Network Defense and
Countermeasures
by Chuck Easttom
Chapter 3: Fundamentals of Firewalls
Objectives
n Explain how firewalls work.
n Evaluate firewall solutions.
n Differentiate between packet filtering and
stateful packet filtering.
n Differentiate between application gateway
and circuit gateway.
n Understand host-based firewalls and routerbased firewalls.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
2
Introduction
Firewalls are one of the fundamental devices
used to secure a network. This chapter
explores the basics of firewalls and how they
work. Based on the evaluations done here, you
can determine under what circumstances a
firewall solution is appropriate.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
3
What Is a Firewall?
A barrier between the world and your network.
n Provided via:
n
Packet filtering
q Stateful packet filtering
q User authentication
q Client application
authentication
q
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
4
Types of Firewalls
n Packet filter
n Connection tracking
n Application gateway
n Circuit level gateway
n Stateful packet inspection
n Hybrid firewalls
n Blacklisting/whitelisting
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
5
Packet Filtering Firewall
n Very basic type of firewall.
n Also referred to as “screening” firewalls.
n Works by examining a packet’s:
Source address
q Destination address
q Source port
q Destination port
q Protocol type
q
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
6
Common Packet Filtering Products
n Firestarter
n Avast Internet Security
n Zone Alarm Firewall
n Comodo Firewall
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
7
Packet Filtering Firewall Disadvantages
n Does not compare packets.
n No authentication.
n Susceptible to SYN and Ping flood attacks.
n Does not track packets.
n Does not look at the packet data, just the
header.
n Not necessarily the most secure firewall.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
8
Packet Filtering Firewall Rules
n Rules should cover:
q
What types of protocols to allow
n
n
n
FTP
SMTP
POP3
What source ports to allow
q What destination ports to allow
q What source IP addresses to allow
q
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
9
Stateful Packet Inspection
n Being aware of the context of packets makes
them less susceptible to flood attacks:
Knows if packet is part of a larger stream
q Recognizes whether source IP is within the
firewall
q Can look at the contents of the packet
q
n When possible, the recommended firewall
solution.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
10
Stateful Packet Inspection
n Examples:
SonicWALL (www.sonicwall.com/)
q Linksys (www.linksys.com/)
q Cisco (www.cisco.com)
q
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
11
Application Gateway
n Also known as application proxy or
application-level proxy.
n Examines the connection between the client
and the server applications.
n Enables administrators to specify what
applications are allowed.
n Allows for user authentication.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
12
Application Gateway Disadvantages
n Disadvantages:
Requires more system resources
q Susceptible to flooding attacks (SYN and Ping)
q
n
n
Due to time it takes to authenticate user
When connection is made, packets are not checked
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
13
Circuit Level Gateway
n More secure than application gateways.
n Typically implemented on high-end
equipment.
n Authenticates the user first.
n Virtual circuit is used to pass bytes between
client and proxy server.
n External users see only the proxy IP not the
internal client IP address.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
14
Application vs. Circuit Level Gateway
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
15
Hybrid Firewalls
n Becoming more popular, these configurations
take multiple approaches to their firewall
implementations.
n SPI and circuit level gateways might be used
together.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
16
Blacklisting/Whitelisting
n Blacklisting is a security approach wherein
users are allowed to visit any website, or
Internet resource, except those on the
prohibited list. That list is a blacklist. This is
very permissive. Users are only prevented
from visiting the sites on those specific lists.
n Whitelisting involves blocking users from
visiting any website or Internet resource
except those on an approved list.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
17
Implementing Firewalls
n Need to understand the firewall’s relationship
to the network it is protecting.
n Most common solutions:
Network host-based
q Dual-homed host
q Router-based firewall
q Screened host
q
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
18
Host-Based
n Software-based solution runs on top of
operating system.
n Must harden the operating system in the
following ways:
Ensure all patches are updated
q Uninstall unneeded applications or utilities
q Close unused ports
q Turn off all unused services
q
n Cheap solution.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
19
In Practice: Demilitarized Zone (DMZ)
Two separate
firewalls.
n One faces the outside
world.
n Once faces the
inside.
n Web, e-mail, and FTP
servers are located in
the area in-between
them;
n
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
20
Dual-Homed Hosts
Expanded version
of the host-based
firewall.
n Also runs on top of
an existing OS.
n Disadvantage, as
with host-based
firewalls, is its
reliance on the
security of the OS.
n
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
21
Router-Based Firewall
n Usually the first line of defense.
n Uses simple packet filtering.
n Ideal for novice administrators.
n Can be preconfigured by vendor for specific
needs of user.
n Can be placed between segments of a
network.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
22
Screened Host
n A combination of firewalls.
n Bastion host and screening router is used.
n Similar in concept to the dual-homed host.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
23
Firewall Deployment
Principle: defense-indepth.
n Multiple firewalls:
n
q
q
Stateful packet inspecting
firewall
Application gateway
Screened firewall routers
separating each network
segment.
n Dual-perimeter firewall,
packet screening on all
routers, individual packet
filtering firewalls on every
server.
n
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
24
Selecting and Using a Firewall
n Configure it properly.
n Consider a consultant for initial setup.
n Review logs periodically for anomalies.
n Utilize statistics for baseline performance.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
25
Using Proxy Servers
n Prevent the outside world from gathering
information about your internal network.
n Provide valuable log information.
n Can redirect certain traffic, based on
configuration.
n Typically runs on the firewall machine.
n Protects against spoofing.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
26
The WinGate Proxy Server
n Supports Internet connection sharing.
n Hides internal IP addresses.
n Allows virus scanning.
n Filters websites.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
27
Network Address Translation (NAT)
n To connect to the outside world.
n Supersedes proxy servers.
n Translates internal IP addresses to public
addresses.
n Can explicitly map ports to internal addresses
for web servers.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
28
Summary
n Firewalls and proxy servers are critical for
network security solutions.
n Many solutions are available, which vary in
price and features.
n Choose the most secure solution that the
budget allows.
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
29
Summary (cont’d)
n Types of firewalls:
Packet filter
q Application gateway
q Circuit level gateway
q Stateful packet inspection
q
n Types of implementations:
Network host-based
q Router-based
q Dual-homed and screened host
q
© 2024 by Pearson Education, Inc.
Chapter 3 Fundamentals of Firewalls
30