Cyberstudy
PDF p.132 In progress

Firewalls

Open PDF at p.132 23 flashcards

Summary

PDF p.132

A firewall is a preventive control designed to enforce policies on traffic entering and exiting a network zone. It can be configured using access control lists (ACLs) to filter packets based on IP addresses, protocols, and port numbers. Firewalls can be implemented as hardware appliances or software and can be placed at various points in the network to protect different zones.

In plain words

Supplementary — not from your PDF

A packet filtering firewall uses an ACL to check packet headers (source and destination IP, protocol, and ports), then accepts, drops (silently) or rejects (with an ICMP reply) each packet. Appliance firewalls can be routed (layer 3, between subnets), bridged (layer 2) or inline (layer 1). The bridged and inline modes are transparent, so you don't have to readdress hosts.

Detailed explanation

PDF p.132
  • Packet Filtering
    • Access Control List (ACL): Group of rules defining data packet types and actions.
    • Inspection: Headers of IP packets are inspected.
    • Rules
      • IP Filtering: Based on source and/or destination IP address.
      • Protocol ID/Type: Identifies protocol (e.g., TCP, UDP, ICMP).
      • Port Filtering/Security: Based on source and destination TCP/UDP port numbers.
    • Actions
      • Accept/Permit: Allows packet to pass.
      • Drop/Deny: Silently discards the packet.
      • Reject: Blocks packet and responds with an ICMP message (e.g., "port unreachable").
  • Firewall Device Placement and Attributes
    • Implementation: Hardware appliances or software on general computing hosts.
    • Placement
      • Network Edge/Zonal Borders: Protects network segments.
      • Individual Hosts: Protects specific devices.
    • Types of Appliance Firewalls
      • Routed (Layer 3)
        • Function: Performs forwarding between subnets.
        • Interfaces: Each connects to a different subnet, configured with IP and MAC addresses.
      • Bridged (Layer 2)
        • Function: Inspects traffic between two nodes (e.g., router and switch).
        • Interfaces: Configured with MAC addresses, not IP addresses.
      • Inline (Layer 1)
        • Function: Acts as a cable segment.
        • Interfaces: No MAC or IP addresses, traffic is blocked or forwarded.
    • Transparent Modes
      • Definition: Bridged and inline modes, no need to reconfigure subnets or IP addresses.
      • Use Case: Deploying a firewall without changing host IP addresses.
    • Management Interface
      • Transparent Firewall: Needs an additional interface with an IP address.
      • Routed Firewall: Can have a dedicated management interface or accept management traffic on any interface.
  • Router Firewalls
    • Definition: Implements filtering as part of router firmware.
    • Example: SOHO Internet routers/modems with built-in firewalls.

Important terms

taken from the text above
Access Control List (ACL)
Group of rules defining data packet types and actions.
Inspection
Headers of IP packets are inspected.
IP Filtering
Based on source and/or destination IP address.
Protocol ID/Type
Identifies protocol (e.g., TCP, UDP, ICMP).
Port Filtering/Security
Based on source and destination TCP/UDP port numbers.
Accept/Permit
Allows packet to pass.
Drop/Deny
Silently discards the packet.
Reject
Blocks packet and responds with an ICMP message (e.g., "port unreachable").
Network Edge/Zonal Borders
Protects network segments.
Individual Hosts
Protects specific devices.
Interfaces
Each connects to a different subnet, configured with IP and MAC addresses.
Transparent Modes
Bridged and inline modes, no need to reconfigure subnets or IP addresses.
Transparent Firewall
Needs an additional interface with an IP address.
Routed Firewall
Can have a dedicated management interface or accept management traffic on any interface.
Router Firewalls
Implements filtering as part of router firmware.
ACL Access Control List

Examples & real-world scenarios

Supplementary — not from your PDF
  • A rule allowing TCP 443 to the web server and denying everything else.
  • A SOHO router with a built-in firewall.
  • A transparent bridged firewall added without changing any host IPs.

Scenario

An admin wants blocked connection attempts to fail quietly rather than tell the sender a port exists. They choose drop, not reject, because reject sends back an ICMP 'port unreachable'.

Common mistakes

Supplementary — not from your PDF
  • Mixing up drop (silent) and reject (sends a response).
  • Forgetting that a transparent firewall still needs a management interface with an IP address.

Practical skills

Supplementary — not from your PDF
  • Read a simple ACL and predict what each packet will do.
  • Choose a routed or transparent firewall mode.

What I should remember

Key Points PDF p.132
  • Packet Filtering
    • ACL: Defines rules for packet types and actions.
    • Inspection: IP headers.
    • Rules: IP filtering, protocol ID/type, port filtering.
    • Actions: Accept, drop, reject.
  • Firewall Device Placement and Attributes
    • Implementation: Hardware or software.
    • Placement: Network edge, zonal borders, individual hosts.
    • Appliance Firewalls
      • Routed: Layer 3, subnets, IP/MAC addresses.
      • Bridged: Layer 2, nodes, MAC addresses.
      • Inline: Layer 1, cable segment, no addresses.
    • Transparent Modes: Bridged, inline, no subnet/IP reconfiguration.
    • Management Interface: Transparent needs additional IP interface, routed can have dedicated or any interface.
  • Router Firewalls
    • Definition: Filtering in router firmware.