All right, what is a firewall?
A firewall is a device that mediates
access between two networks of different trust levels.
It works on various criteria.
You can also describe a firewall as
running at a specific layer of the OSI model.
We'll look at layer 3, layer 4, layer 7, etc.
But a firewall, software, or hardware are a combination of both,
which is used to separate a protected network from an unprotected network.
For example, we have hardware firewalls which are implemented as a network device.
We have software firewalls which are implemented as a program.
Typically, these are installed on local machines.
The Windows firewall is a great example of a software firewall.
Host based and network based.
Host based firewalls,
again, typically you see those in the software firewall variety.
Software based firewall, network based
firewalls are typically your hardware firewalls.
Or it's a Linux host with the IP tables
configured, which isn't necessarily dedicated appliance, but it is a dedicated
node and the software configuration is used to allow our display access.
Our types of firewalls, internal and external.
External firewalls are used between trust boundaries for protected public networks.
Internal firewalls will separate networks
of different trust levels internally, which is definitely recommended.
You see a lot of flat networks out there,
which once you're inside the security perimeter, everything is accessible.
You should carve up your networks into multiple segments.
Firewalls should be provided at the
boundaries between different classifications, different trust levels.
The packet filtering firewall works on layer 3 of the OSI model.
It filters based on IP addresses.
One of your best examples of a packet filtering firewall is just a router.
Most routersto support packet filtering, which means you have access control lists
which dictate what can be accessed and what can't be accessed.
A circuit level gateway.
A circuit level gateway will proxy multiple protocols.
It is a proxy, we'll talk a little bit more about proxies.
The circuit level gateways will run at the
tcp or the session layer of the OSI model or TCP layer of TCPIP.
They may actually route multiple types of protocols, but a proxy does provide a
security service since it shields your identity from the outside world.
When you connect to the proxy and it connects to the outside world, the
outside world sees the proxy and not you the requesting host internally.
Our application level gateways will filter
packets based on the application or the OSI model.
The application level gateways can also be
called application level firewalls or web application firewalls,
which can filter application specific commands like HTTP post and get.
They can also do deep content inspection.
Stateful multi layer inspection firewalls.
Stateful multi layers will inspect the packet at multiple layers of the OSI
model, deep packet inspection, and also maintain a state table, which is a session
table of legitimate connections across the firewall.
So this is a multifaceted inspection type
of firewall, all the way down to deep content inspection.
The application proxy.
It works like the circuit proxy, but it
filters or proxies one type of traffic like web proxy.
The advantage to that is you can control
civic websites being accessed and so forth, but it proxies only one type of
traffic versus circuit, which is multiple types.
Our network address translation or NAPS is okay in my book.
This is the one that's got us still able
to use IP version 4versus being fully immersed in IP version 6.
I hate IP V6 notations.
Naps allows us to use multiple internal
RFC 1918 addresses with a single external address, which
allows us to conserve the address space and it also gives us a degree of security
since the internal hosts are being proxied basically through the NAPS server.
All right, NAT actually happens in a couple of different configurations.
You have static, dynamic, port
address translation and a couple of other variants.
The virtual private network.
The advantage of the VPN is it gives us private network access from the public
internet, so we can create a private network using public network segments
such as the internet, which means encapsulation and encryption.
So the VPN allows us to remote into the
workplace or tie two land segments together.
There's a couple of different
configurations for that without having to have dedicated or lease lines.
The next generation firewall or NGFW.
Our third generation firewall technology moves beyond port or protocol inspection.
Next Gen or deep content inspection and so forth
are going to run multiple services on the same firewall, pack inspection, encrypted
traffic inspection, bandwidth management, threat intelligence, integrated intrusion,
advanced threat protection, one stop shopping solution to take care of
all of your perimeter security border needs.
All right, firewalls access control lists.
One way a firewall can manage access is through an ACL.
An ACL is specific rules on what can be accessed and what can't be.
A standard ACL blocks or allows based on the IP address.
Extended ACLs block based on port numbers and IP address or even MACs.
Host based firewall protection with IP tables.
The IP tables is a built in firewall utility for Linux OSes.
Comes preinstalled on any Linux
distribution and you're going to be doing a lab on IP table firewall configuration.
All right, Packet Fence or PFsense is a
pretty well known free community edition firewall distribution.
You'll also be configuring a PDF sense firewall in the labs.