In computing, a firewall is a piece of hardware and/or software
which functions in a networked environment to prevent some
communications forbidden by the security policy, analogous to the
function of firewalls in building construction. A firewall is also
called a Border Protection Device (BPD), especially in NATO
contexts, or packet filter in BSD contexts. A firewall has the
basic task of controlling traffic between different zones of trust.
Typical zones of trust include the Internet (a zone with no trust)
and an internal network (a zone with high trust). The ultimate goal
is to provide controlled connectivity between zones of differing
trust levels through the enforcement of a security policy and
connectivity model based on the least privilege principle.
Proper configuration of firewalls demands skill from the
administrator. It requires considerable understanding of network
protocols and of computer security. Small mistakes can render a
firewall worthless as a security tool.
Types of firewalls
There are three basic types of firewalls depending on:
* Whether the communication is being done between a single node and
the network, or between two or more networks.
* Whether the communication is intercepted at the network layer, or
at the application layer.
* Whether the communication state is being tracked at the firewall
or not.
With regard to the scope of filtered communications there
exist:
* Personal firewalls, a software application which normally filters
traffic entering or leaving a single computer.
* Network firewalls, normally running on a dedicated network device
or computer positioned on the boundary of two or more networks or
DMZs (demilitarized zones). Such a firewall filters all traffic
entering or leaving the connected networks.
The latter definition corresponds to the conventional, traditional
meaning of "firewall" in networking.
In reference to the layers where the traffic can be intercepted,
three main categories of firewalls exist:
* Network layer firewalls. An example would be iptables.
* Application layer firewalls. An example would be TCP
Wrapper.
* Application firewalls. An example would be restricting ftp
services through /etc/ftpaccess file
These network-layer and application-layer types of firewall may
overlap, even though the personal firewall does not serve a
network; indeed, single systems have implemented both
together.
There's also the notion of application firewalls which are
sometimes used during wide area network (WAN) networking on the
world-wide web and govern the system software. An extended
description would place them lower than application layer
firewalls, indeed at the Operating System layer, and could
alternately be called operating system firewalls. Some firewalls
have higher privileges than others like mysql and pj.
Lastly, depending on whether the firewalls track packet states, two
additional categories of firewalls exist:
* Stateful firewalls
* Stateless firewalls
[edit]
Network layer firewalls
Main article: network layer firewall
Network layer firewalls operate at a (relatively) low level of the
TCP/IP protocol stack as IP-packet filters, not allowing packets to
pass through the firewall unless they match the rules. The firewall
administrator may define the rules; or default built-in rules may
apply (as in some inflexible firewall systems).
A more permissive setup could allow any packet to pass the filter
as long as it does not match one or more "negative-rules", or "deny
rules". Today network firewalls are built into most computer
operating systems and network appliances.
Modern firewalls can filter traffic based on many packet attributes
like source IP address, source port, destination IP address or
port, destination service like WWW or FTP. They can filter based on
protocols, TTL values, netblock of originator, domain name of the
source, and many other attributes.
[edit]
Application-layer firewalls
Main article: application layer firewall
Application-layer firewalls work on the application level of the
TCP/IP stack (i.e., all browser traffic, or all telnet or ftp
traffic), and may intercept all packets traveling to or from an
application. They block other packets (usually dropping them
without acknowledgement to the sender). In principle, application
firewalls can prevent all unwanted outside traffic from reaching
protected machines.
By inspecting all packets for improper content, firewalls can even
prevent the spread of the likes of viruses. In practice, however,
this becomes so complex and so difficult to attempt (given the
variety of applications and the diversity of content each may allow
in its packet traffic) that comprehensive firewall design does not
generally attempt this approach.
The XML firewall exemplifies a more recent kind of
application-layer firewall.
[edit]
Proxies
Main article: Proxy server
A proxy device (running either on dedicated hardware or as software
on a general-purpose machine) may act as a firewall by responding
to input packets (connection requests, for example) in the manner
of an application, whilst blocking other packets.
Proxies make tampering with an internal system from the external
network more difficult and misuse of one internal system would not
necessarily cause a security breach exploitable from outside the
firewall (as long as the application proxy remains intact and
properly configured). Conversely, intruders may hijack a
publicly-reachable system and use it as a proxy for their own
purposes; the proxy then masquerades as that system to other
internal machines. While use of internal address spaces enhances
security, crackers may still employ methods such as IP spoofing to
attempt to pass packets to a target network..
[edit]
Network address translation
Firewalls often have network address translation (NAT)
functionality, and the hosts protected behind a firewall commonly
use so-called "private address space", as defined in RFC 1918.
Administrators often set up such scenarios in an effort (of
debatable effectiveness) to disguise the internal address or
network.
[edit]
Management
The Middlebox Communication (midcom) Working Group of the Internet
Engineering Task Force is working on standardizing protocols for
managing firewalls and other middleboxes. See, e.g., Middlebox
Communications (MIDCOM) Protocol Semantics.
[edit]
Implementations
* Software
o Astaro Security Linux
o MCS Firewall - [1]
o Check Point VPN-1 (formerly Firewall-1)
o SC Gauntlet (discontinued, but still in use)
o ipchains
o Iptables
o IPFilter (ipf)
o ipfw
o Microsoft Internet Security and Acceleration (ISA) Server
o Netfilter/iptables
o PF
o WinGate Proxy / NAT Firewall
o PORTUS-APS
* Free software
o ZoneAlarm
* Appliances
o ActionTEC (a DSL Modem packaged by Qwest with new DSL customer
orders)
o Celestix MSA Series
o Cisco PIX and Cisco ASA
o CyberGuard
o Global Technology Associates, Inc.
o NetASQ
o DataPower
o Juniper NetScreen
o Lightning MultiCom VPN Firewall - [2]
o Lucent VPN Firewall - [3]
o Nortel Stand-alone and Switched Firewall - [4]
o Phion NetFence
o PORTUS-APS Appliance
o PresiNET VPN/Network Visibility - [5]
o Sarvega
o Sidewinder and Sidewinder G2
o SofaWare Technologies
o SonicWall
o Watchguard
o MultiTech Systems - RouteFinder
* Free software distributions (that allows you to reuse your old
computer as a firewall)
o Endian Firewall (GPL)
o IPCop (GPL)
o m0n0wall (BSD-style license)
o pfSense (BSD-style license) (m0n0wall fork)
o Devil-Linux (GPL)
o SmoothWall Express (GPL)
o eBox Platform (GPL)
o BrazilFW Firewall and Router (GPL) - Formerly Coyote Linux - This
runs from a floppy disk or hard disk, and is configured through a
Windows or Linux program.
* Personal firewalls see that article
http://en.wikipedia.org/wiki/Firewall_%28networking%29
