Firewalls
What is a Firewall?
A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predefined security rules.
It acts as a barrier between a trusted internal network and potentially untrusted external networks.
How Do Firewalls Work?
Traffic Inspection
Firewalls monitor incoming and outgoing network packets in real time. Each packet is analysed to determine its source, destination, and contents. This process allows the firewall to decide whether to allow or block the traffic based on predefined rules.
Scenario: A school firewall receives a request from a student’s device trying to access a file-sharing site. The firewall inspects the packet and blocks it because the URL is not permitted by school policy.
Whitelists and Blacklists
Firewalls use whitelists to allow traffic from trusted sources and blacklists to block known malicious addresses. These lists can be updated regularly to reflect changes in threat intelligence.
Scenario: A teacher needs access to an educational site. The site’s domain is added to the whitelist, ensuring uninterrupted access. Meanwhile, a known malware host is on the blacklist and is automatically blocked for all users.
Rule-Based Filtering
Administrators define filtering rules based on IP address ranges, port numbers, and network protocols (e.g. HTTP, FTP). These rules allow or deny traffic depending on what service is being accessed and from where.
Scenario: The network blocks incoming traffic on port 23 (Telnet) to prevent unauthorised remote access. However, traffic on port 443 (HTTPS) is allowed for secure web browsing.
Stateful and Stateless Filtering
Stateless filtering checks each packet on its own, without remembering any previous activity. It makes decisions based only on what it sees in that one packet-such as the source, destination, or port number.
Stateful filtering remembers previous packets and understands the state of a connection. It knows whether a packet is part of a trusted, ongoing session or not, allowing it to make more informed decisions.
Scenario: Imagine you're loading a webpage. A stateless firewall might block the reply from the website because it doesn’t remember that your browser made a request earlier. A stateful firewall recognises that the reply belongs to an active session and lets it through-even if the incoming port would normally be blocked.
Strengths and Limitations of Firewalls
Strengths
- Network Protection: Prevents unauthorised access and cyber threats.
- Traffic Monitoring: Analyses incoming and outgoing data.
- Access Control: Manages traffic using rules and lists.
- Prevents Malware Spread: Stops malicious traffic from spreading inside the network.
Limitations
- Cannot Prevent Internal Attacks: Firewalls don’t stop threats already inside the network.
- Requires Regular Updates: Needs frequent rule updates to stay effective.
- May Slow Down Traffic: Filtering processes can introduce delay.
- Not a Complete Solution: Works best with other security tools.