Firewalls

A firewall is a security device. It can be either hardware or software.

Firewalls monitor and controls network traffic. It is looking at things and making decisions to either allow or deny that network traffic based off of rules we set up as the end user.

  • Rules/Policies: Instructions for traffic.
  • Stateful vs. Stateless: Tracks connections vs. treats each packet individually.

Ingress vs. Egress Traffic

  • Ingress: Data coming into your network (Uses inbound rules)
  • Egress: Data going out of your network (Uses outbound rules)

Types of Firewalls

  1. Packet Filtering Firewalls: Examines basic packet info: IP, Port, Protocol
  2. Stateful Inspection Firewalls: Maintains a "state table" to track active connections. Allows legitimate return traffic immediately (doesn't have to check every time because it remembers).
  3. Proxy Firewalls: Acts as an intermediary, inspecting traffic at the application layer
  4. Next-Generation Firewalls: Combines traditional functions with advanced features like IPS, application control, and threat intelligence.

How Firewalls Work

Firewalls process rules in a specific order (typically top-down). Once a packet matches a rule, the action is taken.

Anatomy of a Rule:

  • Source: IP, Network, User (where did you come from)
  • Destination: IP, Network, Service (where are you going)
  • Protocol: TCP, UDP, ICMP, etc.
  • Port: (e.g., 80, 443, 22)
  • Action: Allow, Deny/Reject, Drop

Deny/Reject vs. Drop

  • Deny/Reject: Tells the user it was denied.
  • Drop: Just ignores it / doesn't tell the user it was denied.

If you tell them they're rejecting their packet, the hacker could try and find a workaround. Otherwise, they might be confused.