Firewalls

A firewall is a device that protects a private network from outside intrusions by examining every packet that passes through it against a set of rules. A firewall is not a virus guard.

Stance

The stance dictates what a firewall does in the absence of a matching rule. The default stance blocks everything unless explicitly allowed.

Interfaces

• External interface
  Connects to an untrusted network, typically the Internet.
• Trusted interface
  Connects to the internal network, requiring maximum protection.
• Optional interface
  Connects to a DMZ or another semi-trusted zone, hosting public web, mail, FTP, or DNS servers.

Security Policy

A firewall’s security policy specifies:

• Which hosts send or receive which kinds of traffic.
• Which communication links require authentication or encryption.
• Which users are authorized to use which services through the firewall.
• Which communication protocols and content types are allowed.
• Which times of day users may browse the web.
• Which categories of website users may visit.

Packet Filtering

Packet filtering inspects a packet’s header, filtering on IP address, port, protocol, or type of service, and treats incoming and outgoing packets separately.

• Operates at the network and transport layers.
• Cannot detect stateless attacks such as denial of service, since it judges every packet independently.

Circuit Relay

Circuit relay filters using information outside the packet header, such as the user or time of day, and tracks connection state dynamically instead of judging each packet in isolation.

Combining packet filtering with circuit relay is more effective than either alone.

Security Proxy

A security proxy intercepts each packet, strips its wrapping, inspects and processes the content, then re-wraps and forwards it, detecting forbidden content that packet filtering and circuit relay cannot see.

• Blocks entire categories of attack rather than individual packets.
• Conceals details of internal servers from the public Internet.
• Adds processing delay to every packet.

A lower layer means less information is available to the filter, but less processing overhead per packet.

Virtual Private Networks

A virtual private network (VPN) gives 2 hosts an encrypted channel over a public network, using a protocol such as IPsec, L2TP, or PPTP.

• Encrypts traffic end to end.
• Encryption overhead trades bandwidth and processing power for confidentiality.
• This overhead can noticeably reduce throughput on a high-speed connection.

A VPN server needs to be dedicated to the task, since a server shared with other services cannot sustain the added processing load.

Stateless and Stateful Inspection

A stateless packet filter judges each packet independently, with no memory of the protocol context.

A stateful firewall tracks the state of each connection. It permits inbound traffic only if it matches an established, legitimate outbound request, so unsolicited probes and forged replies are dropped.

Web Application Firewall

A web application firewall (WAF) inspects Layer 7 traffic in depth. It mitigates application-specific attacks such as SQL injection and cross-site scripting. A traditional or next-generation firewall that works on lower-layer traffic does not specialize in these.

URL Filtering

Web pages are filtered against a database controlled by a third party. The administrator can add sites or exceptions. Filtering can depend on the user, the user group, the time of day, and similar attributes.

Demilitarized Zone

A demilitarized zone (DMZ) is a separate network segment behind the optional firewall interface. It hosts public servers such as web and mail, isolated from the internal network.

Proxy Advantages

• Harder to hack
  Blocks entire categories of common attacks and conceals internal servers from the public Internet.
• Bandwidth use
  Prevents unwanted or inappropriate traffic from entering the network.
• Lower liability
  Prevents an attacker from using the network as a launch point for further attacks.
• Easier management
  Administrators apply tools and defaults broadly instead of desktop by desktop.

Software and Hardware Firewalls

• Server-based firewall
  Runs on a general-purpose server. The OS is less secure and not real-time. The deployment pays for unnecessary features, needs parts from several vendors, and needs frequent patches. Low initial cost, high total cost of ownership.
• Hardware appliance
  A dedicated box with a hardened OS from a single vendor, often without a hard disk. Firmware updates are harder to apply. Higher initial cost, significantly lower total cost of ownership.

Appliances beat software through ASICs (application specific integrated circuits), which hard-code functions such as packet classification, rule enforcement, NAT, and encryption into chips.

• On a CPU-centered design, every packet crosses the system bus, which becomes the bottleneck.
• An intelligent ASIC sends the first packet of a flow to the CPU for classification and policy lookup.
• The policy is cached in the ASIC. The remaining packets of the flow are cut through, bypassing the CPU.