Firewall
Filters traffic between private and public networks.
A firewall is a software-or hardware-based system located at the network gateway that protects the resources of a private network from unauthorized access by users on other networks. They are placed at the junction or gateway between two networks, usually a private network and a public network such as the Internet. Firewalls examine all the messages entering or leaving the intranet and block those that do not meet the specified security criteria. Firewalls may be concerned with the type of traffic or with the source or destination addresses and ports. They include a set of tools that monitor the flow of traffic between networks. A firewall placed at the network level and working closely with the router filters all the network packets to determine whether to forward them toward their destinations. Always install firewalls away from the rest of the network, so that none of the incoming requests can gain direct access to a private network resource. If appropriately configured, the firewall protects systems on one side of it from systems on the other side.
Types
Firewall Technologies
- Packet Filtering Firewall
- Circuit-Level Gateway Firewall
- Application-Level Firewall
- Stateful Multilayer Inspection Firewall
- Application Proxy Concepts
- Network Address Translation
- Virtual Private Network
| Component Function | OSI Layer | Role in Multilayer Inspection |
|---|---|---|
| Packet Filtering | Network Layer (Layer 3) / Transport Layer (Layer 4) | Filters based on individual packet headers, such as source and destination IP Address, port number, and Protocol in use. This is the base layer of inspection. |
| Circuit-Level Gateway | Session Layer (Layer 5) / Transport Layer (Layer 4) | Monitors requests to create sessions and checks the TCP handshake between packets to ensure the requested session is valid. It allows or prevents data streams but typically does not filter individual packets based on content. |
| Application-Level Firewall (Proxy) | Application Layer (Layer 7) | Performs Deep Packet Inspection by evaluating the actual content of the packets at the application layer. This allows it to check against application-specific commands (like HTTP: post and get) and malicious code (like worms) that simple stateful firewalls might miss. |
OSI Layer and Firewall Technologies
The table below summarizes technologies operating at each OSI layer:
| Firewall Technology | Mapped OSI Layers |
|---|---|
| Virtual Private Network (VPN) | Application Layer, Network Layer, Data Link Layer, Physical Layer |
| Application Proxies | Application Layer, Session Layer |
| Circuit-Level Gateways | Session Layer, Transport Layer |
| Packet Filtering Firewall | Network Layer |
| Network Address Translation (NAT) | Network Layer |
| Stateful Multilayer Inspection | Network Layer, Transport Layer |