Firewall
A firewall is a device that filters all traffic between a protected or
“inside” network and a less trustworthy or “outside” network. A
firewall is a computer traffic cop that permits or blocks data flow
between two parts of a network architecture. It is the only link
between parts
Definition: A firewall is a protection mechanism for a local system or
network of systems. It guards against security threats from network-
based attacks while allowing access to external networks such as the
Internet or a WAN.
Firewall Characteristics
Design Goals:
o All traffic must pass through the firewall: This ensures
that no unauthorized traffic can access the internal network
directly.
o Only authorized traffic is allowed: The firewall is
configured to only let traffic through based on defined
security policies.
o Immunity to penetration: A firewall must be resistant to
attacks itself, often by using a trusted system with a secure
operating system.
Goal: The design of firewalls has evolved to accommodate
growing network infrastructures like moving from small LANs (Local
Area Networks) to Internet connectivity.
Purpose:
Controlled Link: To establish a controlled connection between
the local network and the Internet.
Choke Point: Firewalls act as a single point of control to
prevent attacks from the Internet.
Network Protection: They protect the internal network from
outside threats.
Types of Controls:
Service Control: Determines which types of services (e.g.,
HTTP, FTP) are allowed to be accessed from inside or outside
the network.
Direction Control: Dictates which direction (inbound or
outbound) service requests are allowed.
User Control: Restricts services based on the identity of the
user requesting access.
Behavior Control: Governs how specific services are used,
such as filtering email or limiting Internet use.
Three Common Types:
o Packet-filtering Routers
o Application-level Gateways (Proxy Servers)
o Circuit-level Gateways
6. Packet-Filtering Router
How it Works:
o A set of rules is applied to incoming and outgoing IP
packets.
o It filters traffic based on matches in the IP or TCP headers.
o Two default policies are used: discard (block) or forward
(allow).
Advantages:
o Simple to implement.
o Transparent to users (users typically don't know it's there).
o Operates at high speed.
Disadvantages:
o Complex to set up rules.
o Lacks user authentication features.
7. Application-Level Gateway
Also known as a proxy server, it acts as a relay between the
network and the Internet, only allowing application-specific
traffic to pass through.
Advantages:
o Provides higher security than packet filters.
o Allows detailed logging and auditing of traffic.
Disadvantages:
o Adds processing overhead, slowing down traffic since
each connection is analyzed in-depth.
8. Circuit-Level Gateway
Function: Establishes two TCP connections – one with the
external network and one with the internal network. It relays
traffic between the two without inspecting the content of the
TCP segments.
Common Use Case: Often used when the system administrator
trusts internal users, an example being the SOCKS protocol.
9. Bastion Host
A bastion host is a dedicated system recognized as a critical
security point within a network. It serves as a platform for either
an application-level or circuit-level gateway and is highly
secured.
Firewall Configuration
Single Packet-Filtering Router or Gateway:
A simple setup involving a single firewall device.
Provides basic protection but lacks comprehensive defenses
against advanced threats.
Screened Host Firewall (Single-Homed Bastion Host):
Setup:
o Combines a packet-filtering router with a bastion host (a
secure, critical system for managing traffic).
o All traffic must pass through the bastion host, which
handles authentication and proxy functions.
Benefits:
o Greater security by combining multiple filtering layers.
o More flexibility in defining security policies.
Screened Host Firewall (Dual-Homed Bastion Host)
Setup:
Utilizes a bastion host with two network interfaces:
o One interface connects to the internal network.
o The other interface connects to the external network (e.g.,
the Internet).
All communication between the internal and external networks
must pass through the bastion host.
No direct routing exists between the two networks, ensuring
strict traffic control.
Benefits:
Enhanced Isolation:
o The physical separation of network interfaces prevents
direct communication between internal and external
systems.
Increased Security:
o Intruders must compromise the bastion host to access the
internal network, which adds a robust layer of protection
Screened Subnet Firewall:
Setup:
o Most secure configuration.
o Uses two packet-filtering routers to create an isolated sub-
network (DMZ).
Benefits:
o Three layers of defense: external router, internal router,
and the bastion host.
o The internal network is invisible to the external Internet,
reducing exposure to threats.
o Provides secure, controlled access to public-facing
services (e.g., web servers) without exposing the internal
network.
Possible attacks and appropriate countermeasures
IP address spoofing involves faking the source IP to bypass
security, which can be mitigated by filtering incoming packets.
Source routing attacks exploit routing controls to bypass security
measures, which can be stopped by disabling source routing.
Tiny fragment attacks break up data into tiny packets to evade
inspection, and the countermeasure is to discard overly small
fragments.