Scribd Logo
Upload

Welcome to Scribd!

  • 10 7 Firewalls Ink

    Uploaded by

    amjadsadozai
    28 views14 pages
    Firewalls are used to restrict network connectivity and protect hosts by only allowing intended traffic while blocking unwanted traffic. They act as a boundary between internal networks and the internet, implementing packet filtering rules to either accept or deny packets based on criteria like ports, protocols, and IP addresses. Firewall design involves translating high-level security policies into specific packet filtering rules. Stateless firewalls use static rules while stateful firewalls can track packet exchanges. Application layer firewalls inspect packet content and emulate higher network layers. Firewalls are typically placed around the boundary between internal and external networks.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    Firewalls are used to restrict network connectivity and protect hosts by only allowing intended traffic while blocking unwanted traffic. They act as a boundary between internal networks and the internet, implementing packet filtering rules to either accept or deny packets based on criteria like ports, protocols, and IP addresses. Firewall design involves translating high-level security policies into specific packet filtering rules. Stateless firewalls use static rules while stateful firewalls can track packet exchanges. Application layer firewalls inspect packet content and emulate higher network layers. Firewalls are typically placed around the boundary between internal and external networks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    28 views14 pages

    10 7 Firewalls Ink

    Uploaded by

    amjadsadozai
    Firewalls are used to restrict network connectivity and protect hosts by only allowing intended traffic while blocking unwanted traffic. They act as a boundary between internal networks and the internet, implementing packet filtering rules to either accept or deny packets based on criteria like ports, protocols, and IP addresses. Firewall design involves translating high-level security policies into specific packet filtering rules. Stateless firewalls use static rules while stateful firewalls can track packet exchanges. Application layer firewalls inspect packet content and emulate higher network layers. Firewalls are typically placed around the boundary between internal and external networks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 14

    Computer Networks

    Firewalls (8.6.2)
    David Wetherall (djw@uw.edu) Professor of Computer Science & Engineering

    Topic
    Firewalls
    Protecting hosts by restricting network connectivity

    Internet

    Computer Networks

    Motivation
    The best part of IP connectivity
    You can send to any other host

    The worst part of IP connectivity


    Any host can send packets to you! Theres nasty stuff out there
    Internet

    Computer Networks

    Goal and Threat Model


    Goal of firewall is to implement a boundary to restrict IP connectivity:
    You can talk to hosts as intended Trudy cant talk to you over network
    Ideal

    Internet Good packets


    Computer Networks

    Bad packets
    4

    Recall Middleboxes
    Sit inside the network but perform more than IP processing on packets to add new functionality
    NAT box, Firewall / Intrusion Detection System
    App TCP IP 802.11
    Computer Networks

    Middlebox
    App / TCP

    App TCP

    IP

    IP

    IP

    IP

    IP 802.11
    5

    802.11 Ethernet

    Ethernet 802.11

    Firewall as Middlebox
    App TCP IP 802.11
    App / TCP

    IP IP 802.11 Ethernet

    App TCP IP
    Ethernet

    Firewall

    Organization
    Computer Networks

    Internet
    6

    Operation
    Firewall has two sides:
    Internal (organization) and external (Internet)

    For each packet that tries to cross, decide whether to:


    ACCEPT = pass unaltered; or DENY = discard silently Decision is a local policy; firewall centralizes IT job
    Internal (Organization)
    ACCEPT DENY

    External (Internet) Firewall

    Computer Networks

    Design
    Key tension:
    How to translate desired policies into packet filtering rules

    Policies are high-level statements


    Relate to usage of apps, content

    Packet filtering is low-level


    Limited viewpoint in the network, e.g., no app messages, encryption
    Computer Networks 8

    Design (2)
    Stateless firewall
    Simplest kind of firewall Implements static packet filter rules Typically using TCP/UDP ports E.g., deny TCP port 23 (telnet) Can allow/disallow many types of services and destinations

    Computer Networks

    Design (3)
    Stateful firewall
    A step up from stateless Implements stateful packet filter rules that track packet exchanges NAT example: accept incoming TCP packets after internal host connects

    Computer Networks

    10

    Design (4)
    Application layer firewall:
    Another step up Implements rules based on app usage and content E.g., inspect content for viruses Tries to look beyond packets by emulating higher layers, e.g., by reassembling app messages
    Computer Networks 11

    Deployment
    Firewall is placed around internal/external boundary
    Classic setup includes DMZ (DeMilitarized Zone) to put busy Internet hosts on the outside for better separation

    Computer Networks

    12

    Deployment (2)
    Various device options:
    Specialized network firewall Firewall in boundary device, e.g., AP Firewall as part of host, e.g., in OS

    Tradeoff:
    Centralizing simplifies IT job Distributing improves protection, visibility into apps, and performance
    Computer Networks 13

    END
    2013 D. Wetherall
    Slide material from: TANENBAUM, ANDREW S.; WETHERALL, DAVID J., COMPUTER NETWORKS, 5th Edition, 2011. Electronically reproduced by permission of Pearson Education, Inc., Upper Saddle River, New Jersey
    Computer Networks 14

    You might also like