11.2 - Firewalls

 11.2 - Firewalls 

 

Key Terms: 

• Packet-filtering – When the firewall looks at the packet headers to distinguish between real and illegitimate traffic. 
• Access control list (ACL) - A list that specifies the permissions associated with an object. 
• Stateful firewall – This firewall determines the legitimacy of traffic based on the state of the connection. 
• Virtual private network (VPN) - An encrypted connection across a public network. 
• Network address translation (NAT) - NAT remaps IPv4 addresses. 
• Domain name server (DNS) - The directory of a domain name that specifies the IP address for the domain. 
• Demilitarised zone (DMZ) - A subnet that interfaces with external networks to protect the internal network. 
• Bastion host – Also called a boundary firewall, its designed to have an entry and exit point on the network which allows public and internal interfaces to connect. 
• Screened hubnet – A configuration using a single firewall to protect multiple interfaces. 
• Multihomed – A network or host connected to two or more networks. 
• Firewalking – Probing a firewall to determine the configuration of ACLs. 
• Fragmentation – An attack where fragments of outgoing packets are created, causing some of the header information to be transferred to another packet. 
• Tunnelling – A communication protocol for transmitting data over one network to another. 

 

Hardware Firewalls 

A hardware firewall is a physical device placed between 2 networks. They can either be a standalone device or built into other devices like broadband routers. 

 

Packet-Filtering Firewall 

These firewalls were the first to ever be used. They look at the packet’s header information to identify their legitimacy. They follow an ACL to determine which packets to allow and which ones to block. 

 

Stateful Inspection Firewall 

This firewall identifies packet connections in the network layer to determine if they are legitimate or not. It will also evaluate the packet contents to check for malicious or suspicious traffic. 

 

Virtual Private Network 

A VPN offers a secure connection between two networks over a public network (the internet). 

 

Source Routing 

This is when packets are crafted to route around the firewall node. This means that they will not have to go through the firewall and can bypass its security measures. 

 

URL > IP Replacement 

This is a method of bypassing firewall restrictions on blocked websites. Instead of using the website’s URL, they can use the website’s IP address to directly access the site. In some cases, this can bypass the firewall. 

 

IP Fragmentation 

This is when tiny fragments of packets are created to force some of its header information into the next fragment. The firewall will not recognise the packets due to the broken header information and so the fragments will be able to bypass the firewall’s restrictions. 

 

Tunnelling 

HTTP tunnelling can bypass firewalls easily. This is because most firewalls don't examine the HTTP payload and so will let the packet through without checking its contents. 

 

Evasion Countermeasures 

Network administrators must make sure the firewalls are configured completely. They should also create unique user IDs whenever they are running the firewall and avoid using default IDs.