Firewall
What is a Firewall?
A firewall is a security system that monitors and controls network traffic based on a set of security rules. Firewalls are typically positioned between a trusted network and an untrusted network; the untrusted network is most often the internet. For example, office networks often use a firewall to protect their network from internet-based threats.
Firewalls decide whether to allow incoming and outgoing traffic to pass through. They can be integrated into hardware, software, or a combination of both. The term “firewall” is actually borrowed from the construction practice of building walls between or through the middle of buildings designed to contain fires. Similarly, network firewalls work to contain internet-based threats.
Why Use a Firewall?
The primary use case for a firewall is security. A firewall can intercept malicious incoming traffic before it reaches the network, as well as prevent sensitive information from leaving the network.
Also:
You can use firewalls for content filtering.
A school can configure a firewall to prevent users on their network from accessing adult content. Similarly, in some countries, the government operates a firewall that can prevent people inside that nation-state from accessing certain parts of the internet.
This article will focus on firewalls configured for security, of which there are several types.
What are the Different Types of Firewall?
Proxy-based Firewalls:
These are proxies* that sit between clients and servers. Clients connect to the firewall, and the firewall inspects the outgoing packets, after which it will establish a connection to the intended recipient (the web server).
Similarly, when a web server attempts to send a response to the client,
the firewall will intercept that request, inspect the packets,
and then deliver that response in a separate connection between the firewall and the client.
A proxy-based firewall effectively prevents any direct connection between the client and the server.
Also:
A proxy-based firewall is somewhat like a bouncer at a bar. The bouncer stops guests before they enter the bar to make sure they are not underage, armed, or otherwise posing a threat to the bar and its patrons. The bouncer also stops patrons on their way out to make sure they have a safe way to get home and are not planning to drink and drive.
The downside of having a bouncer at the bar is that when too many people try to enter or exit the bar at the same time, there will be a long queue and many people will face delays. Similarly, the main drawback of a proxy-based firewall is that it can cause latency, especially during periods of heavy traffic.
Stateful Firewalls:
In computer science, a “stateful” application is one that stores data from previous events and interactions. A stateful firewall saves information about open connections and uses this information to analyze incoming and outgoing traffic, rather than inspecting each packet individually. Because they do not inspect every packet, stateful firewalls are faster than proxy-based firewalls.
Good stateful firewalls rely heavily on context when making decisions. For example, if the firewall is logging outgoing packets on a connection requesting a certain type of response, it will only allow incoming packets on that connection if they provide the requested type of response.
Stateful firewalls can also protect ports* by keeping them all closed unless incoming packets request access to a specific port. This can mitigate an attack known as a port scan.
One known vulnerability associated with stateful firewalls is that they can be manipulated by tricking the client into requesting a certain type of information. Once the client requests that response, an attacker can then send malicious packets matching those criteria through the firewall. For example, unsafe websites can use JavaScript to craft these types of forged requests from a web browser.
Next-Generation Firewalls (NGFW):
NGFWs are firewalls that have the capabilities of traditional firewalls but also use a set of additional features to address threats at other layers of the OSI model. Some of the features specific to NGFWs include:
- Deep Packet Inspection (DPI) – NGFWs perform a deeper inspection of packets than traditional firewalls. This deep inspection can look at things such as packet payloads and the application being accessed by the packets. This allows the firewall to enforce more granular filtering rules.
- Application Awareness – Enabling this feature makes the firewall aware of which applications are running and the ports those applications are using. This can protect against certain types of malware that aim to terminate a running process and then take over its port.
- Identity Awareness – This allows the firewall to enforce rules based on identity, such as which computer is being used, which user is logged in, and so on.
- Sandboxing – Firewalls can isolate pieces of code associated with incoming packets and execute them in a “sandbox” environment to ensure they do not behave maliciously. The results of this sandbox test can then be used as criteria when determining whether to allow packets into the network.
Web Application Firewalls (WAF):
While traditional firewalls help protect private networks from malicious web applications, WAFs help protect web applications from malicious users. A WAF helps protect web applications by filtering and monitoring HTTP traffic between the web application and the internet. It typically protects web applications from attacks such as cross-site forgery, cross-site scripting (XSS), file inclusion, and SQL injection, among others.
waf
By deploying a WAF in front of a web application, a shield is placed between the web application and the internet. While a proxy-based firewall protects the identity of a client machine by using an intermediary, a WAF is a type of reverse proxy, protecting the server from exposure by making clients pass through the WAF before reaching the server.
A WAF operates through a set of rules often referred to as policies. These policies aim to protect against vulnerabilities in the application by filtering malicious traffic. The value of a WAF comes in part from the speed and ease with which policy modifications can be implemented, allowing for faster response to different attack vectors; during a DDoS attack, rate limiting can be quickly implemented by modifying WAF policies.
Firewall as a Service (FWaaS):
Firewall as a Service (FWaaS) is a newer model for delivering firewall capabilities via the cloud. This service may also be referred to as a “cloud firewall”. FWaaS forms a virtual barrier around cloud platforms, infrastructure, and applications, just as traditional firewalls form a barrier around an organization’s internal network. FWaaS is often better suited to protecting cloud and multi-cloud assets than traditional firewalls.
What is a “Network Firewall”?
A “network firewall” is any firewall that defends a network. By definition, nearly all security firewalls are network firewalls, although firewalls can protect individual devices as well.
While firewalls are an important component of network security, this field has many other aspects as well, including access control, user authentication, and DDoS mitigation. Learn more about network security.
Are Firewalls Software-based or Hardware-based?
Originally, firewalls were hardware devices (see the firewall history section below). While some hardware firewalls are still in use, many modern firewalls are software-based, meaning they can run on several different types of hardware. Meanwhile, FWaaS is hosted in the cloud.
What is the History of Firewalls?
The history of firewalls dates back to the late 1980s. The first firewalls allowed or blocked individual data packets. They decided which packets to allow and which to block by examining network layer and transport layer headers to determine the source and destination IP address and port (similar to viewing the “To” and “From” sections of an email). This prevented illegitimate traffic from gaining access and stopped many malware attacks.
The next generation of firewalls added stateful capabilities. And newer generations (such as NGFWs) added the ability to inspect traffic at the application layer.
Just as firewall capabilities have evolved over time, so has the way firewalls are deployed. Originally, firewalls were physical hardware devices connected to a company’s network infrastructure. But as business operations moved to the cloud, routing all network traffic through a physical box became inefficient. Firewalls today can also run in software or virtually in the cloud.
And with that, dear friend, we have successfully completed our mission 
With greetings from the #Ezznology team
Find what you need at #our store
To subscribe to our newsletter on Google News click here👇👇
or scan the code
Ezznology on Google news
