A firewall is a system, or group of systems, that enforces a security policy by controlling the flow of traffic between two or more networks. Firewalls can defend against attacks ranging from unauthorized access, Internet Protocol (IP) address spoofing, session hijacking, viruses and rogue applets, rerouting of traffic, and some denial of service (DoS) attacks.

Traditional firewalls are network based. These firewalls are often placed between an organization’s internal network and an external network, such as the Internet. However, firewalls are also used to segment parts of internal networks. As such, they provide both a perimeter defense and a control point for monitoring access to and from specific networks.

Other firewalls, termed “host-based firewalls,” typically are used to protect a single system from network-based threats. Most of these programs inspect all incoming and outgoing packets and match them against known attack or intrusion signatures. When an intrusion or attempted attack is discovered, the program will log the attempt and provide an alert.

Firewalls may be packaged as system software, hardware and software combined, and dedicated hardware appliances (easy to configure integrated hardware and software packages that run on dedicated platforms).

Firewalls can control access at the network level, the application level, both application and network levels, and the session level. At the network level, they can restrict packet flow based on protocol attributes, such as source and destination address.

At the application level, they may act as intermediaries between source and destination applications and enforce control decisions based on, for example, user identification and/or previous connectivity. At the session level, firewalls can be used to establish a secure and authenticated communications channel regardless of the protocol or application requested.

Firewall implementations and products may be grouped into four major categories, each of which is described below:

1. Stateless packet filters: Also known as screening routers, this category of firewall implementations and products controls traffic at the network (or transport) level by examining source and destination addresses of data packets, source and destination service ports, packet types, and packet options; and either blocking or passing the packet to its intended destination network or network segment. Network access/denial is based on Access Control Lists, which are database files that reside on the firewall, are maintained by the administrator, and tell the firewall specifically which packets can and cannot be forwarded to certain addresses. The firewall can also enable access for only authorized application port or service numbers.
2. Stateful packet filters: Also known as stateful inspection firewalls, this category captures data by an inspection engine operating at the network layer. These packets are queued and then analyzed at all Open Systems Interconnection (OSI) layers by comparing them to a “state table.” This table keeps track of inbound and outbound connections and the conversation’s state, and discards packets not part of a valid connection in the proper context.
3. The state of the connection is monitored at all times, allowing the actions of the firewall to vary based on the administrator-defined rules and the state of previous conversations. In effect, the firewall is capable of remembering the state of each ongoing conversation across it and dynamically modifying the packet filter rules to suit, thus allowing it to more effectively determine which inbound packets are part of an existing session and which are rogue packets.

The primary difference between a stateful firewall and a packet filtering firewall is that the packet filtering firewall compares each separate packet to its rule set without regard to any previous packets. The stateful firewall sees each connection as a whole and in context with the normal (layer 3 and 4) behavior of that particular protocol.

4. Application level proxies: Also known as proxy servers, these are programs that reside on a firewall and relay traffic for a specified application, such as Telnet, File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP), or Hyper Text Transfer Protocol. A proxy server acts as an intermediary for user requests, setting up a connection to the desired resource at the application level. Client applications outside the firewall communicate with the proxy servers instead of directly with application servers. The proxy programs work by transferring a copy of each accepted data packet from one network to another, thereby masking the data’s origin.

Because they intercept traffic at the application level, they have more insight into the nature of the traffic that they examine. More specifically, a proxy server firewall can dynamically monitor the behavior of a particular protocol to make sure that the connections are only using the protocol with expected parameters. This can prevent new and unexpected kinds of attacks (or accidental DoS caused by noise from a misconfigured system) without having to wait for software updates to protect against a specific signature. This setup enables an application proxy to control the application communication before allowing the conversation to proceed. Unlike packet filters and stateful inspection firewalls, a direct connection is never allowed between two networks.

Certain kinds of proxy servers can be used to enforce acceptable use policies. An http web proxy, for example, can prohibit user access from certain prohibited sites that either fall outside of acceptable use guidelines, or pose a threat to network security. It can also monitor and log Internet usage for individual systems and users. In the case where a user (either knowingly or unknowingly) downloads malware, or is used in an attack against another system, the web proxy server logs can provide forensic evidence to determine how the security breach occurred, and information on how to prevent such attacks in the future.

5. Circuit level gateways: This category is a variation of application level proxies, providing security for a wide variety of protocols, used when no application specific proxy exists. Like an application level firewall, the circuit level gateway still relays data for a given application back and forth between the internal network and the external network, thus creating a virtual circuit across the gateway. However, the gateway does not perform any control functions at the application protocol level. Instead, it acts at the session or transport level to pass traffic transparently for a given application. A circuit level gateway typically is used as part of a gateway that performs application level proxying and essentially bypasses the control functions of the gateway for a particular application that is deemed not to pose a security threat and for which no application specific proxy exists.

In addition to these main categories of firewalls, in practice, many of today’s commercial firewalls use a combination of these techniques. For example, a product originating as a packet filtering firewall might have since been enhanced with smart filtering at the application level; or application proxies in established areas such as FTP may augment with an inspection based scheme.

While firewalls offer considerable advantages, there are also a number of issues associated with their potential benefit. Many of these advantages and issues are best understood as trade-offs between implementations of the four major firewall classifications; therefore, the determination of the proper firewall architecture is very important to the provision of effective firewall-based security.

Current Strengths
Each category of firewalls has specific strengths. Listed below are strengths of all firewalls and by specific category:

All firewalls:
• Single IP address: Firewalls present a single IP address to the outside world, thus hiding the real structure of a network from intruders.
• Auditing and reporting: Firewalls usually provide full auditing and reporting facilities.
• Inclusion of VPN technology: Many firewalls include Virtual Private Network (VPN) technology, where a secure tunnel is created over the external network via an encrypted connection between the firewalls to access the internal, protected network transparently.
• Ease of configuration for the basics: For users with minimal or basic requirements, firewall appliances of all types provide easy-to-configure integrated hardware and software packages that run on dedicated platforms.
• Difficulty in hacking appliances: Firewall appliances often have only very elementary OSs, residing on flash (burned on) memory rather than having hard drives and RAM chips. Much of their functionality is hard wired onto the board. Their OSs are usually comprised of proprietary machine level code which is single purpose and therefore not as exposed to the larger hacker world. Appliances tend to be very difficult to hack, with little or no ability to store alien code, such as hacker backdoor programs, without physical access to the device.

Stateless packet filters:
• Cost effectiveness: Packet filter firewalls are generally fast, transparent (no changes required at the client), flexible and cheap. (Most routers will provide packet filtering capabilities; pure packet filters do not require powerful hardware on which to run.)
• Performance: A packet filter firewall usually outperforms an application level firewall because it does less processing of each packet. However, it cannot prevent attacks at the application level.

Stateful packet filters:
• Throughput: Stateful inspection firewalls work well with complex protocols, support new services easily, and work best where security is a concern but throughput is more important. Recently, the technology has achieved phenomenal increases in throughput, and decreases in signal delay through the advent of stateful inspection firewall appliances.

Application level proxies:
• Security: Application level proxies can control the application communication before allowing a conversation to continue (e.g., can require strong authentication), and because there is no direct network connectivity between external networks and the protected server, the protected system is secured from network level attacks (e.g., SYN floods, Ping of Death).

Circuit level gateways:
• Ease of maintenance: Circuit level gateways provide security for a wide variety of protocols and are easier to maintain than application level proxies.

Current Issues
Each category of firewalls has specific issues. Listed below are issues of all firewalls and by specific category:

All firewalls:
• Possible bottlenecks: Few firewalls on the market today provide wire-speed throughput, therefore firewalls have the potential to cause serious bottlenecks, especially for gigabit networks. Careful network design and load balancing across multiple firewall devices is necessary.
• Single security location: A networked-based firewall system concentrates security in one location as opposed to distributing it among systems.
• Insider attack vulnerabilities: Firewalls provide little protection from insider attacks (e.g., insider copying of restricted data). However, VLAN and other network segmentation techniques allow for the use of internal firewalls, most often using router ACLs (packet filtering).
• Back door vulnerabilities: Firewalls do not protect against back doors into the site (e.g., in cases of unrestricted modem access).
• Leakage: Firewalls are subject to “leakage,” or accidentally allowing traffic through a filter, and therefore potentially allowing some degree of unauthorized access.
• Lack of protection to underlying OS: A firewall provides little protection to the underlying OS on which it is running. However, the firewall rule set, as well as built-in software access control does provide a measure of protection to the OS of a firewall system and, while it is true the firewall’s OS shares the same vulnerabilities as any other system with that OS on the network, it also shares in the protection afforded by the firewall rule set itself.
A dedicated firewall OS or a hardened general purpose OS may be necessary to provide a secure platform for the firewall. Firewall systems running on UNIX, Linux, BSD or NT can be hardened by disabling all unneeded services in the same manner a bastion system might be hardened. However, there is no guarantee of safety.
• Price performance: There is a very substantial difference in price for performance (or speed) in an appliance-based firewall vs. a firewall application on a traditional OS.
• Stateless packet filters:
• Configuration difficulties: Packet filter firewalls are traditionally difficult to configure and provide relatively poor rule verification and logging capabilities.
• Incomplete server protection in some cases: Packet filters will not prevent all network-level attacks against the protected server; several protocols and application services pose problems. These firewalls have limited functionality for protocols which are not connection oriented (like FTP) and are much more vulnerable to certain kinds of attacks that use artificially segmented packets.
• Download and transfer vulnerabilities: Firewalls do not protect against users downloading virus-infected PC programs from Internet archives or transferring such programs in attachments to e-mail.
• Cost for required expertise: Packet-filtering firewalls with their limited flexibility and features are relatively inexpensive to purchase (There may already be one built into a router somewhere.) but require advanced expertise which can be costly.

Stateful packet filters:
• Complexity: The core technology of stateful inspection is complex and may have difficulty handling more subtle attacks as they evolve (i.e., it takes time to fully understand the context of the communications).
• Susceptibility to DDoS attacks: Stateful firewalls, because of the need to keep state tables, are much more susceptible to DDoS attacks based on techniques like syn floods.
• Greater initial costs: Stateful inspection firewalls have greater initial costs, but allow some on-the-job training with their friendly GUI interfaces, and increased flexibility.

Application level proxies:
• Performance with proxy servers: Proxy servers may impact performance due to large processor and memory requirements for application protocol analysis and support to many simultaneous users.
• Impact to flexibility: Proxy servers may impact flexibility since the introduction of new Internet applications and protocols can often involve significant delays while new proxies are developed specifically to support them.
• Great variance: Proxy firewalls vary greatly in their ease of configuration, features and initial cost.