Firewall

Introduction to firewall
The dramatic rise and progress of internet has
opened the possibilities that no one would
have thought of.
We can connect any computer in the world to
any another computer
But due to this, there may be danger to the
information.
We must have mechanisms which can ensure
that the inside information remains inside and
also prevent the outsider attackers from
entering inside a network
This is where Firewall comes into picture.
Characteristics of Firewall

Types of firewall
Packet filtering firewall
Stateful inspection firewall
Application gateway
Circuit level gateway
Packet Filtering Firewall
Applies a set of rules to each packet
Based on the rules, decides to either forward
or discard the packet.
Also known as Screening router or screening
filter.
Filtering rules are based on fields of IP or TCP
headers such as Source IP address,
Destination IP address, IP protocol field etc.

Packet filter performs following functions:
Receive each packet as it arrives
Pass packets through a set of rules, based on the
contents of the IP and TCP headers of packets. If there
is a match with one of the set rules, decide whether to
accept or discard the packet based on that rule.
If there is no match with any rule, take the default
action. The default action can be discard all packets or
accept all packets.

Stateful Packet filter
Allows the examination of packets based on the current
state of network
Adapts itself to the current exchange of information, unlike
the normal packet filters.
For example, Client sends request to a server. Firewall will
allow it. When server will response back, firewall will also
allow it as it is the response to the request which client has
sent. But if client has not sent any request, but a message is
received from server. In that case, filter will not allow this
message.
It maintains the list of all open connections, according to
these connections, this filter will allow or discard the
packets.
Application Gateway
Also known as Proxy server.
An internal user contacts the application gateway
using TCP/IP application such as HTTP.
The application gateway asks the user about the
remote host with which the user wants to set up
a connection for actual communication.
User provides this information to the application
gateway.
The application gateway now accesses the
remote host on behalf of user and passes the
packets of user to remote host.
Circuit level gateway
Variation of application gateway
Performs some additional functionality as
compared to those performed by application
gateway
It creates a new connection between itself
and remote host.
The user is not aware of this thing and thinks
that there is a direct connection between
itself and remote host.
Circuit gateway changes the source IP address
in the packets from the end users IP address
to its own.
Firewall biasing
Bastion host
Host based firewall
Personal firewall
Firewall configuration and Location
We can configure the firewalls in three
different ways
DMZ
VPN
Distributed Firewall
DMZ (Demilitarized zone)
This concept is quite popular in Firewall
architectures
DMZ is required only if organization has servers
that it needs to make available to the outside
world. (WEB server )
For this, firewall has at least three network
interfaces
One connects to the internal private network
Second interface connects to internet
Third connects to the public servers.


Advantage of such scheme is that access to
nay service on the DMZ can be restricted.
Internal private network is no way directly
connected to DMZ
So even if any attacker ca somehow manage
to hack into DMZ, internal private network is
safe and out of reach of attacker
VPN (Virtual private network)
Let us assume that an organization wants to
connect two of its branch networks to each
other
The trouble is that these branches are located
quite a distance apart.
Two solutions can be
Connect two networks using cables (optic fibres)
Connect them with internet

First solution is good but laying cables is very
costly
Second solution seems good but there are
possibilities of attacks.
So, nice would be if we combine these both.
VPNs offers such solutions
VPN is a mechanism of employing encryption,
authentication and integrity protection so that
we can use a public network as if it is private
network.


Distributed firewall