-: Firewalls.
Firewalls are primarily used to section off
and protect one network from another.
Now, when we talk about firewalls, there's three main types.
There's software-based, hardware-based,
and embedded firewalls.
Software-based firewalls are run as a piece of software
on a host or a server.
In fact, if you're running a Windows server,
those have a built-in Windows Firewall that you can enable.
Hardware firewalls, on the other hand,
are a standalone device that's actually an appliance
that's installed into your network.
It looks like another switch or another router
that goes into your network stack.
The third type of firewall is known as an embedded firewall.
Embedded firewalls work as a single function
out of many on a single device.
So, if you have a small office, home office router
or a unified threat management device,
these are examples of an embedded firewall.
It's one piece of the larger device
that does many different functions.
Firewalls can operate in many different ways.
The first one is packet filtering.
Packet filtering is going to inspect each packet
as it passes through the firewall,
and it'll accept it or reject it
based on the rules that it's been given.
This relies on the firewall's configuration
and the access control list that's been installed.
If I'm running a web server, for example,
I would configure my firewall to allow traffic inbound
on port 80 and port 443
but close all of the other ports
because port 80 gives web traffic,
and port 443 gives secure web traffic,
and so, those are expected to be used.
There are two types of packet filtering,
stateless and stateful.
With stateless packet filtering,
it's simply going to accept or reject packets
based on the IP address
and the port number that was requested.
So, if I'm running a web server
and you requested to come in on port 80,
I would allow that,
but if you requested to come in on port 53,
I would deny it because it's not in my access control list.
Now, a stateful packet filter, on the other hand,
is going to keep track of requests
that leave through the firewall.
So, if I make a request from a host through the firewall,
it will temporarily open up a port number
that I made the request from,
some random high port number like 50,000 or 56,000.
By using stateful packet inspection,
you can almost entirely eliminate IP spoofing as a threat
because the firewall is going to inspect the header
of each packet being received.
It's then going to compare that against what it was expecting
based on the request that recently went out,
and then, it's going to make its accept or reject decisions
based on this additional information.
This is a much more in-depth inspection
than a stateless one does.
Now, NAT filtering is another type of filtering we can do.
This is going to filter traffic according to the port,
whether it's a TCP or UDP port.
This filtering can be done
by simply checking the endpoint connections,
by matching the incoming traffic to the requesting IP,
and by matching the incoming traffic
to the requesting IP address and port.
Now, the next one we have is an application-layer gateway,
or ALG.
This is going to apply security mechanisms
to specific applications such as FDP or Telnet.
Now, instead of blocking traffic
based on the Telnet port of port 23,
instead, it's going to inspect each packet
and determine which application it was meant for,
and if it finds out that it was meant for Telnet,
it would block it because that was unauthorized.
This is a resource-intensive process,
but it is a powerful layer of security
that can be added on into your network.
These are also known as Layer 7 firewalls
because they operate at the application layer.
The next type of firewall we have
is a circuit-level gateway,
which works at the session layer of the OSI model
and applies security mechanisms
when a TCP or a UDP connection is first established.
Now, once that connection is established,
the packets can then be sent or received
without any further inspection or checks
because all of that was done
during the session establishment.
Another thing we can do is use MAC filtering,
and we use MAC filtering,
this is going to filter out computers
and prevent them from accessing beyond the firewall
based on their MAC addresses.
This is used as part of your local area network
before it gets out into the routing
and Layer 3 logical addresses
that go out beyond the network.
All of these things can be configured based upon rules
set up in the firewall's access control list.
In an access control list,
you can either explicitly allow, explicitly deny,
or implicitly deny traffic
that's sent or received through the firewall.
When I talk about an explicit allow,
this means that traffic should be allowed
to enter or leave the network
because the rule allows for it to happen.
For example, if I have a rule like this one,
allow TCP 10.0.0.2 any port 80,
this is saying that with the host
that has an IP address of 10.0.0.2,
it can send packets out of the network
to any IP address it wants
as long as it's requesting that over port 80,
which is used for web browsing normally.
Firewall rules are normally read
as an action to be performed, allow or deny,
the type of traffic, TCP or UDP,
the IP source, the IP destination,
and the port that's concerned.
Now, if I'm going to use an explicit deny,
this means that traffic should not be allowed
to enter or leave the network because this rule says so.
For example, if I have a rule like
deny TCP any any port 23,
this would deny any devices on my network
from sending information to any devices
outside of my network over port 23,
and this should effectively block Telnet.
Now, what happens if I don't explicitly allow
or explicitly deny something?
Well, depending on your firewall,
it may implicitly allow it or implicitly deny it.
Now, I would like to add a rule
that implicitly denies anything
to ensure that we always have the best security.
I only want things allowed that I have explicitly allowed.
So, basically, when a firewall ACL is being processed,
it processes the traffic from the first rule
all the way down to the last rule.
As soon as it finds a matching rule,
it processes that rule and stops going the rest of the way,
so for an implicit deny,
I would just simply add a statement at the bottom of the ACL
that blocks everything else
that has not already been blocked
by one of our previous rules.
This might look like something like
deny TCP any any port any.
Essentially, I like to think of the ACL
as somebody standing at the door to a building with a list,
and that list has two sides to it.
It has the allowed people and the denied people.
As you come up to the door, if your name isn't on the list,
they don't find it on the allowed or the denied,
then we're implicitly going to say you can't get in,
but if I see that your name is on the allowed list,
I'm going to let you in,
and if I see your name is on the denied list,
I'm definitely not going to let you in.
That's the idea here when we start talking about
explicit allow, explicit deny, and implicit deny.
Most newer firewalls are set to implicitly deny
by default now,
so the statement may not be needed
on your particular firewall,
but if you're in doubt,
there is no harm in adding this implicit deny
at the end of your ACLs
to ensure that things are going to be blocked by default,
and you're only allowing in
what you explicitly allow it to be
with that rule inside the ACL.
Now, when firewalls first became popular to use,
they operated pretty much at the Layer 3 or Layer 4.
This means that they would block based on IP addresses
or IP addresses and ports.
More recently, though, application firewalls
have begun rising in popularity.
These application firewalls operate at Layer 7
of the OSI model, the application layer,
and this makes traffic control decisions
based on the applications being used,
things like FTP, HTTP, Telnet, and others.
As time continues to move on,
firewalls are continuing to advance their capability
to control traffic in even more complex ways.
This is always going to help us increase our security
because we can dial in even more specifically
what we're trying to block and what we're trying to allow.
Now, one modern type of firewall you may come across
is known as a web application firewall, or WAF.
A web application firewall is installed on a server
in your environment,
and it provides traffic control in the data
that's being sent to and from your web applications.
These are useful in helping to mitigate threats
like cross-site scripting and SQL injection attacks
because these web application firewalls
are designed to specifically look
for these type of threats and block them.
As you see, there are lots of different types of firewalls
and lots of ways to implement them,
but the key is you want to make sure
that you're telling them what they're allowed
and what they're supposed to be blocking
because this will help you have a more secure network
as you move forward.