u9.3 Firewall Types. P1

u9.3 Firewall Types. P1

1. Packet Filters

   • Every packet arriving at the firewall is tested against a ruleset to determine if it should be allowed or not
     • both inbound and outbound packets are tested
       • FW must have explicit rules allowing packets to travel in each direction
         • Packets not allowed may simply be discarded, no notification sent
           • Packets may be rejected and notification sent
             • Stateless packet fw is the simplest type
               • But has distinct problems handling certain protocols

2. Circuit level proxies

   • Never route packets
     • Instead new connections are made between the proxy and the destination server on behalf of the originating client
       • Response from the remote server comes back to the proxy which then passes it back to the client
   • Packets are always absorbed by the interface when they arrive
     • Contents inspected and if allowed to pass according to the ruleset a new packet is generated and sent to the destination

3. The distinction between a routing packet filter and a non-routing proxy firewall becomes important when you examine the more subtle aspects of TCP

   • Routing filters pass on the original packets from source to destination
     • these packets therefore carry the characteristics of the systems from which they originated
   • Proxy firewalls always generate new packets containing the original data payload
     • therefore all packets sent to the outside world will have the characteristics of the proxy firewall
       • far less information about the client systems being protected is leaked to the outside world by a proxy firewall.