A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules.

What is a Firewall?

A firewall acts as a barrier between a trusted network (internal) and an untrusted network (external, such as the Internet), controlling what traffic can pass through it.

Types of Firewall

1. Network Firewall

Protects the entire network from the perimeter:

  • Hardware Firewall: Dedicated physical devices
  • Software Firewall: Applications running on servers
  • Application Firewall: Protects specific applications

2. Host-based Firewall

Protects an individual system:

  • Windows Firewall: Integrated in Windows
  • iptables: For Linux systems
  • pfSense: BSD distribution for firewalls

3. Web Application Firewall (WAF)

Protects specific web applications:

  • Cloudflare WAF: Cloud service
  • AWS WAF: Amazon service
  • ModSecurity: Open source WAF

Filtering Technologies

Packet Filtering

Examines each packet individually:

1
2
3
4

# iptables rule example
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -j DROP

Stateful Inspection

Maintains the state of connections:

  • TCP Connections: Tracking SYN, ACK, FIN states
  • UDP Connections: Tracking bidirectional flows
  • ICMP Connections: Tracking requests and responses

Application Layer Filtering

Inspects application content:

  • HTTP/HTTPS: Web content filtering
  • SMTP: Email filtering
  • FTP: File transfer control

Basic Configuration

Firewall Rules

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Allow HTTP traffic
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow HTTPS traffic
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow SSH from specific IP
iptables -A INPUT -p tcp --dport 22 -s 192.168.1.100 -j ACCEPT

# Block everything else
iptables -A INPUT -j DROP

Security Zones

  • Internal Zone: Trusted networks
  • DMZ Zone: Public servers
  • External Zone: Internet

Best Practices

1. Principle of Least Privilege

  • Deny by default
  • Allow only what is necessary
  • Review rules regularly

2. Network Segmentation

  • Separate networks by function
  • Implement microsegmentation
  • Use VLANs for isolation

3. Monitoring and Logging

1
2

# Enable logging in iptables
iptables -A INPUT -j LOG --log-prefix "FIREWALL: "

4. Regular Updates

  • Keep firmware updated
  • Review obsolete rules
  • Apply security patches

Common Tools

Open Source Firewalls

  • iptables: For Linux
  • pfSense: BSD distribution
  • OPNsense: pfSense fork
  • Smoothwall: Linux firewall

Commercial Firewalls

  • Cisco ASA: Enterprise solution
  • Fortinet FortiGate: NGFW
  • Palo Alto Networks: Next-generation firewall
  • Check Point: Comprehensive solution

Advanced Configuration

NAT (Network Address Translation)

1
2

# NAT for connection sharing
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Port Forwarding

1
2

# Redirect port 8080 to internal server
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.10:80

Rate Limiting

1
2

# Limit connections per IP
iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

Monitoring and Analysis

Monitoring Tools

  • Wireshark: Packet analysis
  • tcpdump: Traffic capture
  • netstat: Connection status
  • ss: Modern netstat tool

Important Metrics

  • Blocked vs allowed traffic
  • Suspicious connection attempts
  • Bandwidth usage
  • Network latency

Troubleshooting

Common Problems

  1. Inaccessible services

    • Check firewall rules
    • Verify open ports
    • Review connection logs

  2. Slow performance

    • Optimize rules
    • Review hardware
    • Analyze traffic

  3. False positives

    • Adjust rules
    • Implement whitelist
    • Review policies
  • VLAN - Network segmentation that complements the firewall
  • VPN - Secure connections that traverse the firewall
  • WAF - Firewall specific to web applications
  • SIEM - System that collects firewall logs
  • SOAR - Automation of firewall configurations
  • Routers - Network devices that work with firewalls
  • Switches - Switching devices on the network
  • Networks - Network infrastructure protected by firewalls
  • Network Security - Discipline that includes firewalls
  • Attack Vectors - Threats that the firewall blocks
  • Logs - Logs generated by the firewall

References