Application Gateway versus Packet Filter

Compared to packet filters, application proxies can provide a finer-grained access control than packet filters, and they also have the advantage that they can check contents. For example, application proxies can screen email for privileged information. Additionally, they can reject mal-formed data or change the data to a proper form. A drawback is that they are much slower than packet filters. Moreover, a proxy has to be developed for each application. Note that if a corporate network is connected to the Internet through a firewall that uses application gateways, the hosts on that network are not visible on the Internet. This means their IP addresses will never show up in any packets on the Internet.

Hybrid

In an attempt to combine the security of the application gateways and the flexibility and speed of packet filtering, some vendors have created systems that use the principles of both. In these hybrid systems, new connections are authenticated and approved at the application layer. Then the remainder of the connection is passed down to the session layer, where packet filters ensures that only packets that are part of an ongoing (already authenticated and approved) transmission are being passed.

Other possibilities include using both packet filtering and application layer proxies. This method protects computers that provide services to the Internet (for example, public Web server), and serve as an application layer gateway to protect the internal network. Additionally, this method provides multiple layers of defense for intrusions aimed at services on the internal network.

Intruder Attacks Prevented by Firewall

A firewall may protect against the following intruder attempts to breach the security of the system:

Remote login - Intruders may enter your protected network via Telnet logins. Firewalls can block traffic from Telnet and other remote data transfer methods.

Application backdoors - Some programs have special features that may allow intruders to enter illegitimately. Some other programs may contain bugs that provide a backdoor or hidden access that can provide the intruder with some level of control of the program. A firewall can be set up to allow traffic to pass through legitimate ports of the application only.

Source routing - In most cases, the path a packet travels over the Internet is determined by the routers along that path. But, the sender of the packet can arbitrarily specify the route that the packet should travel. Hackers sometimes take advantage of this to make information appear to come from a trusted source or even from inside the network. Most firewall products disable source routing by default.

Viruses - A hybrid firewall can be used to examine mail traffic and filter out those with specific attachments (such as those with file extensions .exe and .vbs).

Denial of service- A firewall can block offending IP addresses

Setting up a Firewall

The effectiveness of a firewall is dependent upon the rules regarding what type of data can pass through, and what type of data is not permitted. The firewall can also be configured to help reinforce certain security policy set up by you or your organization on machines within the protected network. For applications, it can serve as an added layer of security check to ensure that application backdoors are not exploitable.

Firewall configuration is based on the level of security you or your organization wants to establish. The highest level of security would be to block all traffic, but that would defeat the purpose of having an Internet connection. Some firewalls permit only email traffic, thereby protecting the network against any attacks other than those against the email service. Other firewalls provide a lower level of security, and only block services that are known to be problems. Generally, firewalls are configured to protect against unauthorized remote logins via Telnet. This helps prevent intruders from logging into machines on your network.

Some firewalls can be configured to block traffic from the outside to the inside, but permit users on the inside to communicate freely with the outside. However, it is also important to ensure messages from the inside are filtered through the firewall. In case of a virus infection, filtering packets internal to the network can prevent the infection from spreading. A common rule of thumb for setting up a firewall is to block everything and then begin to select what types of traffic you will allow.

Despite how a firewall is set up, be aware that a firewall only protects you from the traffic it denies, and denying all traffic may not be feasible. There are other tools to strengthen the security of your computer system, which you will learn in the next section.