Lesson 11 - Network Security - Firewall

Firewalls

-Control the flow of network traffic to prevent bad traffic from passing through the network

-Integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system

Firewall Policies

Filter incoming or outgoing traffic through a set of rules

Accepted

Packet is permitted through the firewall

Rejected

Packet is not allowed through the firewall, informs the source that the packet was rejected

Dropped

Packet is not allowed through with no indication of firewall

Blocklist(Deny)

Packets are dropped or rejected only if they fit the rules defined in a blocklist

Safelist(Approved)

Packets are dropped or rejected unless they are specifically allowed by the firewall

Stateless Firewall (Packet Filters)

If packet matches the packets filter’s set of rules, the packet filter will drop or accept it

-Applies rules based on source and destination IP ports

Stateful Filters

Maintains a record of all connections passing through it and can determine if a packet is either the start of a new connection or is an invalid packet

-Only allow inbound TCP packets that are in response to a connection initiated from within the internal network

Application Layer

Examines the data stored at the application layer of inbound and outbound packets, applies rules based on these contents

Modern Firewalls

-Mostly stateful

-Include more layers of network stack to enable filtering

-Go beyond inspecting IP and port numbers, identify traffic flows based on the applications

Tunneling Protocol

Communication between a client and server is automatically encrypted so that useful eavesdropping is infeasible

Secure Shell (SSH)

Provides secure access for users and automated processes, interactive and automated file transfers issuing remote commands

IPsec

Defines a set of protocols to provide confidentiality and authenticity for IP packets in network layer

Transport Mode

Additional IPsec header information is inserted before the data of the original packet, and only the payload of the packet is encrypted or authenticated

Tunnel Mode

A new packet is constructed with IPsec header information, and the entire original packet, including its header, is encapsulated as the payload of the new packet

VPNS

Allows private networks to be safely extended over long physical distances by making use of a public network as means of transport