m
à
WHAT IS A FIREWALL?
A firewall is hardware, software, or a
combination of both that is used to
prevent unauthorized programs or
Internet users from accessing a
private network and/or a single
computer
0
FIREWALLS
Prevent specific types of information from moving
between the outside world (untrusted network)
and the inside world (trusted network)
May be separate computer system; a software
service running on existing router or server; or a
separate network containing supporting devices
FIREWALLS CATEGORIZED BY PROCESSING
MODES
Packet filtering
Application gateways
Circuit gateways
MAC layer firewalls
Hybrids
º
PACKET FILTERING
Packet filtering firewalls examine header
information of data packets
Most often based on combination of:
y Internet Protocol (IP) source and destination address
y Direction (inbound or outbound)
y Transmission Control Protocol (TCP) or User
Datagram Protocol (UDP) source and destination port
requests
Simple firewall models enforce rules designed to
prohibit packets with certain addresses or partial
addresses
APPLICATION GATEWAYS
Frequently installed on a dedicated computer;
also known as a proxy server
Since proxy server is often placed in unsecured
area of the network it is exposed to higher levels
of risk from less trusted networks
Additional filtering routers can be implemented
behind the proxy server, further protecting
internal systems
è
CIRCUIT GATEWAYS
Circuit gateway firewall operates at transport
layer
Like filtering firewalls, do not usually look at
data traffic flowing between two networks, but
prevent direct connections between one network
and another
Accomplished by creating tunnels connecting
specific processes or systems on each side of the
firewall, and allow only authorized traffic in the
tunnels
Ñ
MAC LAYER FIREWALLS
Designed to operate at the media access control
layer of OSI network model
MAC addresses of specific host computers are
linked to access control list (ACL) entries that
identify specific types of packets that can be sent
to each host; all other traffic is blocked
[
HYBRID FIREWALLS
Combine elements of other types of firewalls; i.e.,
elements of packet filtering and proxy services, or
of packet filtering and circuit gateways
Alternately, may consist of two separate firewall
devices; each a separate firewall system, but are
connected to work in tandem
r
PACKET FILTERING ROUTERS
Many of these routers can be configured to reject
packets that organization does not allow into
network
Drawbacks include a lack of auditing and strong
authentication
rr
r0
SCREENED HOST FIREWALLS
Combines packet filtering router with separate,
dedicated firewall such as an application proxy server
Allows router to pre-screen packets to minimize
traffic/load on internal proxy
r
DUAL-HOMED HOST FIREWALLS
Bastion host contains two NIC one connected to
external network, one connected to internal network
Implementation of this architecture often makes use
of network address translation (NAT), creating
another barrier to intrusion from external attackers
rº
SELECTING THE RIGHT FIREWALL
When selecting firewall, consider a number of
factors:
y What features are included in base price and which
are not?
Second most important issue is cost
r
CONFIGURING AND MANAGING FIREWALLS
Firewall policy configuration is usually complex and
difficult
Configuring firewall policies both an art and a science
When security rules conflict with the performance of
business, security often loses
r
w
rè
