-: In this demonstration, we're going to explore
a basic small office, home office network firewall.
In this example, I'm going to use a typical router
switch access point combination device
manufactured by Netgear and marketed
as a wireless router N300 model.
Now, this is probably very similar
to what most of you are using
in your small office or home office environments.
Your interface and settings on your firewall
are going to look a little different than mine,
but it's still going to give you the same general idea
of what kind of options there are
and how you can configure one of these firewalls
at your network boundary.
So, on the screen you can see the basic
web-based access for this wireless router,
wireless access point combination device.
Now, on mine, I'm going to go to security,
which is where the firewall is located
and it's under block services
on this particular router.
Now, usually, most of these small office,
home office routers are going to have a very
weak type firewall and they hide it
by calling it something else
instead of calling it a firewall.
So, it'll be called block sites,
block services, block ports, something of that nature.
So, in this case, it's block services
and I can do it based on a schedule
so I only want it to be done
at certain times in the day or always.
Let's say I want to block something like Telnet.
I'm going to always block it, I'm going to add a block,
and the block I want to use is going to be a service,
and go down to Telnet.
Now, it automatically knows that Telnet is port 23,
so it's going to block port 23 for me.
It's called Telnet because this is a pre-defined one,
and then I can block it for all IP addresses
in this network, or only certain IP addresses
or a certain range.
So, maybe I want to block it for everything for Telnet.
That's fine, we can go ahead and add that to our list.
Now, if we want to add something else,
let's say I have another rule.
In this case, I want to block port 666
because maybe there's a game
I don't want my kids playing on that.
So, I'll block it as port 666.
I'm going to make it TCP, UDP, or both.
I'm going to say both in this case.
And I'm just going to call it game.
And then I can block it for an IP range.
Maybe I don't want it to be accessed by my kids,
which all have their devices in the 10.0.0.2
and 10.0.0.10 range.
If I do that, I can go ahead and hit add,
and again that adds another rule to the firewall
where we are blocking port 666 over that range of IPs.
Now, you can see how this works
as you can add or delete different rules.
Then, I can go through and I can do another one.
Let's say I want to block the ftp server.
So, I will just go through here,
and say user defined, port 20 through port 21,
because that is the connection port
and the data ports for ftp.
And then we'll give it a name of ftp.
And we can do it for all IP addresses
in this range so nobody can access ftp server.
That's the idea of how this firewall works.
And you can do it, in this case, it's blocking
the outbound connections because it's preventing
us from sending things out to the Internet.
Now, if we want to block things from coming in
from the Internet, we're going to have to do that
in a different firewall on this particular device
because this one only has the outbound defined here.
It's going to have what things as it's going out
to the Internet.
Now, if I want to do this on inbound stuff,
I would have to go and find that
in this particular router.
That's usually going to be something like
port forwarding or port triggering
or something like a static route.
And so in this case, I can port forward or port trigger
and say hey if something's trying to come in
on port 21, ftp, it can go and be routed to my server
which is at the .50, for instance.
And so now, anything that comes in that's trying
to get to this router on port 21,
is going to be forwarded over to that IP address of .50.
So, that's how you allow things in to your network
based on this particular firewall.
Now, how do you block things at the firewall?
Well, in this particular router,
everything is blocked by default
because it's doing an implicit deny.
So, anytime I add a rule like ftp here,
that's doing an explicit allow
and so anything you don't allow
is going to be blocked by default
on the inbound, based on this particular router.