Firewalls

Firewalls are hardware and/or software designed to prevent unauthorized access to or from a private network.

Firewalls examine all messages entering or leaving the Intranet and blocks those that do not meet the specified security criteria.

They are placed at junction or gateway between the two networks, which is usually a private network and a public network such as the internet.

Firewalls may be concerned with the type of traffic or with the source or destination addresses and ports.

How Firewall Protect From Following Risk

Firewalls try to categorize the network into different portions. One portion is considered as trusted portion of internal LAN. public internet and interfaces connected to are considered as an untrusted portion. Similarly, servers accessed by untrusted entities are placed in a special segment known as a demilitarized Zone (DMZ). By allowing only specific access to these servers, like port 90 of the web server, firewall hide the functionality of network device which makes it difficult for an attacker to understand the physical topology of the network.

One of the interesting features of the dedicated firewall is thier ability to inspect the traffic more than just IP and port level. By using digital certificates, Next Generation Firewalls available today can inspect traffic up to layer7. A Firewall can also limit the number of established as well as half-open TCP/UDP connections to mitigate DDOS attacks.

By implementing local AAA or by using ACS/ISE servers, the firewall can permit traffic based on AAA policy.

By integrating IPS/IDS modules with firewall, malicious data can be detected and filtered at the edge of the network to protect the end-users.

Firewalls Architecture

1, Bastion Host

Basition Host is a Computer system that is placed in between public and private network. It is intended to be the crossing point where all traffic is passed through. Certain roles and responsibilities are assigned to this computer to perform. Bastion Host has two interfaces, one connected to the public network while the another is connected to the private network.

2, Screened Subnet

Screened Subnet can be set up with a firewall with three interfaces. These three interfaces are connected with the internal private network, Public network, and Demilitarized Zone (DMZ). In this architechture, each zone is seperated by another zone hence compromize of one zone will not affect another zone.

3, Multi-Homed Firewalls

Multi-Homed firewall referred to two or more networks where each interface is connected to its network. It increases the efficiency and reliability of a network. A firewall with two or more interfaces allows further subdivision.

— — — — — — — — — — — — — — — — — —

Originally published at https://exploitbyte.com on October 31, 2019.