1. Firewalls

2. Firewalls Purpose of a Firewall Characteristic of a firewall
To allow ‘proper’ traffic and discard all other traffic
Characteristic of a firewall
All traffic must go through the firewall
Allow and blocking traffic (Only Authorized traffic)
The Firewall itself must be immune of attacked

3. Firewalls what to configure
5 areas to control:
Services (web, ftp, mail …) i.e. Port#
Network (hosts) i.e. IP addresses
Direction i.e. control inside-out or reverse
User i.e. only authorized users allow
Behaviour (e.g. attachment to mail)
(Denial of Service Inspection)

4. Firewalls types Screening Firewall
The normal built in packet filter firewall in routers
Application Gateway (OR application proxy)
Establish connection to gateway then a new connect out
Have user authentication BUT performance is bad
Circuit level gateway
Like application (two connections + authentication)
Better performance

5. Firewall – Screening Packet-filtering
Level 3 – network (IP-packets)
Filtering on (the access control list):
Source/Destination IP-addresses
Source/Destination Port-numbers
IP-protocol field (e.g. icmp, tcp, egp)
TCP-direction (SYN-bit)
InBound / Outbound on each interface (sometimes also forwarding)

6. Firewall – Screening Packet-filtering
Configurations
Policies: 1:optimistic: default set to allow / forward 2:pessimistic: default set to discard / deny
Setting up rules

7. Example IN
OUT IN
OUT

8. Firewall – Screening Packet-filtering
Out In
Action
SRC HOST(ip)
SRC port
DST HOST(ip)
DST port
Protocol
Flag(direction)
Remarks
deny *
Pessimistic
Allow
(>1024) 80
To webserver
Action
SRC HOST(ip)
SRC port
DST HOST(ip)
DST port
protocol
Flag(direction)
Remarks
deny *
Pessimistic
Allow 80
* (>1024)
 ACK
From webserver

9. Firewall - Architecture
Best Practice solution For small and middle companies:
Screened subnet firewall MOST secure DMZ – demilitarized zone (2 packet-filter + bastion host on the net (DMZ) in between)
Home Firewall like ZoneAlarm / windows-firewall

10. More Literature
SANS ( SysAdmin, Audit, Networking, and Security) white paper:
General information:
For Unix systems:
For Windows: