firewalls marin stamov. introduction technological barrier designed to prevent unauthorized or...

Firewalls Firewalls

Marin Stamov

IntroductionIntroductionTechnological barrier designed to

prevent unauthorized or unwanted communications between computer networks or hosts

Invented in the early 1990sFirst line of defenseProtect against hackers and worms

Firewall typesFirewall typesPacket filter (stateless)Packet filter (stateful)Hardware firewallNAT firewallProxy firewallTransparent firewallPersonal firewall

Packet filtersPacket filters

Packet filter (stateful)Packet filter (stateful)When a packet reaches the

firewall, it is run against a set of rules.

The rules determine an action to take for the packet

Accept – Let the traffic pass throughReject – Block the packet and return an ICMP

“Communication administratively prohibited”Drop – Block the packet Packets with the SYN bit set are considered by

the firewall as new connections

Firewall rulesFirewall rules

Hardware firewallHardware firewallCiscoPIX

NAT firewall, NAT firewall, AKA "Masquerading"AKA "Masquerading"NAT stands for Network Address

TranslationOriginally developed to address the

limited number of IPv4 routable addresses

Hides the true address of protected hosts

Requires no special configuration on the client side. Clients just have to know their default gateway.

NATNAT

Proxy firewallProxy firewallRuns software that allows

specific programs to functionCan provide anonymityAllowing only specific protocols

that you wish to supportAware of the data format it

handles, and can look for many things inside the data.

Proxy firewallProxy firewallSquid - a proxy server and web

cache daemon.

Transparent firewallTransparent firewall

Personal firewallPersonal firewallProtect only the computer on

which it is installed.May prompt the user each time a

connection is attempted and adapt security policy accordingly.

May provide some level of intrusion detection

FirewallsFirewalls

ConclusionConclusionEach type of firewall does

different things, and can be more or less useful depending on the current scenario

Open only ports that you need

Always test your firewall from the outside

Questions?Questions?