Packet Filtering Firewall

In a packet filtering firewall, each packet is compared with a set of criteria before it is forwarded.

• Depending on the packet and the criteria, the firewall can drop the packet and transmit it or send a message to the originator.
• The rules can include the source and the destination IP address, the source and the destination port number, and the protocol used.
• It works at the internet layer of the TCP/IP model or the network layer of the OSI model.

Packet filtering firewalls focus on individual packets, analyzing their header information to determine the correct direction. Traditional packet filters make decisions based on the following packet information:

• Source IP address: Used to check whether the packet is coming from a valid source. The source IP address can be found in the IP header of the packet.
• Destination IP address: Checks if the packet is going to the correct destination and if the destination accepts these types of packets.
• Source TCP/UDP port: Used to check the source port of the packet.
• Destination TCP/UDP port: Used to monitor the destination port regarding the services to be allowed or denied.
• TCP flag bits: Used to check whether the packet has SYN, ACK, or other flags set for the connection to be made.
• Protocol in use: Used to check whether the protocol that the packet is carrying should be allowed.
• Direction: Used to check whether the packet is entering or leaving the private network. (Inbound / Outbound)
• Interface: Used to check whether the packet is coming from an unreliable zone.

A Packet Filtering Firewall is a fundamental type of firewall that operates primarily by examining individual network packets against a defined set of criteria to control the flow of data traffic.

This type of firewall operates at the Network Layer (Layer 3) of the OSI model or the Internet layer of the TCP/IP model.

I. Mechanism and Operation

1. Packet Examination: A packet filtering firewall compares each packet crossing the boundary against a set of predetermined criteria or rules before forwarding, dropping, or transmitting a message.
2. Filtering Decision: Based on the packet and the established criteria, the firewall decides whether to drop the packet or transmit it. If the packet passes the test defined by the rules, it is allowed to pass; otherwise, it is rejected.
3. Efficiency: Packet filters are highly efficient, holding up each packet for only a few milliseconds while inspecting the headers before applying rules. They are also generally inexpensive and often built into most routers.
4. Configuration: Packet filtering is the technique employed by Network-based Firewalls. This type of firewall is designed to protect the private Local Area Network (LAN).

II. Criteria for Filtering

Traditional packet filtering firewalls make decisions based solely on the header information contained in individual packets. These criteria include:

III. Limitations and Exploitation

Packet filtering firewalls, despite their common use, have several notable limitations that can be exploited by attackers:

• Statelessness: Packet filtering is inherently stateless. It examines each packet in isolation, without considering the packets that came before or those that may follow in a session. This limitation can be exploited by hackers.
• Trusting the Header: This type of firewall generally trusts that the packets themselves are legitimate when reporting their source and destination.
• Vulnerability to Spoofing: Attackers can exploit the trust placed in headers by using IP spoofing to insert fake IP addresses into packets sent to the network, bypassing filters designed to check for legitimate sources.
• Vulnerability to Fragmentation: Attackers can use Packet Fragmentation techniques to split the TCP header into multiple packets to evade the filter. If the filtering router examines only the first fragment, the attack may succeed. For example, the SYN/FIN scanning using IP fragments method was developed specifically to split the TCP header to evade the packet filter.
• Lack of Application Awareness: Packet filters do not examine traffic at the Application Layer. They cannot filter traffic based on specific application commands (like HTTP: post or get). They are also unable to defend against attacks that bypass filtering by using a particular source port or source routing methods.
• Evasion using ACK Packets: Traditional packet-filtering firewalls often assume malicious code is likely present only in the SYN packet. They filter ACK packets less rigorously to reduce workload, allowing attackers to perform ACK Tunneling by injecting malicious payloads into ACK packets.

IV. Defensive Context

Packet filtering firewalls can be bypassed by spoofing techniques. Countermeasures suggested in the sources include:

• Custom Rules: Use a custom rule set to lock down the network and block unwanted ports.
• Input Filtering: Filter incoming packets that appear to come from an internal IP address (Ingress Filtering).
• Blocking Exploitation: Ensure that filtering mechanisms cannot be bypassed using Source Port Manipulation or Source Routing methods.
• Enhanced Firewalls: For better protection, packet filtering functionality is often combined with other techniques in advanced firewalls:
  • Stateful Multilayer Inspection Firewalls use packet filtering but overcome its limitations by performing deep packet inspection and remembering prior packets.
  • Web Application Firewalls (WAFs) are specifically required to defend against application-layer attacks like SQL injection, which standard packet filtering firewalls cannot stop.
• IPsec: Although IPsec runs on the network layer, its packets often use UDP as a transport protocol to get through firewalls.