A firewall is basically something that protects the network from the Internet. It is derived from the concept of firewalls used in vehicles which is a barrier made of fire resistant material protecting the vehicle in case of fire. Anyway a firewall is best described as a software or hardware or both Hardware and Software packet filter that allows only selected packets to pass through from the Internet to your private internal network. A firewall is a system or a group of systems which guard a trusted network( The Internal Private Network from the untrusted network (the Internet.) To understand how a firewall works, firstly we need to understand how exactly data is transferred on the Internet.
The TCP\IP suite is responsible for successful transfer of data across a network both the Internet and the Intranet. The TCP\IP suite is a collection of protocols which are inter-related and interdependent and act as a set of rules according to which data is transferred across the network. A protocol can be defined as a language or a standard which is followed while transfer of data takes place.
A firewall relies on the source and destination IP and also the ports to control the packet transfer between the untrusted network and the trusted network. Firewalls can be classified into 3 types:
1. Packet Filter Firewalls
2. Application proxy Firewalls
3. Packet Inspection Firewalls
Packet Filter Firewalls
They are the earliest and the most criticized firewalls, which nowadays are not easily found. They are usually Hardware based i.e. Router Based (a router is a piece of device which connects two
networks together.) Whenever a Packet Filter Firewall receives a packet for permission to pass through, it compares the header information i.e. the source and destination IP address, and port number with a table of predefined access control rules If the header information matches, then the packet is allowed to pass else the packet is direct contact between the untrusted system and the trusted private system.
Such Firewalls can be fooled by using techniques like IP Spoofing in which we can change the source IP such that the firewall thinks that the packet has come from a trusted system which is among the list of systems which have access through the firewall.
Application proxy Firewalls
The shortcomings of the packet filter firewalls are addressed by the new type of firewalls developed by the DARPA. It was widely believed that the earlier type of firewalls were not secure enough as they allowed the untrusted systems to have a direct connection with the trusted systems. This problem was solved with the use of Proxy servers as firewalls. A proxy server which is used as a firewall are called application proxy servers. This kind of a proxy firewall examines what application or service (running on ports) a packet is meant for and if that particular service is available only then is the packet allowed to pass through and if the service is unavailable then the packet is discarded or dropped by the firewall.
Packet Inspection Firewalls
It can be also known as an extension of the Packet Filter Firewall. It not only verifies the source and
destination IP's and ports, it also takes into consideration or verifies that content of the data before passing it through. There are two ways in which this kind of a firewall verifies the data to
be passed:
State and Session.
In case of state inspection, an incoming packet is allowed to pass through only if there is a matching outward bound request for this packet. This means that the incoming packet is allowed to pass through only if the trusted server had requested for it or had sent an invitation for it.
In case of session filtering, the data of the incoming is not verified, but instead the network activity is traced and once a trusted system ends the session, no further packets from that system pertaining to that session are allowed to pass through.
All along you will come across many Firewalls on various systems, basically a
firewall can be established
or setup in two ways:
1. Dual-homed gateway
2. Demilitarized zone (DMZ)
In a dual homed gateway firewall, there is a single firewall with 2 connections, one for the trusted network and the other for the untrusted network.
In the case of a Demilitarized Firewall or a DMZ there are two firewalls, each with two connections, but there is a slight difference in the case of a DMZ setup.
In the case of a DMZ setup, there are two firewalls, the first having two connections, one leading to the untrusted network and the other leading to the host systems like the email server or the FTP server etc.
In the case of a Dual Homed Gateway the untrusted network is connected to the host systems (email and FTP servers etc) through a firewall and these host systems are connected to the internal private network. There is no second firewall between the host systems and the internal
private trusted network.
The basic structure of the DMZ setup declares it to be a more secure system as even if an attacker gets through the first firewall, he just reaches the host systems, while the internal network is protected by another firewall.
No comments:
Post a Comment