. This is where you get the ma from. This is the peppercorn. This is the regular spice, you know, the chili pepper that everybody knows. So together, these create ma la. Here's what I would say. Keeps it from being a restaurant level thing. I think it's a little too oily. Beef quality is strizzy. I give this a 3.5 out of five. Give it a four out of five. I think Justin would like it and I actually really think Moreton over there would like it. Try this chicken mushroom soup. So what I had to do, David, was it all came dry, right? And I had to empty it and go pack and then I had to go to the hot water dispenser. I would say that this is actually pretty solid. I'm really enjoying this flavor because I do think there's a chicken essence in there as long as the mushrooms. Chicken and mushroom, great combination, creates a lot of umami. I give that a four out of five. Here we have, correct me if I'm wrong, David, because there is a picture of a sweet potato. I'm assuming this is a chocolate-covered sweet potato pastry puff. Chocolate. Tastes pretty European. Mm. 3.5 out of five. 3 out of five.  I actually really wish there was just a cup of noodles. I thought there could have been higher-quality lower-end foods, but what we ended up getting were actually some fancy foods that I thought were executed just okay. People must prefer worse versions of fancier food as opposed to elevated versions of simple food like an instant ramen. The trained food impressed me. It's higher quality than I thought. It's overall better than I thought. And they're trying to do fancier dishes. Yo, I was impressed, man. Chinese trains are coming up. You used to be able to see the train tracks from where you were taking a dump back in the day. I'm glad they updated since 12 years ago, man. All right, everybody, that is it for the Chinese train portion of this video. The next thing that we're gonna be eating is the food off of a plane. They did serve definitely some dishes I didn't expect, so shout-out to the train. It's getting better, but on to the plane. All right, so we had just ate train food. Now it's time to try the plane food. So we are on the plane. We are headed back to see if I can try the food here. They have three options. Herb chicken, penne pasta, stir-fried beef, created by award-winning chef. Let's go see how this food compares to the food that we had on the train. Going from Shanghai to Beijing. It's really hot, so I like to put the butter. Herb roasted chicken, tomato risotto. You gotta compare this to the chicken that we had on the train. It's real quick. It does look solid. I like the little grill mark. Okay, it's moist, it's soft. Herb roasted chicken, you need to go. Funny enough, it kind of tastes like the Chinese chicken, Alfredo sauce. Oh, there's Alfredo sauce. I was looking for it. Pasta, slightly soggy. Flavor's not bad. It's a little bit hot. This one's a little heavier than the rest of them. So I would compare this to the beef stew dish that we had on the train. Actually, it's not gonna lie. It actually looks like the other airline. This would probably be a little bit different with bell peppers, broccoli, and mushrooms. All right, that pretty much wraps up our Shanghai Beijing trip. Thank you so much for watching. Make sure you click subscribe, turn on your notifications, and take out us the turkey and cheese croissant.


What's up guys? It's Eric here. In this podcast James and I share some stories talk about the overall market and give some tips on the current small cap market So stick around listen up because you're not gonna want to miss this one What's going on guys? We're back in another episode after this podcast Today's just Harry and I we're gonna be kind of talking a little bit about the large cap market overall How markets and economy are moving and then we'll kind of touch on small caps and in kind of what we're doing there And how the how things are shifting in that area So I mean, I guess we can start off kind of talk about the overall markets and economy. So right now as of like last week You know the Fed raised another three-quarters of a point We got news yesterday that meta is gonna be laying off thousands of employees We don't really know the extent of how many employees but definitely it said upwards of over a thousand and Apple had kind of come out and said that the production in China was gonna be really slow They're saying that it's because of China's zero covid policy, which I don't know if that's accurate It could just be because of the economy in the actual like Market in China's pretty China's pretty fucked right now Pretty crazy right now just but there I mean they there was a lot of rumors that the zero covid policy was gonna come to an end And I think it kind of shocked people That they announced that it wasn't And I think I think right now like the overall stock market. We've just been bouncing around and I think I almost I've changed my my stance a lot on things recently where I think I think that potentially over the next couple months to years We just might be a stock market that kind of bounces around It's almost like every day you wake up right and then bulls are like up the bull market starting again and bears are like No, this is just a this is just a it's a bear It's a rally in a bear market and you know, it's gonna go down and I almost feel like Realistically there's nothing coming down the pipeline that's gonna change one way or another like I think people Are slowly starting to recognize like we are in a recession I think that layoffs and stuff and slowing up production and pausing of hiring Yeah, is is really starting to wake people up to the fact that we are in a recession But you know, that doesn't mean that the market's gonna continue down either It doesn't mean just cuz we're in a recession or even potentially depression at the time That the market's gonna continue to slide it could just mean that we're gonna bounce around for a long time I mean if you look at the past Like stock market history like, you know, a lot of times, you know markets bottom During a recession and then just kind of our stagnant, you know I mean, we could be in this period of like 1970s where the market really was just not returning much Yeah, but it wasn't crashing every day either. It just we you know, we might just be there So, you know, I don't know. What do you think about that? But I Completely agree with that to be honest. I just think there's so much Uncertainty around just literally everything, you know, um, yeah Like for instance just last week you had you had Canada going out and only raising the interest rate by point five Yeah, and so everyone thought oh the United States is gonna only raised by point five to they must be in it together. They must be You know the the United States and Canada must be kind of like teaming up. They're gonna only raise by point five It's gonna be good. So the market rallied on that and I think a lot of people were caught off guard by Just the Fed was like no point seven five That's what we're raising to and we've traded a lot lower since that FOMC meeting. So, yeah I think that's also something to kind of look at is that, you know, everyone is betting that They're going to save the market Everyone is betting that they're not going to be as aggressive Everyone's betting and you know, even when you it's an interesting environment right now because when you talk to people I feel like there yes, there are a lot of people who are worried, but you know, when you talk to my neighbor like Well, I guess like my old neighbor when I used to live in my parents house, you know She texted me the other night and she was like, hey, what do you think about the market? I'm gonna retire soon and I was like, yeah, yeah, okay, okay And she's like, well, I'm just gonna retire anyway because the market will go up again You know, there's a lot of people making a lot of investment decisions right now Based on the fact that all the market will go up again. All the market will go up again So that kind of tells me that maybe we have a little bit lower to go Just because of the fact that so many people just are on face by this like yeah When you talk to working people who are out there, you know, not that we're not working people, but you know, like Yeah, working class people, you know, um a lot of them just have kept their head down and Are like now like the market will go up again. It's fine. Don't worry about it You know, so that kind of tells me that maybe the opposite will happen, you know I think so too. I think we've been conditioned dude I think we're conditioned to think like since 2009 like right after the financial crisis that I think that we're just conditioned to think that the market's always going to get saved I think that we always think the fed's going to step in and save Save the world from ending kind of thing in terms of the economy But but this time I feel like Jerome Powell does not want to go down in history as the only guy that lost to inflation I don't think he wants to go down in history as a guy that could not fix the economy and fix the market So I think he's going to crush everybody because he has to I think he unfortunately has to basically wipe out a lot of wealth That was built over the last 15 years I mean, I'm pretty sure and don't don't quote me on this but I'm pretty sure the stock market in the last You know 12 13 years since the crisis has averaged like an average of like 15% returns or something ridiculous like that And it's like you think about that in terms of overall wealth and compounding. It's huge So I think that he realizes that that we just got way too out of control with spending We got way too out of control with money printing and everything and and he's going to do it You know, so anyone who's not close to retirement stuff like of course, I'd be a little anxious I talked to a lot of older folk who are like At that point we're in the next five to ten years They were looking to either stop working or even stop working sooner and now they're like wait a second You know, we're so used to making this much money every year because the market's been so hot We've been in the longest like secular bull run for the free So as long as we've we've been alive at least and you know now these people are going to enter a phase Where maybe it's protection time, but when you're close to retirement and you want to live off your investments That's when it gets hard, you know, and I think people are soon going to realize that I think I think a lot of people who are relying on their real estate as retirement Are going to come into a hard point You know my girlfriend and I actually this weekend in the last couple weeks We're looking at condos and houses in the area and You know, it just doing the simple math of it like there was a really nice condo we found and you know With the price of it even putting down 20 percent our mortgage would still be really big just be Considering the interest now I'm not complaining because I did have plenty of time to lock in a low interest rate if I wanted Just kind of at the point where we're looking now and it's it's crazy So like, you know, if those people like my parents, for example If they were relying on not saying they are but if they were relying on their house sale for their retirement Because the market is slow, let's say, you know now trying to sell a very expensive home to new buyers Who are getting locked in at seven over seven interest rates and you're you know I think the math of it is like if you buy a seven hundred thousand dollar home, you put down 20 percent Your mortgage is still going to be like five grand or something like that Which like to an average person is pretty like pretty ridiculous. Yeah So I think we're just like I said, I think we're we're going to enter this period of just like a lot of uncertainty A lot of slowness, you know and just anxiety in people and as the economy Gets worse and as people realize it. I mean, I notice it every day I think all-time frustrations are at an all-time high with people Stress is at an all-time high with people lack of savings is at an all-time low credit card debt is high Midterms are coming up where I think that we're going to run into a lot of political issues With either side accepting The outcome I think in general that's going to affect the economy in fact the market You know, like I said, I don't know if that means the stock market will go down Because I don't think the stock market is necessarily a hundred percent reflection of the economy But I do think we're just going to be bouncing around for a while. Yeah, I think so too And maybe we're going to look back on this podcast and be like wow, you guys are completely wrong It went way lower. It went way higher or whatever. I don't really see a cost for going higher though I I think I think we're pretty optimistic saying that we see a sideways chop You know, I think that that's the more optimistic stance right now Rather than people saying oh, it's going to go lower.    It wasn't yeah for me.   I saw sales booming for all those major companies I saw people spending a lot of money. I saw, you know, people were at home. They were online shopping. They were doing this They were doing that people were drinking partying having a fun time and they were still working and still getting paid and so It was really hard for me to understand like Like is that what a pandemic is going to be?  Everyone's like all deer in the headlights.  It's here and people are still in denial so we probably have a little bit lower to go and I think they're just going to keep getting aggressive and aggressive and aggressive and aggressive and they're just going to try and wipe everything out Like you said Yeah To me and this is to me. This is a fact. I don't I don't I know people who will probably disagree But I think the economy will be impacted negatively way more Not the stock market. The economy will be impacted way worse With the looming recession, if not the pressure then it was during covid now people initially will say how can that be possible? We were closed the reality was spending was out a crazy all-time high during the pandemic I spent money like crazy actually during that time the you know, I was I was always drinking fine like nice bottles I was I bought cars like I mean I was spending because I was also bored like yeah restaurants and bars were slower Some of them are closed, but that doesn't mean spending stopped Um, you know, we were all partying more if you look at like like we what we we said like the stripper index, right?  I mean, I know people who had no business getting stimulus checks getting stimulus checks Um, you know, and when I remember we talked about some previous podcasts when stimulus checks went out You know, if you went to the mall you'd see lines out the door At louis Vuitton of people who and not trying to judge people by like what they look like or anything But like you could just tell these people probably had no business spending thousands of dollars at louis Vuitton Um, you know, and it was it was just uh, we got to a period of time and I think in our country where Uh, like godliness and you know, just overall just over spending got crazy I see more teslas on the road than I ever have and that's I have a tesla It's an expensive car to have and pay for it monthly and I know people who have them that should not have them And I think we just got ahead of ourselves as a country. So I think By powell kind of getting aggressive and like kind of crushing the market in the economy It's gonna have to happen because if he pivots too soon and if he gets if he takes his foot off the gas We're probably gonna have the same issues in two to three years.  That's just how it is It's unfortunate other countries have to deal with how we Expend in what we do and our dollar affects them, but that's the reality So if you long term want success in your country and in ours We need to fix the economy here We need to fix the market and and get people back on track to realism You know free money doesn't exist countries have negative interest rates at point that doesn't exist It's not real, you know 10 mortgages as crappy as it sounds You know, maybe that has to happen So house prices come down so that average people can afford it and maybe they're tight for a little while But maybe people will start stop spending outside of their means and stop spending with arrogance because That's what that's what's kind of needed right now.  I think for the lower class Oh, I want to be a part of that. I want to be a part of that And so you kind of have this battle of rich versus poor trying to kind of compete against each other You know the rich people who are buying the nice bags the poor people who are trying to keep up And it kind of created that toxic mess during covid where you saw a lot of people who didn't really have the money Go out and spend it on all that designer shit, you know like even now still I mean and rolex like the prices are Uh, starting to come down right now But do you remember at the height like how hard it was to get a wash or how hard it was to get anything You know, richard melz were going 200k over asking price. You had rolex's going, you know 50 percent over asking price in some things. I remember alex went on a trip I forget where he was.  So what does that tell you? Like the one percent is the one percent for a reason.   We're gonna hike.  Yeah, you look at the small cap market right now There's not as many people trading, you know, if we had two million people trading before we only have 50k now So it's like, you know, they they have successfully I think crushed a lot of those Stimulus whatever people but I don't think we're there yet, you know Yeah, I think um I think the reality is like America as a country is built off of a lot of principle of like you come here You work really hard and you get to live the american dream Which means, you know, you get to have a house you get to have a car and be with your family and all that And I think we just unfortunately got too far from it and we let politics kind of put a wedge in between What's right and what's wrong and how we live our lives and people got way too crazy people got way too overextended, you know The stock market Like we said over the last 12 13 years returned an unreal amount of money Which is a lot of fake money on I would say on paper and a lot of people, you know Like as long as you're in the casino kind of thing, you know, the money's the money's real But you know the second that things kind of come down the money starts to go away and you're like wait a second like I I've been spending like I I have all this extra money and and now that the market's getting hobbled and I really would have been greedy It's going to affect people So I always think the best thing and I always talk to my friends about this But the best thing you can do is just like, you know You know, it's I think a really a better flex than having a Rolex and stuff because like there was a period during the pandemic Where I have a friend who works works for Rolex and He's still a distributor and I asked him as like could you get me something and he was like no He's like I have a list of 50 people that want a watch and most of them shouldn't be able to afford it But I think they're they they're just bending over to get it because flex culture became huge and and I think the Really a sexier flex and the cooler thing is having stability and security in your life Having a life that you can afford and not being stressed all the time You know, if you make a hundred thousand dollars a year, but you have $300,000 worth of lifestyle that doesn't make sense in long term. You're going to be stressed You're going to be unhappy and things are going to affect you more You know, I've I've tried to build a life for myself where politics don't affect it as much Um, you know, whoever's in an office. Yeah, it's some years tax are higher some years tax are lower But they always get you one way or the other, right? So it's just comes down to being secure and not stressing so hard about that stuff And I think just everyone got too far, you know The only reason you're really stressed right now But the market and the economy is probably because a lot of people will overextended. They've spent too much money Um, you know, whereas reality we're at position as younger investors, I guess to to really build wealth long term, right?   Um, and uh The only trip I really did go on which I should be traveling a little bit more Um, that's my own fault. But just because my girlfriend's in her master's like we haven't really been able to yet Um, but you know, I went out to utah.  I do feel bad for some of the people who Um, like aren't really receiving the wake-up call yet Like I feel like the fed is sounding the alarm and like we're still like a little bit early And once this kind of catches up over a couple quarters, you know, I'm really interested to have to see how this kind of plays out You know, dude, what's that saying? I think it's Warren Buffett. He says like when times of economic hardship come We find out who is like swimming with their pants down or something like that Yeah, I forget that quote, but it's like it's true And I think the two people that are gonna be revealed here and this coming like next years or so are gonna be people who overspend People who are way over leveraged and have uh lived outside of their means and then on the flip side It's gonna be unfortunately people who are not of economic means and aren't doing as well financially because the reality is like during The gas is going to go up after the midterms that I'm almost I'm 100 positive of that Um, and when gas goes up, you know what rich people are going to complain about it They're going to say oh, it's costing me more money to fill my Mercedes AMG, you know G-wagon or whatever, but there's not it's not going to stop them from driving anywhere Nothing's going to stop them from taking their vacations going away during the summer and all that stuff and extra $200 a week is not going to change their lives But the people it will affect are the people who are way overspending and the people who don't have the money So we'll see I mean again, we can we can kind of banter about this all day But you know it's going to it's going to be telling and I don't think anything changes until we receive major news You know and I still think this is just going to be a multi-year thing and you know as far as small caps go right now It's like I think there I think opportunities are there. I actually I actually in my opinion find um on the short side I need a few more weeks to really like confirm this in myself but I think the opportunities might be better because I feel like after ilag and after um HUD I the other day like I just think a lot of short sellers are are almost scared Um, and I think it wiped out a lot of them and I think that a lot of moves are actually pretty clean right now Um, we we still lack a little bit of range and I I do hope like we do start to get some range Um, like I don't I'm not going to short things that are up 20 percent It's just to me. It's not worth the mental capital, but I'm gonna you know, I do hope that we get some more and I think opportunities are maybe around the corner. I do think for you and for longs It's it's just tough right now because there's just no confidence on the confidence on the long side I mean, I I did I've you know, I've been starting to pick it up a little bit. Yeah, you find it Yeah, it's been getting better for me. Definitely last week. I saw you know, we're starting to change in the right direction I think um, but but you take those opportunities Like you take those opportunities and then like, you know what if you go through a slow week Then it's like all right, whatever. I hit a I hit a banger, you know, you're not going to press You're not going to come into the market today after hitting a $3 share home run on friday and be like I need to make two dollars a share today three dollars a share today.  You know, maybe I hope the kind of uh Uh, you know stuff can kind of set up for me, but you know, we'll see it And also I just want to say one more thing about the large cap market Just as we're kind of transitioning in small caps is that also I read something the other day Like what happens if the company has cut all the dividends, right? They're like, hey economic hardship is That that's coming and I'll it'll be interested to see how people react from that Because there are a lot of older people that are living off those dividends who have money Who are down on the air that are like, well, at least I have the dividends When they got that it's like, oh fuck You have you have dividends and you have corporate profits in excess, right? That's what that's what leads to companies being able to give dividends raise dividends In the reality is when you start to see I I think in my opinion the last domino that is holding strong is apple If we start to see weakness in apple, then I think there's going to be a huge change in like the market sentiment But yeah, um, you know, that's like Warren Buffett's biggest holding right is apple And I think that's because of their dividend structure and in the stability But dude, once you see a like a little chink in the armor there That's when it's going to start to get to get real with a lot of companies. I mean, I think so too Yeah, I think just pull up a daily of meta.  It's crazy meta carvana All of them what are what's what's some of the rest of them? Oh, I mean On snap, you know peloton is almost a penny stock And I know in peloton is like the one of the like as a product is something that only wealthy rich people can afford and like It's a very nice product, but they're trading it like five dollars a share.  I'm cutting my subs Yeah, that's it. And now you know what now they're back in the gyms like It's just I mean it was someday we should do a podcast We can talk about actual like companies and like what they do and like why we disagree or agree But but I mean it's it's crazy, man It really is so you know just like I like you said this as we're kind of I guess we're coming up on the time to wrap it up But you know, uh Unless there's something else to add but you know, just right now It's just about managing expectations in small caps day to day trading and in large cap returns You know, just you know, the market's not always going to be in our favor Um, you know, I'm talking to a lot of guys right now or way better than me about expectations and trades to take and you know Situations to avoid and it's like, you know, just right now. I'm like today's monday november 7th or whatever it is And I don't even know but it's like, you know, I'm still going out and popping a few bottles this week Listen mondays haven't been my day for the market for a long time I've noticed that for my setup mondays just aren't decorated right now And so I I'm pretty much off on mondays like I'll come I'll show up and if an opportunity That's like an a plus or I don't even believe in a plus anymore five an opportunity shows up That's worth it. I'll take it but pretty much I'm um, you know, I'm just Taking it day by day and that's all we can do right now Yeah, exactly And that's what I've really been doing too is just You know, I think a big thing for me as well though has been I always wait for the open now I never trade pre-market. Yeah, if things go up things go down. That's okay. I'll manage the sentiment, but I never trade pre-market anymore just because Um, I know for you like sometimes it's like getting a good fill You know open when the shit fades but like for me, it's just like not really worth it anymore Rather just preserve my capital to the open chill watch Um, and I know like Alex doesn't really trade like short in the pre-market that often either But like I feel like it just really depends on the day.  You know, you just really have to be able to kind of size up the day And I think for the open, you know, that's helped me kind of tremendously to be able to say It helps me manage my expectation My expectations at the open as well because if we have a shit that's just ran from like two to five You know, maybe I'm not going to be as aggressive on that stock and maybe I'll look for others You know, but there's so many situations that I think like we've just been like trained and conditioned for And a big thing is just not being emotional. So you can just be calm cool and collected, you know And I think that that's very important for me Yeah, I just spent the whole weekend actually like going over charts and stuff because you know, I had a pretty good week The first week of november For the current market environment But I need to find ways to eliminate the cuts I'm taking because like the way my my style works is like I take multiple cuts but on the way down as long as the stock has ranged like um, it's it's well worth it But I want to be more in the the mentality, especially during this market sentiment where like I want more confirmation rather than just like Anticipating breakdowns, right? So So it's just I think there's always room to improve and I think kind of like you said It's just you can't be in a rush right now. You have to kind of wait for The right opportunities to come up and just not be not be so in a hurry to get get involved because you know what if you miss You miss it sucks, but it's like, all right, you know, but I also don't want we don't want to take sub par setups and just cut away our actual equity so Yeah, I mean unless there's anything else you really want to add.  I'm just um, oh man No, I think that's pretty good. So thanks everyone for uh, we're listening and we'll catch you for the next one. Yeah, later guys