A firewall is like a border sentry. A firewall is like a gateway. A firewall is like a traffic control device. A firewall is a filtering device that enforces network security policy and protects the network against external attacks.

As a filtering device, a firewall watches for traffic that fails to comply with the rules defined by the firewall administrator. Firewalls can focus on packet header, packet payload, packet header and payload, the content of a session, the establishment of a circuit, and possibly other assets. Most firewalls focus on only one of these, rather than all of them. The most common filtering focus is on the header of the packet, with the payload of a packet a close second. Many firewall products focus on more than one aspect of communication filtering.

Filtering allows what you want on your network and denies what you do not. Filtering relies on filtering rules. Each rule has a pattern of concern and a response the firewall will make if an incoming element matches the pattern.

Firewalls follow a philosophy or stance of security known as deny by default, allow by exception. All the rules on a firewall are exceptions. Some exception rules define what you allow. Some exception rules define what you wish to deny. The final option, sometimes called the final rule, is anything that did not match one of the exceptions denied by default.

Firewall filtering compares each packet received to a set of exception rules. These rules state that content in the packet is either allowed or denied. If the packet matches an allow rule, it continues on to its destination. If the packet matches a deny rule, then the packet is dropped. Hence, a deny rule prevents the packet from reaching its destination. If a packet fails to match any rule, then the firewall drops the packet by default.

The filtering rules are the exceptions to the deny all rule that is the final and absolute rule of a firewall. In fact, if a deny by default rule didn't exist, the filtering device would not be a firewall at all. Instead, it would be more like a router or switch, allowing traffic to pass, even if it did not match an expected pattern or rule. So, keep in mind the security stance of deny by default, allow by exception. A firewall is a filtering device that helps support this stance.

Think of a firewall as a sentry along the borders of a country. The term firewall is not exactly the best term that could have been selected for this device or service that performs essential security filtering for hosts and networks. The term firewall comes from a building and automotive construction concept of a wall that is built to prevent the spread of a fire from one area into another. The firewall in a building or car engine compartment is a physical block against the spread of fire.

Network security administrators use the term firewall to refer to a device or service that allows some traffic but denies other traffic. This is not the same as a building's firewall, which only allows a fire to spread if the firewall fails. In network security, firewalls allow traffic through that's considered safe—or at least authorizes traffic without the entire firewall failing. Additionally, if a firewall does fail, it fails into a secured state. This means that when the firewall is offline, is locked/frozen, or otherwise experiences a problem, it stops all traffic, rather than allowing all traffic through. This is known as fail-safe or fail-secure.

Better ways to envision the job of the firewall are a sentry, doorman, or even border guard. These people positioned at the entrance or exit of a building watch for unauthorized attempts to enter the secured area. Some people are allowed to enter; others are prevented. In the event that the sentry isn't present, the doorway is locked, so only those with a key can enter. Think of a firewall as a border sentry.

A gateway is an entrance or exit point to access a controlled space. We all use gateways everyday in a variety of ways. An on-ramp is a gateway to the highway, a doorway is a gateway to a building, and a personal computer is a gateway to the Internet—and to your organization's network. You can also think of a firewall as the gate at a gateway. The firewall stands at the entrance of a network to block unwanted traffic.

Gateways are important because, typically, high levels of traffic pass through a gateway. Thus, positioning a firewall at a network gateway is an aspect of secure design. If the gateway already exists in the network infrastructure, then positioning the firewall at that point is an obvious security improvement. A firewall so positioned watches over all traffic crossing that gateway point.

If a network is still in its design phase, a network designer might make the secure choice to create a gateway in the network's layout. However, in this situation, the concentration point would be known as a choke point instead of a gateway. If a gateway is an access point to other areas of resources, a choke point is a specialized kind of gateway that focuses on traffic to a single concentrated pathway to simplify the process of filtering.

Whether labeled as a gateway for resource access or a choke point to control security, the result is the same. A firewall positioned at a gateway provides filtering services across all traffic. The choke point provides filtered access to resources. As a wise poet once said: "Good fences make good neighbors." So too, good gateways and well-positioned firewalls make secure networks.

You can also think of a firewall as a traffic control device. A significant amount of network security is little more than controlling traffic. Authorized traffic passes through the digital intersection, while unauthorized, unwanted, abnormal, or obviously malicious traffic is blocked.

The very basic and original form of the modern firewall was a screening router. Routers analyze traffic based on destination address. The best-known available route to the destination informs the Forwarding decision. However, screening routers added in additional rules that could discard traffic based on destination or source address. Once filtering expanded to address protocols and even ports, the screening router became the basic static packet filtering firewall.

In addition to filtering, firewalls can also offer routing functions, which are a holdover from this router ancestry. A multi-homed firewall can grant traffic access to one or another interface or segment based on the results of filtering. Traffic for a private LAN could traverse one segment, while traffic destined for the DMZ could follow another (see Figure 2-1). A firewall is an efficient, necessary traffic control device on the highway that is your network.

A firewall enforces your organization's network security policy. Specifically, a firewall enforces the network traffic access control security policy. A firewall is the physical embodiment of the security policy. It's the most obvious or direct enforcement of access control on your network's traffic. No device more than your firewall is as directly involved in allowing authorized traffic and denying all else.

Figure 2-1. A basic multi-homed firewall filtering and routing for two network segments.

A security policy defines the goals, objectives, and procedures of security. Every security policy focusing on network security requires the deployment of a firewall. The firewall's job is to impose all restrictions and boundaries defined in the security policy on all network traffic. A firewall enforces your organization's network security policy just as a traffic policeman enforces the motor vehicle laws of a town or state.

A firewall's critical function is to protect your network against external attacks. It's no secret that threats from without are numerous. The onslaught of attacks is almost unbelievable, like a constant flood against every Internet-connected node. If it were not for vigilant hardening of hosts and the use of firewalls, the Internet and private networking as we know it could not exist.

It's no accident that some threats to computer networks are called viruses: external threats seem to continuously change and evolve. Some attacks are targeted specifically for your network or organization. Some attacks are untargeted and random. Instead, they are directed toward any host that happens to have a specific vulnerability. Malicious code relentlessly infects and compromises unprotected computer systems. Flooding attacks attempt to interrupt timely Internet communications. And these are only some of the external threats facing your organization's network.

A firewall stands as a sentry, as a front guard, as a defense against all attacks and attempts at system compromise. The good news is that many firewalls are well hardened against all known-to-date attacks. These firewalls can withstand the blitzkrieg of the attacks without faltering. A firewall protects the network against the substantial asset damage that external attacks can cause.

Understanding these definitions and distinctions are only the beginning of understanding firewalls. These topics are explored further in this chapter as well as in Chapters 7-11.

What Firewalls Cannot Do

A firewall is an essential part of network security. However, it's not the whole of network security. Don't make the mistake of deploying a firewall while ignoring other security management activities. A firewall is only one piece of the large complex puzzle of network security.

There are many things a firewall is not. Don't be fooled by the marketing. Some of these "deficiencies" can become cloudy as vendors sell combination or multi-function solutions. Often, these devices are designed for the SOHO or home user and thus were never intended to provide commercial-grade protections.

A firewall is primarily for network traffic filtering.

But it's not an authentication system. Firewalls aren't designed to check logon credentials, compare biometric scans, or even confirm the validity of digital certificates. These are the functions of an authentication service, typically hosted on a domain controller or primary network server.

That said, you might find it necessary for a firewall to allow authentication before granting access to a resource or allowing a session. Some firewalls can have enhancement features that provide for firewall-hosted authentication services. However, in many cases, a better solution would be to have the firewall offload that task to a dedicated authentication server or service, such as 802.1x, Public Key Infrastructure (PKI), or directory services. Most security experts do not recommend using a firewall to authenticate users, or at least not as a replacement for a network's directory service or centralized authentication solution. Firewalls are not authentication systems.

A firewall is not a remote access server. Connections from remote users do not have an endpoint at the firewall. Instead, the endpoint is a remote access server (RAS) or network access server (NAS). A firewall may function before or after the RAS/NAS to filter remote access traffic. However, that doesn't mean the firewall is the RAS/NAS itself.

Your firewall should of course filter all remote traffic. Especially since remote traffic is much more likely to be purposefully malicious or accidentally damaging than local traffic. Why? An organization has much more control over who can connect to their network locally than it does when it allows remote connectivity. Remember: A firewall does not replace a remote access server.

Like Superman, your firewall does not have x-ray vision into encrypted traffic; in other words, it cannot see the contents of encrypted traffic. A firewall can filter on the header of traffic using transport mode encryption, since the original header is in plain text form. However, a firewall cannot filter the original header of traffic using tunnel mode encryption, since the only plain text component is a temporary tunnel header that only includes information about the endpoints of the tunnel. It's like trying tell what's in the boxcars of a train, by observing only the locomotive and the caboose.

Position your firewall where it can be most effective. If the security design requires that all traffic content be examined by a firewall, then you need to position the firewall after encryption is removed from the traffic. If the security design only requires filtering on non-encrypted traffic, then positioning the firewall is not as critical.

Firewalls designed for use by Web e-commerce sites may have an additional ability to act as the endpoint of a Secure Sockets Layer (SSL) or Transport Layer Security (TLS) tunnel from an Internet client. This grants the client protection for their data as the information traverses the Internet. This allows a firewall to filter the content of the traffic before the Web server receives and processes the information.

Encryption is one method to evade filtering. Users and hackers can employ client-side encryption solutions that encode the data before transmission or create unauthorized encrypted encapsulation tunnels to prevent firewall filtering. In this situation, your network security policy may stipulate that the firewall needs to block encrypted transmission initiated by clients, especially if the destination is on the Internet. It's important to remember that firewalls are powerful, but they don't have x-ray vision into encrypted traffic.

A firewall is also not a malicious code scanner. Firewalls are traditionally rule-based filtering products. These rule sets usually have only a few dozen to at most a few hundred rules. To filter malicious code, the rule list would need millions of entries. As of Dec 2009, the AVG Anti-Virus definition database #270.14.88/2538 was tracking 24,303,360 malicious code infection definitions. That number of entries is simply impractical to include in a firewall rule set.

Some firewall products include an enhancement or add-on module for malicious code scanning. Such an enhancement is just an add-on component, not a core feature of a firewall. In most cases, it's more efficient and more secure to use separate anti-malware scanners than to add this function to your firewall.

Many firewall rules block traffic with spoofed addresses, uncommon ports, unauthorized protocols, invalid header constructions or values, etc. Such rules block a significant amount of traffic caused by malicious code, but these rules do not themselves directly block malware from entering or leaving a network. Keep in mind that your firewall can do many things, but it's not a malicious code scanner.

A firewall is also not an intrusion detection system. An intrusion detection system or IDS is a type of network burglar or intruder alarm that detects and responds to unauthorized activity inside your network. An IDS performs this task by monitoring all network traffic. While an IDS can be deployed on a network border or outside the network against the Internet, most IDSs operate inside private networks so that they can watch all internal network traffic.

A firewall can only detect malicious traffic when such traffic enters one of the firewall's interfaces. Firewalls generally don't watch over general interior network activity. Either firewalls are border devices for networks and subnets, or they are software products watching over a single host. In either case, they cannot see the same traffic nor perform the same tasks as an IDS. A firewall, therefore, is not interchangeable with a good intrusion detection system.

Note

IDSs can detect a plethora of unwanted activities, use several methods of detection, and can perform a wide range of responses, both passive and active. You'll find more on IDSs in Chapter 1 in the section, "Common Network Security Components" and in Chapter 15 in the section, "Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)".

A common misconception is that firewalls protect against insider attacks; they cannot. A firewall can be a border device or a firewall can be software on a host. A border firewall can filter traffic entering or leaving a network or subnet. So a border firewall is unable to see any interior traffic (Figure 2-2). When an attacker from an inside client attacks a target that is also an internal host, a border firewall is not part of the communication and thus cannot detect nor block the attack.

A host software firewall can only see the traffic entering or leaving that one host. A host software firewall is unable to see any other interior traffic

Of course, if traffic does not pass through its interfaces, a firewall cannot filter the traffic. A firewall can only filter on what it sees. If malicious or unwanted traffic does not enter an interface of a firewall, the firewall will not be able to filter that traffic (see Figure 2-2). So you'll want to place firewalls on each host, on every border gateway or choke point, and between each significant subnet or interior network division. Another thing firewalls can't do is protect against social engineering. Social engineering is the category of attacks that focus on the personnel of an organization. These attacks get information from people just by asking for it in clever ways or convincing someone to perform an action that breaches network security. The only real protection against social engineering is worker training and awareness. A firewall cannot stop the attack stemming from social engineering.

Figure 2-2. Border firewalls cannot filter internal communications.

A firewall can't protect against the threat posed by removable media. The widespread use of removable media has been a significant threat to every computer in existence, even those not connected to the Internet, an external network, or even a single other computer through a network link. Removable media include USB hard drives, USB thumb drives, CDs, DVDs, Blu-ray discs, HD-DVD discs, other optical discs, flash memory cards, firewire storage devices, tape media, e-mail attachments, and more. Removable media can leak information out of an organization or smuggle malicious code in. A firewall is not involved in the use of removable media nor any of the contents these devices may contain. A firewall cannot protect your network against the ongoing threat posed by removable media. Again, the best defense against this threat is good company policy, worker training, and awareness.

A firewall, of course, cannot protect against physical incursions or attacks. Physical attacks bypass any and all logical and electronic protection mechanisms. A firewall does not protect against theft of devices, planting of eavesdropping mechanisms, disconnection of cables, connecting a rogue notebook to an open node, destruction of equipment, dousing electronics with liquids, building fires, or any other form of physical attack. Only effective physical defenses can deter physical attacks. A firewall is not designed or intended to thwart physical attacks.

Firewalls aren't insurance against inept or ignorant administrators. Computer equipment and software can only do what it's designed and programmed to do. If an administrator mis-configures a security device, the device doesn't automatically compensate for that oversight. If a security administrator fails to learn about all the features and defaults of new equipment, the product cannot secure itself autonomously. Security requires training, research, careful planning, thoughtful implementation, and ongoing review and maintenance. This process is known as security management—and it takes work. The old expression was never more true than today: "Garbage in, garbage out." What you put into network security is precisely what you will get out of it. So remember that a firewall can't compensate for ineptitude or ignorance on the part of administrators.

In the same vein, firewalls can't compensate for poor security management. Proactive security management is essential for the success of any security endeavor. Security management is the process of reviewing, testing, tuning, and updating an organization's security policies and security infrastructure. This is an ongoing effort that requires knowledge, research, and vigilance. The threats and risks facing an organization are constantly evolving to become more persistent and virulent. Your security strategy should be just as rigorous and purposeful in defense. Keeping up to date on the most current threats to and trends in network security is a big part of this job. Networking, conferencing, and reading the latest industry literature are ways to keep yourself and your security efforts sharp.

Keep in mind that a firewall is a focal point of security. It's an embodiment—a physical representation—of your organization's security policy. When you use them well and wisely, firewalls provide reliable and consistent security from external threats. However, firewalls are a tool with limitations and are only part of the complete security strategy. By itself, a firewall cannot protect a network against every threat. A firewall cannot compensate for the lack of informed, state-of-the-art security management.

Furthermore, and this follows from everything we've discussed so far, firewalls are not a substitute for a solid, written security policy. A firewall is nothing but a reliable border sentry. It is not the complete security infrastructure and strategy. Even the decision to deploy a firewall is a significant strategic undertaking that shouldn't be taken for granted. Thorough research and planning will help design and deploy an effective firewall. A firewall policy ensures the success of your network's firewall. A company-wide security policy ensures the success of your organization's security infrastructure. Firewalls are in no way a substitute for such a security policy.

Finally, firewalls are not a perfect solution. As we've noted, a firewall is a border sentry, reliable but limited. A firewall can only filter what it sees. It can only perform filtering according to the rule sets defined by the security administrator. It cannot self-adjust to changing conditions or future threats. A firewall is only a part of a complete security infrastructure. Firewalls are mostly software, even when operating on dedicated hardware. They are software, written by fallible humans; they can, and do, therefore, have bugs and flaws. A firewall is never the perfect solution—but it is part of the solution.

Fortunately, in spite of all the things a firewall is not, a firewall is a solid filtering solution. A firewall can and should protect the borders of networks and individual hosts. No security strategy—or deployment—is complete without properly installed firewalls.

"Who needs a firewall?" Anyone who uses a computer to interact with and exchange resources with any other computer! Your personal computer needs a firewall. Your home network needs firewalls. Your company network needs firewalls. Every network needs firewalls. They are a fundamental of network communication.

High-speed Internet connectivity has become ubiquitous. Most computer users now have high-speed access at home, at work, and even on the go through mobile devices. Often, these broadband connections are always-on connections. This means computers and networks are online all the time—and exposed to attacks. A drawbridge is easy to cross if it's always down. When a system is always connected, it can be the focus of a concerted attempt to discover its vulnerabilities and breach its security.

How likely is it that a computer will be discovered and attacked over the Internet? Almost guaranteed. Most systems are detected, scanned, and probed within minutes of obtaining a public IP address. It is technical suicide to connect your system to the Internet before installing a firewall, as well as installing the latest vendor patches for the hardware, OS, and installed applications.

Does this mean that there are armies of hackers just waiting to find new targets to attack? Unfortunately, yes. Not, however, in the way you might think. Malicious programs perform most of the scanning and attacking automatically. These are commonly known as agents, robots, zombies, or just 'bots. Groups of malicious code, known as botnets, scour the Internet for new victims constantly.

Another wrinkle in being constantly online over a broadband connection is the throughput speed. High-speed links to the Internet enable high-speed attacks against your system. On older, slower connections, the same risks existed, but the attacks were slower or fewer simply because the link to a targeted system throttled the speed of the attack. With 10 Mbps and faster connections common, attacks can occur at near-lightning speed.

This is not to suggest that only slow-speed Internet links are secure. On the contrary, you should take full advantage of high-speed Internet connections. However, you need to protect your systems with firewalls. A firewall will impose a significant barrier to most attacks that originate from the Internet.

With a firewall protecting your system from the Internet, hacker scans will be nearly worthless. Responses to probing packets will be filtered. An outsider will learn little about your infrastructure. This, in turn, means they will discover fewer vulnerabilities, thus wage fewer attacks. And even then, those attacks will more likely fail.

Firewalls are not only used for Internet protection. Don't forget that significant levels of threat exist internally. Firewalls stand guard against network segments inside your private network (Figure 2-3). Think of a firewall as a tool to prevent abuse or misuse of LAN resources. Each major department, subnet, or other relevant distinction within an organization should have firewall protection. This will ensure that accidental compromises, as well as intentional abuses, are minimized internally. All networks protect against both internal threats as well as external ones.

Figure 2-3. An example of a private network using firewalls to securely separate subnets.

Don't overlook that, while a firewall has its origins in routing, you still want to use a dedicated router for routing and a dedicated firewall for filtering. In many cases, the combination or multi-function devices offer lots of features, but not necessarily best of breed performance and efficiency. These may be money-savers for small networks, but they are often cause for expense for larger networks. If a device fails to perform at commercial levels when necessary, the repercussions can cost more than deploying the proper safeguards in the first place.

Firewalls should be used to protect a resource, no matter where that resource resides on your network. A hardware firewall can protect a single host or a network of hosts, while a software firewall can only protect a single host. Don't limit your definition of a firewall to just a border sentry device. Think of it, instead, as a sentry device in general, able to protect anything placed behind its filtering service.

Host firewalls protect a host and protect a network from the host. A host firewall's job is to filter traffic entering or leaving a single computer system. Attacks and malicious traffic can come from the Internet or the local network. A host firewall can protect the host against such threats. However, the host itself could be compromised by malicious code or be controlled by a malicious user. In this situation, the host firewall protects the network from the threats coming from the host.

Another way of looking at this is that a host firewall also protects the network from a user in general. A user is the most risky element in a network infrastructure. Even if every other component, hardware or software, does what it was programmed and configured to do, you can decide to violate security. Thus, the free will of human users is one of the biggest risks to every computing environment.

Users can be ignorant, make mistakes, be tricked by a Trojan horse, be the target of social engineering attacks, and perform malicious actions on purpose. The security of a host system, including general system hardening, anti-malware scanning, Internet client restrictions, blocking of non-approved software, and a host firewall, are all designed to protect the network from the risk of human users.

Firewalls protect against Internet threats, internal network threats, protect resources generally, and protect against the risk of users. These capabilities alone might make installing a firewall on every host and on every segment seem like the obvious follow through.

However, deploying firewalls everywhere has two significant drawbacks: cost and over-dependence. Most commercial grade firewalls are costly. Even if they have no purchase cost, due to promotions or being open source, the ongoing maintenance costs of firewalls add up significantly over time. With firewalls deployed on every host and on every segment, the overhead of firewall management would far exceed the total IT budget of most businesses.

A second drawback to ubiquitous deployment of firewalls is over-dependence. Firewalls are only part of a complete security solution, not a whole solution by themselves. By deploying firewalls on every host and every segment, other essential security endeavors might be overlooked or deemed unnecessary. This would be a disastrous security stance. Firewalls cannot compensate for poor security policy, poor security management, or a lack of proper system hardening.

With these concerns, how can your organization determine how many firewalls to deploy and where to deploy them? In most cases, this requires a process risk assessment and risk management. Risk assessment is a process of examining values, threat levels, likelihoods, and total cost of compromise versus the value of the resource and the cost of the protection. While many other factors affect risk assessment, this essential business and security process is as follows:

In short, if the best cost/benefit for a particular asset-threat is for a firewall, then installing one is a good business, security, and budget decision. If some other countermeasure has a better cost/benefit, then that countermeasure is the better choice.

Performing detailed risk analysis is a complex task. Many small companies or home network enthusiasts might not want to spend the effort to perform a complex risk assessment. This is understandable, but failing to perform a full risk assessment doesn't mean that you have no risk or that you have no assets worth protecting.

At a minimum, you need to protect any and all data that is personally identifiable. This includes personal communications like e-mails, any custom crafted document, picture, video, or other file type, all medical information, all financial information, configuration settings, passwords and other credentials. Identity theft is one of the most frequent and devastating crimes of the interconnected world. Worrying only about your neighbors, the random home burglary, or the pickpocket on the street is nothing short of tunnel vision. Today, you must be concerned about all would-be criminals across the globe attempting to gain access to your electronic assets over the Internet.

Who needs a firewall? Everyone with a networked computer needs a firewall. Why are firewalls necessary? Firewalls are critical because threats and malicious entities lurk on the Internet, on private networks, and possibly within your own home!

A zone of risk is any segment, subnet, network, or collection of networks that represent a certain level of risk. The higher the risk, the more security you need to protect against that risk. The less of a risk associated with a zone, the less security is necessary because the threats of that zone pose less chance of harm.

The flipside of zones of risk is zones of trust. Highly trusted zones naturally require less security, while zones of low trust require more security.

Each zone of risk needs to be clearly and distinctly isolated from any other risk zone, especially if those zones have different levels of risk. The primary tool used to isolate zones from each other is the firewall.

Figure 2-4. An example of a private network with four risk or trust zones.

Most networks have two to four zones of risk. These include the private network, DMZ, extranet, and the Internet. See Figure 2-4. The private network zone has the lowest risk and is the zone of the highest trust. The Internet zone has the highest risk and is the zone with the least trust. A DMZ has less risk than the Internet, but is not as trusted as the private network. A DMZ zone has medium-high risk or medium-low trust. An extranet has more risk than the private network and more trust than the Internet. An extranet zone has medium-low risk or medium-high trust. See Table 2-1.

Your organization's written security policy should define where these zones exist and dictate the security requirements for each zone. Such requirements would include traffic management, use of firewalls, use of VPNs to cross the zone divisions, hardening of systems, malicious code scanning, and so on. Firewalls are likely found at risk zone divisions and may be the best cost/benefit security countermeasure in some circumstances. The next step is to understand what a firewall can do at these points and how it performs these tasks.

Firewalls work along a communication pathway. This can be the gateway point of a network, a choke point within a network, a point of zone transition, or on a host. In these locations, the firewall interrupts the traffic flow to inspect packets or sessions. If the contents are authorized, they continue to their destination. If the contents are not authorized, they are blocked and dropped.

Firewalls operate on a bastion host basis (Figure 2-5). This is most obvious in the case of hardware firewalls, but it's true of host software firewalls, as well. A bastion host firewall stands guard along the pathway of potential attack, positioned to take the brunt of any attack. A firewall acts as the vanguard, as the front line of defense against any attack. A bastion host can also be called a sacrificial host.

In the case of a host software firewall, the firewall will attempt to prevent all malicious interactions to and from the host. In the event that the firewall itself is compromised, it usually disconnects the system from the network. While this is a form of DoS, it's often a preferred fail-safe/fail-secure response over defaulting to an open unrestricted and unfiltered connection. This is especially true if the connection is directly to the Internet. Bastion host deployment is discussed further in Chapter 8.

Figure 2-5. An example of a bastion host firewall deployment.

If the firewall is able to rebuff an attack, then the resources are secure. If the firewall falls due to the attack, it prevents any further communication with the resources behind it. Think of a firewall as a dead-man switch. If the firewall fails or goes offline, so does the connection it was filtering.

The most common function of a firewall is to screen or filter traffic. The firewall checks any packet received on its interface against its rule set to determine whether to forward or drop the packet. As we discovered earlier, firewalls typically function on a deny-by-default, allow-by-exception security policy.

The firewall performs most traffic filtering based on information in a packet or segment header. This can include the IP address of the source and destination, as well as the source and destination port. Some firewalls can also filter or block specific protocols or certain uses of protocols. For example, a firewall could block all streaming media protocols and block just the Internet Control Message Protocol (ICMP) type 3 (destination unreachable) and 11 (timeout exceeded).

Firewalls differentiate between networks or subnets. A firewall serves as a clear and distinct boundary between one network area and another. By positioning a firewall between network divisions or subnets, the network designer and security administrators are using traffic management and control for traffic attempting to cross that intersection. Firewalls serve as boundary devices both on the edge of networks facing the Internet, as well as internally between different divisions within an organization.

Open and unrestricted internal communications might sound like a good idea, but in practice such traffic causes severe degradation of overall infrastructure performance and stability. By preventing or at least limiting communications between certain divisions of an organization, traffic efficiency increases. Additionally, traffic control and management decreases risk.

For example, by blocking communications between the programming group's network and the production network, unapproved versions of software cannot leak out. Additionally, blocking general access to the accounting subnet, the research and development subnet, the DMZ, and the extranet from the production network protects against data leakage, spread of malicious code, and other forms of fraud and abuse.

Firewalls can act as a general filter for malicious activity or as a one-way sieve. As a general filter, a firewall will allow all normal benign traffic to pass through. This is the type of firewall used to protect a DMZ or differentiate subnets within a LAN. A general filter firewall works to stop malicious activities.

A general filter firewall can allow communication using any protocol on any port or to limit communications to specific protocols and ports (amongst other limitations). If only a few specific resources hosted behind the firewall are to be accessed by external users, the firewall can allow access to those specific internal systems based on IP address and port, but block all other inbound requests.

A sieve firewall will only allow traffic to originate from the private or trusted side. A sieve firewall will allow non-malicious responses to return from the public or less-trusted side, but it will generally block or prevent any initiation or inbound communication request from the outside. A sieve firewall typically protects a private LAN or an extranet.

Firewalls can support special inbound authorized connections with the LAN, such as VPN links from telecommuters. This is an important feature for an extranet, as well, since VPN access is often the only method to reach hosted resources through the Internet.

Firewalls can provide port-forwarding services. Port forwarding is a form of static reversal of network translation. In traditional or dynamic NAT or network address translation, external entities cannot initiate communications with internal systems because any packet received by the outside interface of the NAT system will not find a matching mapping in the translation table and therefore drops the packet as invalid.

With port forwarding or static NATing, a translation mapping is coded so that an external IP address and port combination are fixed and redirect traffic to a specific internal system, even if the internal system uses a private IP address. The combination of an IP address and a port number is known as a socket. In Figure 2-6, the external port 208.40.235.38:8081 is forwarded to an internal server's port at 192.168.5.74:80. Port forwarding can also be called static NAT, traffic forwarding, service redirection, reverse proxy, and "punching a hole through the firewall." Port forwarding and reverse proxy are discussed further in Chapter 8.

The alias "punching a hole through the firewall" points out a very important concern: namely, that using port forwarding reduces the effective security provided by the firewall. Without port forward or other similar services, a firewall can rebuff attempts to communicate with internal systems. Using port forwarding, you create a pathway across the primary border sentry. Several hacker exploits can take advantage of port forwarding to reach other internal systems on other ports than what was "allowed" by the port forwarding settings. These attacks are usually variations of fragmentation manipulation and are discussed in Chapter 4 "Network Security Threats and Issues."

Figure 2-6. An example of port forwarding across a NAT or network address translation system.

Managing and controlling traffic is a primary concern and function of firewalls. Only authorized communications are allowed; everything else is blocked. The act of determining what to allow and what to block depends on the filtering features of the firewall. These include packet inspection, connection or state management, stateful inspection, and others. These filtering concepts are defined later in this chapter in the section, "Types of Filtering."

In addition, firewalls can block or filter outbound traffic. This function can block spoofed traffic or anything with an invalid IP address as the destination or source. Specific protocols or ports can be blocked, as well. And of course specific domain names or destination addresses can be blocked.

Firewalls can also filter based on content. The firewall can intercept specific content in a packet leaving the network before it reaches the outside. This could result in the packet being discarded, an entire connection being dropped, or the packet being edited to remove the blocked content and replace it with something else. Content filtering can focus on domain name, URL, filename, file extension, or keywords in the content.

Another capability of firewalls is the ability to filter based on encryption. A firewall can allow encryption without restriction. Or, a firewall can be set to block encryption on some ports and not others. Firewalls can also block encryption from and to all internal IP addresses except for servers, VPN devices, and RAS/NAS. The issue of firewalls and encryption is discussed further in Chapter 7.

Firewalls can perform intermediary functions between hosts where network administrators deem direct communication too risky. This is the basic function of a proxy. A proxy firewall positioned along a communication path can hide the identity of one or both endpoints of a communication from the participants. In most cases, proxy services hide the identities of internal systems from external entities.

Firewalls can perform address conservation through the use of an address conversion or translation system. NAT or network address translation is the most common translation service supported by networks. As discussed in Chapter 1, NAT translates between internal addresses and public external addresses. NAT allows a private network to use the RFC 1918 private IP addresses. This, in turn, provides additional security, since Internet hosts cannot address an RFC 1918 system directly.

Through the combination of all their features, functions, and capabilities, firewalls provide consistent, reliable protection for an organization's computer and electronic resources. But firewalls are not perfect and should not be the sole security component of a network infrastructure. They are only one element—although an essential one—of a network security strategy.

Firewalls can log events. Firewalls can be set to record any action into a log file. In addition, they can record the content of any malicious traffic into a log file. And they can record any abnormal network activity, performance levels, and traffic statistics into a log file. Logging events is an invaluable feature of a firewall. You can learn more about firewall logging and understanding those logs in Chapter 7.

Since perfect security products don't exist, you must rely on monitoring to watch for attempts (and any successes) to breach or violate security. Recall from Chapter 1 that security is locking things down to the best of your ability, and then watching for attempts to breach your defenses. Lock, then watch. A successful security strategy is not possible without both locking and watching. Additionally, most security components should include a locking and a watching aspect to them. Firewalls are no exception. If a proposed firewall product is unable to record a log of its actions and network activities, then you need to seek out a different firewall product. Remember the time-tested business adage: "You get what you inspect, not what you expect."

To fully understand the mechanisms of filtering employed by firewalls, you need a solid understanding of the TCP/IP protocol suite. Thorough knowledge of TCP/IP benefits a security administrator not just in the area of firewall management, but also in routing, switching, maintaining availability, improving network performance, managing network traffic, analyzing protocol, understanding vulnerabilities and exploits, and even performing penetration testing or ethical hacking.

Most networks, including the Internet, use the TCP/IP protocol. As discussed in Chapter 1, the most prevalent version in use is IPv4. However, IPv6 is gaining wider use across the globe. During this transitional period, you should learn about both versions of IP. If you need additional detailed information regarding TCP/IP, please consult:

OSI Model

Most protocol discussions begin with the open system interconnection reference model (OSI model). The OSI model is a standard conceptual tool used to discuss protocols and their functions. The OSI model has seven layers (Figure 2-7). Each layer communicates with its peer layer on the other end of a communication session. While the OSI model is helpful in understanding protocols, most protocols are not in full compliance with it.

Below is a brief description of the OSI model's seven layers. Each layer has unique responsibilities, functions, and features. The OSI model defines what needs to take place at each layer and leaves the actual process of accomplishing those tasks to the protocols and, ultimately, to the protocol programmers.

• Application layer (Layer 7)—This layer enables communications with the host software, including the operating system. The application layer is the interface between host software and the network protocol stack. The sub-protocols of this layer support specific applications or types of data.

• Presentation layer (layer 6)—This layer translates the data received from the host software into a format acceptable to the network. This layer also performs this task in reverse for data going from the network to the host software.

• Session layer (layer 5)—This layer manages the communication channel, known as a session, between the endpoints of the network communication. A single transport layer connection between two systems can support multiple, simultaneous sessions.

• Transport layer (layer 4)—This layer formats and handles data transportation. This transportation is independent of and transparent to the application.

• Network layer (layer 3)—This layer handles logical addressing (IP addresses) and routing traffic.

• Data link layer (layer 2)—This layer manages physical addressing (MAC addresses) and supports the network topology, such as Ethernet.

• Physical layer (layer 1)—This layer converts data into transmitted bits over the physical network medium.

As data moves from a software application for transmission over the network, it traverses the layers of the protocol stack from top to bottom. As each layer receives data from the layer above it, that data becomes the payload with a layer specific header (Figure 2-7). At the Data link layer, where Ethernet resides, the data receives a footer, as well. This process is known as encapsulation. The inverse, known as de-encapsulation, occurs when a network communication is received. As this process takes place, the data set being manipulated receives unique names, depending on the layer it traverses. They are:

technical TIP

Logical addresses, such as IP addresses, create global distinction. At least for public IP addresses, all addresses used on the Internet are unique. Logical address assignment is independent of physical location. Logical addresses enable communications between two hosts, regardless of their physical proximity to each other.

Physical addresses, such as MAC addresses, create local distinction. MAC addresses must be unique only within the local subnet. This enables a distinction between physically proximate systems that are able to receive the same electronic signal. The manufacturer usually performs physical address assignment of the NIC and is thus dependent on the physical hardware component itself.

technical TIP

MAC addresses are dependent on the physical NIC; the manufacturer assigns these as a "permanent" hardware address. However, modifying or spoofing the effective MAC address is usually possible on most systems. MAC changes are possible using native commands, as with Linux, Unix, and Mac OS, or with third party utilities, such as required by Windows. Tools for this include MAC Spoof, MAC Makup, and MAC changer.

Figure 2-7. The process of encapsulation and the names of header and payload sets at each OSI layer.

• Application layer (layer 7)—PDU (payload data unit) (data obtained from the host software application)

• Presentation layer (layer 6)—PDU

• Session layer (layer 5)—PDU

• Transport layer (layer 4)—Segment

• Network layer (layer 3)—Packet

• Data link layer (layer 2)—Frame

• Physical layer (layer 1)—Bits of data

The encapsulation process of adding headers (and a footer at the Data link layer) enables data exchange between layers on different systems. This is known as peer-to-peer communications. The content of a header includes information to be processed by the corresponding layer on the receiving end of a network link.

The content of the headers, mainly from layers 2-4, are the greatest concern and focus of a firewall. Application proxy firewalls and stateful inspection firewalls can also examine the headers and the payload content of layers 5-7. Learn more about the methods of filtering based on this layer information in the section, "Types of Filtering" later in this chapter.

Listing the types of firewalls is almost like listing taxonomy of the animal kingdom in biology. The variations, models, and versions are so numerous. In addition, opinions vary about what is and is not a firewall. Many experts begin the discussion of firewall types by dividing the collective into two simple, main groupings: personal and commercial.

A personal firewall is designed to provide protection to a single system or a small network, such as a SOHO network. To take full advantage of their features, most personal firewalls do not require special training or certification. Most personal firewalls offer user-friendly interfaces that may be Web-based or graphical user interfaced (GUI) in nature.

A commercial firewall is designed to provide protection for a medium-to-large business network. Most commercial firewalls are quite complex and often require special training and certification to take full advantage of their features. Most commercial firewalls use a Unix-like command line interface (CLI) that, while powerful and efficient, is not intuitive.

These two groupings do not, however, represent the complete collective of firewalls properly, as several firewalls could easily fall into either or both categories. Another common grouping method, therefore, is to classify firewalls as either hardware or software.

A hardware firewall is a dedicated hardware device specifically built and hardened to support the functions of the firewall software running on it. A hardware firewall is also known as an appliance firewall. A hardware firewall does not require any additional hardware or software for its use. All it needs is one or more network connections and a power source.

A software firewall is an application installed on a host. A software firewall is also known as a host firewall. A software firewall depends upon the host's hardware and operating system. If the host's components are not properly hardened, the software firewall will be less effective, especially if there are other communication pathways or attack points on the host. Software firewalls must compete for resources among all other processes active on the host. A software firewall is only able to protect a single host from malicious network activity. A software firewall is only able to filter traffic that reaches the network interface of its host.

With these two types of divisions, four potential combinations exist:

A personal software firewall is a product used on individual home systems, on SOHO systems, and even on client/server network work stations and servers. Generally a personal software firewall is free or less expensive than commercial software firewall products. A personal software firewall operates on its own to protect a single host.

A commercial software firewall is a product used on client/server network work stations and servers. While they can be installed onto personal or SOHO systems, they are usually expensive and are part of an overall security management or NAC system. Most commercial software firewalls can be used in an agent/console infrastructure where each host's firewall can be remotely administered from a master management console.

A personal hardware firewall is part of an integrated firewall product, such as a wireless access point or a cable/DSL modem. Another variation of the personal hardware firewall is the re-purposing of a client or server computer into a home-crafted open-source firewall. One example of this is SmoothWall, a hardened bootable Linux-based firewall. You can read a case study of deploying SmoothWall in Chapter 11.

A commercial hardware firewall is usually a device that handles the complexity of larger organizational networks. A commercial hardware firewall is often very expensive, running in the range of $10,000 or more.

The personal and commercial versions of software and hardware firewalls might include different add-ons or enhancements than their commercial equivalents. These add-ons or enhancements include antivirus, password management, registry protection, driver protection, VPN gateways, remote access support, IDS, IPS, spam filtering, and more. Usually these add-ons make the firewall products more attractive to the potential individual buyer. However, most commercial entities would generally avoid integrated firewall solutions in favor of dedicated products to handle their distinct security or management functions. An integrated device might offer easier administration, but it represents a single point of failure for multiple services. Additionally, such bundled solutions are more difficult to troubleshoot due to the complexity of the communications they support.

Another variation of firewall, in fact the original variation, is a screening router. Most appliance routers and many software routers, such as the RRAS (Routing and Remote Access Service) of Windows Server, are able to perform firewall filtering services in addition to routing. Those screening routers that perform firewall filtering might provide enough sentry security for your needs. However, if you want more advanced features, a screening router is unlikely to be the best solution for your network.

Ingress and egress filtering is a common tool for spoof filtering. A source address that comes from the opposite side of the firewall than where it is assigned is obviously a spoofed address. An example of this is when an internal LAN address appears as a source address in a packet on its way in to a network from outside. This form of spoof filtering can be part of ingress filtering.

Likewise, the same process can filter for packets leaving a network. If a packet with a source address from the outside such as an Internet address is received by a firewall from an interface inside the private LAN, this is also a spoofed address. This form of spoof filtering can be part of egress filtering.

Ingress and egress filtering can expand beyond spoofing protection and include a variety of investigations on inbound and outbound traffic. This can include black list and white list filtering, protocol and port blocking, and confirmation of authentication or authorization before communications continue.

Unfortunately, if a packet's spoofed addresses don't violate any of these concerns, the spoofed addresses might not be as easy to detect. For example, if a client spoofs an IP address to look like another client in the same subnet, the rules just described to catch spoofing would fail to notice this spoofed communication.

In addition to basic ingress and egress filtering, firewalls can support additional forms of packet examination and investigation.

Filtering is the primary function of a firewall. Through its filtering services, most of the other benefits and capabilities of firewalls apply. Firewalls can support many different forms of filtering. Additionally, the terms used for the type of filtering and the type of firewall are often used interchangeably. For example, a firewall that supports packet filtering is known as a packet filtering firewall.

A software firewall is an application installed on a host. A hardware firewall is a dedicated hardware device specifically built and hardened to support the functions of the firewall software running on it.

A software firewall is also known as a host firewall. A hardware firewall is also known as an appliance firewall.

A software firewall depends upon the host's hardware and operating system. If the host's components are not properly hardened, the software firewall will be less effective if other communication pathways or attack points on the host exist. A hardware firewall does not require any additional hardware or software for its deployment. All it needs is one or more network connections and a power source.

Software firewalls must compete for resources among all other processes active on the host. A hardware firewall has dedicated hardware resources not shared with any other service.

A software firewall is only able to protect a single host from malicious network activity. A hardware firewall can protect a single system or an entire network

A software firewall is only able to filter traffic that reaches the network interface of its host. A hardware firewall can also only filter traffic that reaches the network interfaces of its appliance. However, a hardware firewall can be positioned on a network at a choke point or gateway to analyze and filter all traffic.

A software firewall and a hardware firewall are both a form of software, but the hardware firewall has a dedicated appliance as its host, while the software firewall uses a standard client or server as its host. In either case, software flaws or bugs in programming can cause the firewall to fail.

A software firewall and a hardware firewall can both be targets of attack. Exploits can compromise their software component or physical attacks can harm their host/appliance.

A software firewall is often less expensive than a hardware firewall. A hardware firewall typically offers a wider range of features and capabilities than a software firewall.

Both software firewalls and hardware firewalls are options you can use throughout a network infrastructure.

Firewalls, specifically hardware appliance firewalls, typically have two or more network interfaces. A firewall with two interfaces is known as a dual-homed firewall, while a firewall with three interfaces is known as a triple-homed firewall or a three-legged firewall.

The benefits of multiple interfaces are that the segments, subnets, or networks connected to each firewall interface are electronically isolated from each other. This prevents unfiltered traffic from leaping from one segment to another in an attempt to bypass firewall filtering.

However, for software firewalls using multiple interfaces, you need to ensure that the TCP/IP protocol feature called IP Forwarding is disabled. IP Forwarding is actually a router rule that allows traffic from one interface to exit another interface without needing to move any further up the protocol static than where IP resides. In many cases, IP Forwarding allows packets to bypass filtering. If the system is to be a firewall, you should disable this feature.

Software host firewalls are most often single-homed firewalls since the host only has a single NIC. This is acceptable, since the software host firewall is not providing sentry services between network segments, but between the host and the network.

While firewalls with four or more interfaces are possible, they are rarely deployed. Such a configuration requires significantly more complex filtering and routing rules to operate effectively. It's also a significant single point of failure and a bottleneck to traffic flow between multiple network segments.

The placement of your network's firewalls depends on several key but subjective factors. No single correct answer or deployment strategy is perfect for everyone. However, several good general guidelines can be of help in planning firewall placement.

First, understand the structure of your network. Where are natural or organizational divisions on the network? Do they correspond to distinct subnets or geographic/physical locations? In many situations, placing a firewall between each division or physical location (even different floors of a building) can be beneficial. Do you have a DMZ or extranet? You will need to isolate these from the private LAN and from the Internet.

Second, know the traffic patterns of your network. What are the common vectors and pathways of communication, both between internal systems and between internal and external systems? Consider positioning firewalls so that they can filter all traffic. This may involve the creation of choke points.

Third, is Internet connectivity essential to business tasks? You should firewall-protect all Internet access points or gateways. In fact, any external gateway or portal should have a firewall.

Fourth, is any form of remote access in use, including wireless? You should position a firewall between each RAS or NAS and the private LAN. Assume all remote and wireless connections are potentially malicious.

Fifth, based on previous compromises, what are the most likely access pathways an internal or external hacker might use to breach your network? Place firewalls along these pathways.

Sixth, does any other unique aspect or feature of your IT infrastructure warrant consideration for firewall protection?

Placing a firewall everywhere mentioned in these guidelines may not be practical, cost effective, or secure. So before any deployment, conduct a risk assessment to determine whether a firewall is the best choice of countermeasure. Review the previous section, "Why Do You Need a Firewall?" for more information on conducting risk assessments.

An essential element of network security, a firewall is a filtering service used to protect your network and hosts from a variety of threats, both internal and external. Several types of firewalls are available, including screening routers, hardware appliances, and host software products. Each of these firewalls can employ one or more features for ingress and egress filtering. The common filtering features include static packet filtering, stateful inspection or dynamic packet filtering, NAT, application proxy, and circuit proxy.