Firewalls have become an important part of global computer networks as they perform as a barrier between a company’s local network and the rest of the unpredictable world inclusive of the Internet. The main function of their work is to filter incoming and outgoing traffic in accordance with defined security policies. This monitoring is important because, if not performed, then networks are open to virtually any type of threat, from viruses and worms, to hackers and even scripts. The concept of a firewall can be described as a version of a checkpoint situated at the entrance of a secure building; it examines each of the incoming and outgoing items in order to allow through only those elements that are recognized as legitimate and safe. This analogy points towards the fact that functions and the configuration of firewalls need to be well understood as poorly set up or outdated rules expose systems to attacks.
With the Internet being a part of people’s lives, connecting devices to it poses these devices to possibilities of risks. Internet is a complex network of connected equipments and many equipments possibly being governed by different people with different agendas. Though most of the interactions are legitimate, considering the size and popularity of Internet, there are innumerable ways in which malevolent users can take advantage. These actors may intend to steal data, mess up services, or obtain control over the systems for many malicious intents. Hence, placement of a firewall becomes an important process in protection of any network. It also acts as a barricade that practically divides the secure, enclosed territory of a local area network from the open and usually unfriendly outside world.
Basics of Firewall Functionality
The term ‘firewall’ used in computing is derived from the actual physical barrier used to stop the spread of fire along the walls of structures. Nevertheless, the analogy only partially works in the context of the network security. Saliently, whereas a traditional firewall strives to put the kabash on everything in order to halt the propagation of fire, a network firewall has to be much more selective. It has to be able to recognize which kind of traffic is good and which is bad and let the good traffic through while at the same time preventing the bad traffic. This selective process makes a firewall more like a security guard or a doorman who examines the people’s identity and permission to access the building at the door. The term ‘network gatekeeper’ could be more appropriate because the term ‘firewall’ in a certain sense conceals the rather wide range of responsibilities which this element of the network assumes, namely, the regulation of the flow of traffic.
To do this effectively, a firewall has to have a set of parameters or in other words, a set of rules to work with. These rules are usually set by the network administrator and there may be vast differences in these rules depending on the organization’s needs and security measures. It can cover the kind of traffic, the origin and destination of the data frame, or the particular applications and services in question. Packet filtering is used with traditional firewalls, they look at the header of each data packet and filter according to that. This header has important information like the source and destination Ip addresses; the protocol used and the source and destination port numbers. With help of these parameters, the firewall can make its decision and allow or drop the packet.
Types of Firewalls
That is why as the nature of threat became more digital oriented the type of firewalls also underwent some changes. Originally, the means for firewall was just the packet filtering which although it offers some basic protection is no more sufficient enough to combat new attacks. Packet filtering firewalls only check the header part of each packet and make decision on them that is based on the rules that are set. However, this approach can be somewhat confined because it does not scan the real contents of the received data. This limitation has contribute to the emergence of better firewalls for example the proxy firewalls or application gateways where the full content of he packets are analyzed.
Proxy firewalls are different from the other type of firewalls because the former examines data at the application layer. Using semantic analysis, they receive an idea about the content of the communications with the help of which they come to right decision that either to allow traffic or to block the particular traffic. For instance, a proxy firewall can examine an FTP transaction and filter certain file types in accord to the content instead of the file extension. This deeper inspection offers another level of protection since it will be able to detect contents that might be allowed by the basic packet filtering firewall. However, this is not without its tradeoff since proxy firewalls are slightly heavy on the processor and also add delay to the sequences that traverse the network.
Packet Filtering Mechanics
One of the most straightforward techniques used by firewalls is packet filtering that entails the analysis of headers in the packets. This process is similar to glancing at the memo to examine the name and designation on the envelope before deciding to open it or not. Primary fields contained in the packet’s header consist of the source/ destination IP address, the protocol in use (TCP/UDP), and the corresponding ports. These details enables the firewall decide whether to let the packet be part of communication process or discard it.
The source IP address defines the source equipment, but this information may be deceptive. For instance, a hacker may employ the IP spoofing method to spoof the source IP address therefore making the incoming packet to perceived as originating from a reliable source. This can be applied in ply to the social engineering process in order to penetrate security systems that have been put in place. Thus, while the source IP address is an indispensable piece of information, the actual security decision has to rely on other data at one’s disposal.
Destination IP address shows the packet is being sent to this address This is the IP address of the node or computer that is being targeted by the packet. This information is used to check that the packet is being sent to a proper address of a receiver. As an example, a firewall filters out traffic from certain source or destination addresses that are on a list of known hostile IP addresses or for/disable internal data from getting to other outside addresses. The protocol field defines that transport protocol that is to be used, for examples Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP). It enables the firewall to realize the type of transmission and which rule to enforce.
Other elements to apply in packet filtering include port numbers. They define the exact application or service through which the communication is being effected. For instance, HTTP constantly works on port number 80 while on the other hand, HTTPS works on port number 443. When inspecting the port numbers, the firewall is also in a position to add specific conditions regarding a given type of traffic. For instance, a firewall can deny all traffic on port 21 to highly discourage file transferring through the FTP.
Internet Protocol Spoofing and Its Prevention
Another type of attack based on the determination of the source IP address is the IP spoofing where the attacker hides the source of the packages. From the information given above, one realizes that from the source IP address, hackers are able to hide and this make it seem as though the packets are from a trusted host. This can be done for numerous evil uses including, but not limited to, gaining unauthorized access to a secure network, the instigation of denial of service attacks, or the issuance of commands to malware which may already be present and active within the network. IP spoofing has the potential to pose many risks and, for this reason, is a eminent area that firewalls must consider.
IP spoofing has its uses and one of them is in denial-of-service attacks. In such an attack, the attacker transmits a large number of packets with the Sender IP address as that of another system. Since the source IP addresses used are fictitious, the reply made by the target system is actually sent elsewhere hence the attacker is hard to deny and/or block. The second scenario is when a hacker sends commands to a Trojan horse or other malware that is established in the network using other IP addresses. This enables the attacker to guide the afflicted system without necessarily being physically nearby.
Firewalls have measures that act against IP spoofing. There is ingress and egress filtering where the firewall scrutinize the validity of the source and destination IP addresses. For instance, if a packet has source IP address that belongs to internal addresses it would be regarded as spoofed since such addresses do not belong in the external networks. Likewise the outgoing packets, the source IP address of the packets must not be from outside the internal range. Because by not allowing those packets that the firewall marked as suspicious it is able to stop many attacks.
The Role of ICMP
ICMP (Internet Control Message Protocol) is used in networks as an important part of diagnostics and error messages sending. It is employed for transmitting error messages and items of operational data, for instance, a service presence or a host accessibility. Some of the common ICMP messages include ; Destination Unreachable, Time Exceeded and Echo request used for the ping command. ICMP is indeed a useful protocol for managing and diagnosing networks but it is also misused.
This is the case because through ICMP, it is possible to have reconnaissance attacks executed on a targeted network or host. This means that the attackers can use the ICMP messages to do a reconnaissance of the network, that is, they get to know the different devices that are connected to the network as well as the different ports that are open and even the vulnerabilities that may be present. For instance, through using Internet Control Message Protocol (ICMP) messages, an attacker can identify which IP address responds to the “Echo Request” (ping) basically identifying which are in use. It can then be used to plot the follow-up operations to be made on the intended target.
One problem is related to the fact that it is sometimes possible to use ICMP for performing typical redirect attacks. In the ICMP redirect attack, an attacker sends a forged ICMP redirect message to a host which informs the host a different routing path to use hence portraying a different path when attacked. This can be deployed to redirect the victims to another server to leak or even alter the information that passes through it. To avoid these threats, filter or limit some ICMP messages are added to a firewall or network.
Fragmentation Challenges
IP fragmentation takes place where a large IP datagram is divided into smaller fragments in a way to conform to maximum transmission unit’s MTU of the network path. Fragmentation is a normal and mandatory function in IP networking, but it becomes an issue for firewalls. Here only the first fragment contains all the header information though it includes the port number, firewalls may not be able to assign rules to the subsequent fragments with ease.
Another weakness might be that an attacker will have the probability of exploiting fragmentation and traverse through all the firewall rules. For instance, a hacker can transform a payload into multiple fragments, which can make it past checks conducted by the firewall; the initial fragment, especially, will contain no incriminating information. Following fragments could contain the detrimental data, but they will not contain the necessary header info, so the firewall could pass them. This technique can be used efficiently against those firewalls that do not reconstruct fragments for scrutiny.
Let us continue with the options that the firewalls have when dealing with fragmented packets for them to perform packet filtering and other related tasks. The process that involves the prevention of all fragments is the most secure one but it can hinder normal traffic for protocols that fragment inherently. Another possibility is to reassemble fragments before inspection, but this demands more memory and processing power from the firewall, which can be dangerous and can be potentially turned into DoS by filling up the firewall’s memory and CPU resources. Admitting fragments based on the first packet’s authentic can be quite dangerous since it relies on the first examination outcome.
Dynamic Packet Filtering
Dynamic packet filtering otherwise referred to as stateful inspection is considered a better advancement of packet filtering. In contrast to the packet filtering engaging in separate packets’ examination, the dynamic packet filtering takes into consideration an active connection state. These characteristics of the firewalls enable it to make better decisions when analyzing the traffic flow.
For instance, once an internal user starts a connection to an external server, then the firewall records information about the connection such as source IP address, destination IP address, and the ports involved. It then has an anticipated response from the external server as a result of transmitting a request. While the packets that match the anticipated characteristics can pass through, those that do not are rejected. This mechanism denies the attackers the chance of sending unfriendly packets that may probe for weak links or introduce themselves into the protected system.
Dynamic packet filtering also helps in increasing security since it deals with eradicating certain protocol vunerabilities. For example FTP and SMTP have well understood public, which in certain circumstances can be subjected to the effect of the packets which are malformed. Here, the involved protocols’ specifications can be more comprehensively analyzed and scrutinized by the firewall, with the particular focus on the potentialAttack indications. This deeper inspection capability makes it dynamic packet filtering stronger option than traditional packet filtering, especially where and when there is heavy and probably complicated traffic in the network.
NAT and Its Implications
Network Address Translation (NAT) is a method that let more than one PC in an internal network use the same internet IP address. This does not only help to minimize the usage of the limited sum of public IP addresses but also helps the security standpoint by obscuring internal structure from the outer world. NAT operates through translation of IP addresses in the headers of transmitted as well as received packets and replacing the private IP addresses with a public one.
From the security view point, NAT can be viewed as a firewall since direct access to the internal devices is prohibited from the outside world. The public IP address is the only one that external entity can send data to and the NAT device then decides what internal device the data should be routed to. It is important to note that this process inherently recreates the firewall, or more specifically the restriction of undesirable incoming connections which the NAT device does not store a mapping for.
But as with any idea, NAT has its trade off. But one major problem is that they are likely to be abused by attackers. Because NAT conceals internal IP addresses, it can also cover up malicious incidents; therefore, it does not help to track an attack’s source. However, some of the applications and protocols including the peer-to-peer communication, and gaming may have issues with NAT because they establish end to end connectivity.
Another issue appears in such protocols that integrate and execute the IP addresses and the port numbers within the structure of the data payload as well as in the packet headers. NAT devices generally do not look at the payload, implying that some or all of these protocols may not behave as expected when NAT is used. For instance, to establish the necessary intercommunications, some additional techniques such as Universal Plug and Play (UPnP) or Session Traversal Utilities for NAT (STUN) are used.
Proxy and Application Gateways
Another type of firewall called proxy firewall or sometimes called application gateway, analyzes the data at the application layer as it is more comprehensive than the OSI network layer. Proxy firewalls also differ from packet-filtering firewalls because the latter examines only the packet’s headers, while proxy firewalls examine the content of communication. This capability is very important since it helps in the early identification of abnormalities in traffic pattern that may be a result of host manipulation or cashing attacks whereby traffic that is malicious is traffic that appears to be legitimate.
Proxy firewall works in a way that it first establishes another connection for every communication session. When for example a program on the internal network and on a computer needs to interact with a server outside the network, the proxy firewall first opens a connection in the place of the device that needs access to the external server. The request is sent to the public network after that it relays the response back to the internal device thus making it an intermediary. This setup provides two key benefits: the internal device does not interact with the external server and the proxy can thoroughly scan all the contents of the communication.
Nonetheless, there are disadvantages associated with the use of proxy firewalls. A major weakness is that in order for the proxy to work it must know the meaning of the protocols in usage with the specific applications. The proxy firewalls are effective in filtering standard protocol; however they are not effective when it comes to filtering the less popular protocols or the customized ones. This limitation may limit the range of those applications that are properly to run through the firewall.
On the same note, the utilization of a proxy firewall, may warrant configuration alteration of the inside network devices. People might have to set proxy parameters that are located in their computers and these are a potential area for mistakes. In addition, there may be also additional processing with the help of a proxy, which can cause a delay in communication.
Weaknesses of Proxy Systems
However, it is also important to reveal that proxy firewalls have several imperfections. One of the key issues, which is worth mentioning, is that at present these tools are constructed based on their authors’ understanding of the protocols that they are supposed to implement. If there is a new or a unique protocol that has been adopted it might not be recognized by the proxy firewall hence creating a loophole in the net-work security. This is due to the fact that the above limitation may not be very much effective especially in today’s world where most facilities are required to support several applications and services.
Another problem is that DoS attacks aimed at the proxy may be carried out deliberately. The problem with proxies is the fact that they process and review every communication; when overloaded with traffic, they tend to get congested. The above vulnerability may be exploited by attackers to launch DoS attacks that overwhelm the proxy with request and it may slow down or deny response. Despite the fact that proxy helps in reducing some types of attacks it is not shielded from other attacks and a failure in this form of proxy means that communication of the relevant network is cut completely.
However, proxies are delicate to configure and maintain in the best possible manner on the network. Continuous changes in proxy risks and new proxy uses to enhance the organization’s functioning increase the number of regulations that must be developed and improved, which contributes to the administration overload. Configuration mistakes can be made that can either cause harm by blocking acceptable traffic or by not blocking undesirable traffic.
Logging and Monitoring
Logging and monitoring must be noted as one of the most essential activities in the process of firewall management. Firewalls are not an option that can be placed online and left for a long time, without supervision to determine whether or not it is properly filtering traffic. In addition, by logging all the activity passing through the firewall, allowed and specifically, the traffic that was blocked is documented and is particularly useful for security audits or when there is a known security incident.
The use of activity logs is diverse and aims at the following goals. They can assist in detecting illicit activities like multiple attempts of log-ins, or other strange activity models in the system. These logs are of great help to the network administrators, in that they help identify intrusions as well as steps taken to ensure they do not become successful. It also helps generate reports on the usage of the networks so as to inform the organizations on the usage of their resources.
In addition, activity logs are legal evidences in case of security breeches or in the case when an attacker has to be prosecuted. In the event that a network intrusion results in theft of data or any criminal related activity, it is very possible to look for source of the attack from the logs. However, these logs should be protected because the attackers usually erase or modify them to conceal their activities.
Because of the large amount of data that a network can produce especially in areas of high usage, proper log management has to be put in place. Some of the necessary actions are proper setting of audit trail retention period, secure storage of audit trail data, and utilization of log analyzers that can identify anomalous patterns. Log analysis is extremely beneficial for understanding security state and possible threats to avoid similar occurrences in the future.
Conclusion
It is critical to have a good understanding of the functioning of firewalls in order to effectively support any network’s security mechanisms. That being said, one can say that there is no ultimate perimeter for security; however, a proper configuration of the firewall coupled with other technologies like NAT and proxies is quite effective against a vast number of threats. However, being so versatile in its function, the cybersecurity is a constantly evolving field therefore, the firewalls must be re-checked and upgraded frequently.
High security and usability are the two features that should be observed when managing the firewall system. The highly restrictive settings can subordinate activities that should not be restricted, whereas relatively liberal settings can make the network insecure. The requirements of constant examination and adjustment of the firewall rules and settings, staying knowledgeable about the current threat analysis and having strict logging and monitoring procedures are also considered indispensable for any firewall plan.
In a nutshell, the objective of a firewall is a control of the traffic but at the same time enable secure and reliable communication. This paper has discussed the different categories of firewalls, as well as the advantages and disadvantages of each, concerning both implementation and use, thus enabling the organization to build a network system that allows them to run their operations effectively and, at the same time, safeguard their important resources from threats such as hacking attacks.