THANK YOU FOR SUBSCRIBING
Network Infrastructure Magazine | Wednesday, April 13, 2022
At its most fundamental level, a firewall is a physical barrier that separates a private internal network from the public Internet.
FREMONT, CA: A firewall is a network security device, either hardware or software-based, that scrutinizes all incoming and outgoing traffic and accepts, rejects, or drops that traffic relying on a predetermined set of security rules.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
Accept: permit traffic.
Reject: deny access but respond with an "unreachable error."
Drop: obstruct traffic with no response
A firewall separates secured internal networks from untrusted external networks, such as the Internet.
Before the advent of firewalls, network security was handled via Access Control Lists (ACLs) stored on routers. ACLs are ruled that specify whether a specific IP address should be given or denied network access.
However, ACLs cannot determine the nature of the packet they are preventing. Additionally, ACL alone is incapable of preventing threats from entering the network. As a result, the Firewall was created.
Organizations can no longer afford to be disconnected from the Internet. However, access to the Internet benefits the business; it also enables the outside world to communicate with the organization's internal network. As a result, the organization faces a threat. A firewall is required to protect the internal network from illegal traffic.
The Firewall compares network traffic to the ruleset specified in its database. Once the rule is matched, the network traffic is subjected to the associated action. For instance, rules may be created such that no employee from the human resources department can access data on the code server, while another rule may be defined such that the system administrator is permitted to view data from both the human resources and technical departments. Rules can be determined based on the organization's requirements and security regulations on the Firewall.
Network traffic might be either outgoing or incoming from the server's perspective. The Firewall keeps a separate set of rules for each of these scenarios. The majority of outbound traffic, which originates from the server, is permitted to pass. Nonetheless, enforcing an outbound traffic regulation is always preferable to increase security and avoid unwanted communication.
Incoming traffic is treated differently from outgoing traffic. The majority of traffic that reaches the Firewall is TCP, UDP, or ICMP. Each of these categories includes a source and destination address. Additionally, both TCP and UDP have port numbers. ICMP employs a type code rather than a port number to indicate the purpose of a packet.
Default policy: It is exceedingly difficult to cover every possible rule on the Firewall explicitly. As a result, the Firewall must always be configured with a default policy. The default policy is composed entirely of actions—accept, reject, or drop.
Assume that no rule is defined on the Firewall regarding SSH connections to the server. As a result, it will adhere to the default policy. If the Firewall's default policy is configured to accept, any computer located outside your business can create an SSH connection to the server. As a result, constantly setting the default policy to drop or reject is a smart practice.
More in News