Packet Filtering

Packet filtering firewalls are the least detrimental to throughput because they only inspect the header of the packet for allowed IP addresses or port numbers. Although even performing this function will slow traffic, it involves only looking at the beginning of the packet and making a quick allow or disallow decision.

Although packet filtering firewalls serve an important function, they cannot prevent many attack types. They cannot prevent IP spoofing, attacks that are specific to an application, attacks that depend on packet fragmentation, or attacks that take advantage of the TCP handshake. More advanced inspection firewall types are required to stop these attacks.

Proxy Firewalls

Proxy firewalls stand between each connection from the outside to the inside and make the connection on behalf of the endpoints. Therefore, there is no direct connection. The proxy firewall acts as a relay between the two endpoints. Proxy firewalls can operate at two different layers of the OSI model. Both are discussed shortly.

Circuit-level proxies operate at the Session layer (layer 5) of the OSI model. They make decisions based on the protocol header and Session layer information. Because they do not do deep packet inspection (at layer 7 or the Application layer), they are considered application-independent and can be used for wide ranges of layer 7 protocol types.

A SOCKS firewall is an example of a circuit-level firewall. This requires a SOCKS client on the computers. Many vendors have integrated their software with SOCKS to make using this type of firewall easier.

A kernel proxy firewall is an example of a fifth-generation firewall. It inspects the packet at every layer of the OSI model but does not introduce the performance hit that an Application layer firewall will because it does this at the kernel layer. It also follows the proxy model in that it stands between the two systems and creates connections on their behalf.

Proxy servers can be appliances, or they can be software that is installed on a server operating system. These servers act like a proxy firewall in that they create the web connection between systems on their behalf, but they can typically allow and disallow traffic on a more granular basis. For example, a proxy server might allow the Sales group to go to certain websites while not allowing the Data Entry group access to these same sites. The functionality extends beyond HTTP to other traffic types, such as FTP and others.

Proxy servers can provide an additional beneficial function called web caching. When a proxy server is configured to provide web caching, it saves a copy of all web pages that have been delivered to internal computers in a web cache. If any user requests the same page later, the proxy server has a local copy and need not spend the time and effort to retrieve it from the Internet. This greatly improves web performance for frequently requested pages.

Application Firewall

Application-level proxies perform deep packet inspection. This type of firewall understands the details of the communication process at layer 7 for the application of interest. An application-level firewall maintains a different proxy function for each protocol. For example, for HTTP the proxy will be able to read and filter traffic based on specific HTTP commands. Operating at this layer requires each packet to be completely opened and closed, making this firewall the most impactful on performance.

Personal Firewall

Personal firewalls may be those that come with an operating system like the Windows Firewall, or they may be third-party host firewalls such as Kaspersky Internet Security or Zone Alarm Pro Firewall. These firewalls, called either host or personal firewalls, protect only the device on which the software is installed.

While never a replacement for properly positioned network firewalls, they are an excellent complement to the protection provided by the network firewalls, and installing both types of firewalls is an example of exercising the concept of defense in depth. This concept prescribes that you should always deploy multiple barriers to unauthorized access.

One key feature that a personal firewall can provide (although in many cases this is not configured by default) is the ability to control egress traffic. This is traffic leaving the device and can help to prevent malware that “calls home” to a command-and-control server from functioning. These firewalls can also help protect systems from other systems inside the network perimeter.

Operations

Figure 13.2 shows the operation of a stateful firewall.

The device C1 on the right is sending a SYN packet to the device H1. The firewall permitted and recorded that operation in its state table and will monitor that table whenever a packet arrives at the firewall to ensure that any packets permitted either are connection requests from the inside (SYN packets only) or are part of an existing connection and that all rules of the handshake are enforced. For example, in the scenario, a packet from the outside destined for C1 from H1 with an ACK flag set would be rejected because the next expected packet type in the handshake would be a packet with the SYN and ACK flags set.

State Table

The state table is used to monitor all allowed connections. The following are the key items that are typically recorded by a stateful firewall with respect to each connection:

• Source IP address
• Source port number
• Destination IP address
• Destination port number
• IP Protocol
• Flags
• Timeout