Title: Firewalls
Course: IN 2001 Principle of Information Assurance > Section: Module 6: Chapter Six

Firewalls
1. A firewall prevents specific types of information from moving between the outside world, known as the untrusted network and the inside world, known as the trusted network.
2. The firewall may be a separate computer system, a software service running on an existing router or server, or a separate network containing a number of supporting devices.

Firewall Processing Modes
1. The processing modes are: packet filtering, application gateways, circuit gateways, MAC layer firewalls, and hybrids.

Packet Filtering
1. Packet filtering firewalls examine the header information of data packets that come into a network.  The restrictions most commonly implemented are based on a combination of:
  - Internet Protocol (IP) source and destination address
  - Direction (inbound or outbound)
  - Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) source and destination port requests
2. Simple firewall models examine one aspect of the packet header: the destination and source address.
3. They enforce address restrictions, rules designed to prohibit packets with certain addresses or partial addresses from passing through the device.
4. They accomplish this through access control lists (ACLs), which are created and modified by the firewall administrators.
5. There are three subsets of packet filtering firewalls:
  - Static filtering
  - Dynamic filtering
  - Stateful inspection
6. Static filtering requires that the filtering rules governing how the firewall decides which packets are allowed and which are denied are developed and installed.
7. Dynamic filtering allows the firewall to react to an emergent event and update or create rules to deal with the event.
8. While static filtering firewalls allow entire sets of one type of packet to enter in response to authorized requests, the dynamic packet filtering firewall allows only a particular packet with a particular source, destination and port address to enter through the firewall.
9. Stateful inspection firewalls, or stateful firewalls, keep track of each network connection between internal and external systems using a state table, which tracks the state and context of each packet in the conversation by recording which station sent which packet and when.
10. Whereas simple packet filtering firewalls only allow or deny certain packets based on their address, a stateful firewall can block incoming packets that are not responses to internal requests.
11. The primary disadvantage of this type of firewall is the additional processing required to manage and verify packets against the state table, which can leave the system vulnerable to a DoS or DDoS attack.

Application Gateways
1. The application gateway, also known as an application-level firewall or application firewall, is frequently installed on a dedicated computer, separate from the filtering router, but is commonly used in conjunction with a filtering router.
2. The application firewall is also known as a proxy server, since it runs special software that acts as a proxy for a service request.
3. Since the proxy server is often placed in an unsecured area of the network or in the DMZ, it—rather than the Web server—is exposed to the higher levels of risk from the less trusted networks.
4. Additional filtering routers can be implemented behind the proxy server, limiting access to the more secure internal system and thereby further protecting internal systems.

Circuit Gateways
1. The circuit gateway firewall operates at the transport layer.
2. Connections are authorized based on addresses.
3. Like filtering firewalls, circuit gateway firewalls do not usually look at data traffic flowing between one network and another, but they do prevent direct connections between one network and another.
4. They accomplish this by creating tunnels that connect specific processes or systems on each side of the firewall and then allowing only authorized traffic, such as a specific type of TCP connection for only authorized users, in these tunnels.

MAC Layer Firewalls
1. While not as well known or widely referenced as the firewall approaches above, MAC layer firewalls are designed to operate at the media access control layer of the OSI network model.
2. This gives these firewalls the ability to consider the specific host computer’s identity in its filtering decisions.
3. Using this approach, the MAC addresses of specific host computers are linked to ACL entries that identify the specific types of packets that can be sent to each host, and all other traffic is blocked.

Hybrid Firewalls
1. Hybrid firewalls combine the elements of other types of firewalls—that is, the elements of packet filtering and proxy services or of packet filtering and circuit gateways.
2. Alternately, a hybrid firewall system can consist of two separate firewall devices; each is a separate firewall system, but they are connected so that they work in tandem.

Firewalls Categorized by Generation
1. First generation firewalls are static packet filtering firewalls—that is, simple networking devices that filter packets according to their headers as the packets travel to and from the organization’s networks.
2. Second generation firewalls are application-level firewalls or proxy servers—that is, dedicated systems that are separate from the filtering router and that provide intermediate services for requestors.
3. Third generation firewalls are stateful inspection firewalls, which monitor network connections between internal and external systems using state tables.
4. Fourth generation firewalls are dynamic packet filtering firewalls and allow only a particular packet with a particular source, destination, and port address to enter.
5. Fifth generation firewalls are the kernel proxy, a specialized form that works under the Windows NT Executive, which is the kernel of Windows NT.

Firewalls Categorized by Structure
1. Firewall appliances are stand-alone, self-contained systems that frequently have many of the features of a general-purpose computer with the addition of firmware-based instructions that increase their reliability and performance and minimize the likelihood of their being compromised.
2. A commercial-grade firewall system consists of firewall application software running on a general-purpose computer.
3. Organizations can install firewall software on an existing general-purpose computer system or they can purchase hardware that has been configured to the specifications that yield optimum performance for the firewall software.
4. SOHO and residential-grade firewall devices, also known as broadband gateways or DSL/cable modem routers, connect the user’s local area network or a specific computer system to the Internetworking device.
5. The SOHO firewall serves first as a stateful firewall to enable inside to outside access and it can be configured to allow limited TCP/IP port forwarding and/or screened subnet capabilities.
6. Residential-grade firewall software is installed directly on the user’s system.
7. Some of these applications combine firewall services with other protections such as antivirus or intrusion detection.
8. There are limits to the level of configurability and protection that software firewalls can provide.

Software vs. Hardware: The SOHO Firewall Debate
1. So which type of firewall should the residential user implement? Where would you rather defend against a hacker?
2. With the software option, the hacker is inside your computer, battling with a piece of software that may not have been correctly installed, configured, patched, upgraded or designed.  If the software happens to have a known vulnerability, the hacker could bypass it and then have unrestricted access to your system.
3. With the hardware device, even if the hacker manages to crash the firewall system, your computer and information are still safely behind the now disabled connection, which is assigned a nonroutable IP address, making it virtually impossible to reach from the outside.

Firewall Architectures
1. Each of the firewall devices noted earlier can be configured in a number of network connection architectures.
2. The firewall configuration that works best for a particular organization depends on three factors: the objectives of the network, the organization’s ability to develop and implement the architectures and the budget available for the function.
3. Although literally hundreds of variations exist, there are four common architectural implementations of firewalls:
  - Packet filtering routers
  - Screened host firewalls
  - Dual-homed host firewalls
  - Screened subnet firewalls

Packet Filtering Routers
1. Most organizations with an Internet connection have a router as the interface to the Internet at the perimeter between the organization’s internal networks and the external service provider.
2. Many of these routers can be configured to reject packets that the organization does not allow into the network.
3. The drawbacks to this type of system include a lack of auditing and strong authentication and the complexity of the access control lists used to filter the packets can grow and degrade network performance.

Screened Host Firewalls
1. This architecture combines the packet filtering router with a separate, dedicated firewall, such as an application proxy server, allowing the router to prescreen packets to minimize the network traffic and load on the internal proxy.
2. The application proxy examines an application layer protocol and performs the proxy services.
3. This separate host is often referred to as a bastion host or sacrificial host; it can be a rich target for external attacks, and should be thoroughly secured.

Dual-Homed Host Firewalls
1. With this approach, the bastion host contains two NICs.  One NIC is connected to the external network, and one is connected to the internal network, providing an additional layer of protection.
2. With two NICs, all traffic must go through the firewall in order to move between the internal and external networks.
3. The implementation of this architecture, which often makes use of NAT. NAT is a method of mapping assigned IP addresses to special ranges of nonroutable internal IP addresses, thereby creating yet another barrier to intrusion from external attackers.

Screened Subnet Firewalls (with DMZ)
1. The dominant architecture used today, the screened subnet firewall provides a DMZ.
2. The DMZ can be a dedicated port on the firewall device linking a single bastion host or it can be connected to a screened subnet.
3. A common arrangement finds the subnet firewall consisting of two or more internal bastion hosts behind a packet filtering router, with each host protecting the trusted network:
  - Connections from the outside or untrusted network are routed through an external filtering router
  - Connections from the outside or untrusted network are routed into—and then out of—a routing firewall
  - to the separate network segment known as the DMZ
  - Connections into the trusted internal network are allowed only from the DMZ bastion host servers
4. The screened subnet is an entire network segment that performs two functions:
  - It protects the DMZ systems and information from outside threats by providing a network of intermediate security
  - It protects the internal networks by limiting how external connections can gain access to internal systems
5. DMZs can also create extranets, segments of the DMZ where additional authentication and authorization controls are put into place to provide services that are not available to the general public.

SOCKS Servers
1. The SOCKS is the protocol for handling TCP traffic via a proxy server.
2. The general approach is to place the filtering requirements on the individual workstation rather than on a single point of defense (and thus point of failure).
3. This frees the entry router from filtering responsibilities, but it requires that each workstation be managed as a firewall detection and protection device.

Selecting the Right Firewall
1. When selecting the best firewall for an organization, you should consider a number of factors.  The most important of these is the extent to which the firewall design provides the desired protection.
  - What type of firewall technology offers the right balance between protection and cost for the needs of the organization?
  - What features are included in the base price?  What features are available at extra cost?  Are all cost factors known?
  - How easy is it to set up and configure the firewall?  How accessible are the staff technicians who can competently configure the firewall?
  - Can the candidate firewall adapt to the growing network in the target organization?
2. The second most important issue is cost.

Configuring and Managing Firewalls
1. Good policy and practice, which dictate that each firewall device, whether a filtering router, bastion host or other firewall implementation, must have its own set of configuration rules that regulate its actions.
2. The configuration of firewall policies can be complex and difficult. Configuring firewall policies is as much an art as a science.
3. Each configuration rule must be carefully crafted, debugged, tested, and sorted.
4. when configuring firewalls, keep one thing in mind: when security rules conflict with the performance of business, security often loses.
5. Best practices for firewalls.
  - The following are some of the best practices for firewall use
  - The firewall device is never directly accessible from the public network
  - SMTP data is allowed to pass through the firewall, but it should be routed to a well-configured SMTP gateway to filter and route messaging traffic securely
  - All ICMP data should be denied
  - Telnet access to all internal servers from the public networks should be blocked
  - When Web services are offered outside the firewall, HTTP traffic should be denied from reaching your internal networks through the use of some form of proxy access or DMZ architecture

Firewall Rules
1. Firewalls operate by examining a data packet and performing a comparison with some predetermined logical rules.
2. The logic, which is based on a set of guidelines programmed in by a firewall administrator, or created dynamically and based on outgoing requests for information.
3. This logical set is most commonly referred to as firewall rules, rule base, or firewall logic.
4. Most firewalls use packet header information to determine whether a specific packet should be allowed to pass through or should be dropped.

Content Filters
1. A content filter, which is a software filter—technically not a firewall—that allows administrators to restrict access to content from within a network.  It is essentially a set of scripts or programs that restricts user access to certain networking protocols and Internet locations or restricts users from receiving general types or specific examples of Internet content.
2. Some refer to content filters as reverse firewalls, as their primary focus is to restrict internal access to external material.
3. In most common implementation models, the content filter has two components: rating and filtering.
4. The rating is like a set of firewall rules for Web sites, and it is common in residential content filters.
5. Filtering is a method used to restrict specific access requests to the identified resources, which may be Web sites, servers or whatever resources the content filter administrator configures.
6. The most common content filters, which restrict users from accessing Web sites with obvious non-business related material, such as pornography or deny incoming spam e-mail.