Firewalls and VPNs

1. Firewalls

1.1 Concept of Firewalls

  • Firewalls act as barriers to prevent specific types of information from passing between an untrusted network (outside world) and a trusted network (inside world).

  • Can be implemented as:

    • Separate computer systems.

    • Software services on existing routers or servers.

    • Separate networks with supporting devices.

1.2 Categories of Firewalls

1.2.1 By Processing Modes

  • Packet Filtering: Analyzes packet headers based on IP addresses and ports.

  • Application Gateways: Proxy servers that filter messages at the application level.

  • Circuit Gateways: Operate at the transport layer, creating tunnels for certain traffic.

  • MAC Layer Firewalls: Operate at the Media Access Control layer, considering the identity of the host in filtering.

1.2.2 By Development Era

  • First Generation: Static packet filtering firewalls.

  • Second Generation: Application-level firewalls or proxy servers.

  • Third Generation: Stateful inspection firewalls that track connection states.

  • Fourth Generation: Dynamic packet filtering that adapts to network events.

  • Fifth Generation: Kernel proxies operating under the OS kernel.

1.2.3 By Deployment Structure

  • Most firewalls are appliances, self-contained systems:

    • Commercial-grade systems consist of firewall applications on general-purpose computers.

    • SOHO (Small Office/Home Office) firewalls are basic equipment to connect to networks.

1.2.4 By Architectural Implementation

  • Packet Filtering Routers: Used as interfaces to the internet, they can reject unwanted packets but lack auditing capabilities.

  • Screened Host Firewalls: Combine packet filtering with dedicated proxy servers, reducing internal traffic load.

  • Dual-Homed Host Firewalls: Have two NICs, one for internal and another for external networks, using NAT for security.

  • Screened Subnet Firewalls: Incorporate DMZs for external connections, protecting internal networks from outside threats.

1.3 Firewall Configuration and Management

  • Must establish configuration rules for each device, balancing security with operational performance.

  • Best practices include ensuring traffic from trusted networks is allowed out and restricting direct public access to firewall devices.

2. Virtual Private Networks (VPNs)

2.1 Concept of VPNs

  • Provides private and secure connections over unsecured networks, extending organizational networks to remote locations.

2.2 Key Functions of VPNs

  • Encapsulation: Incoming and outgoing data is encapsulated.

  • Encryption: Data is encrypted for security.

  • Authentication: Remote users and computers are authenticated.

2.3 VPN Modes

2.3.1 Transport Mode

  • Only the data content is encrypted, not the header information, allowing direct secure connections to remote hosts.

2.3.2 Tunnel Mode

  • Utilizes encryption points (tunnel servers) that secure all traffic, hiding the true destination of the data, e.g., Microsoft's ISA Server.

3. Summary

  • Firewalls are essential for controlling network traffic and managing security. They are categorized based on processing modes, development era, deployment structure, and architectural implementation. VPNs extend secure internal networks over public infrastructures, employing encapsulation, encryption, and authentication to ensure security.