Packet Filtering Firewall

1. SUB: Computer System Security
Presented By
Mr. VIVEK TTRIATHI
ASSISTANT PROFESSOR
DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING
KCNIT,BANDA

3. What is a Firewall
 A Firewall is a network security device that monitors and
filters incoming and outgoing network traffic based on an
organization’s previously established security policies.
 A firewall is essentially the barrier that sits between a
private internal network and the public Internet.
 A firewall’s main purpose is to allow non-threatening
traffic in and to keep dangerous traffic out.

5. Types of firewalls
Firewalls are classified as either software or hardware
firewalls, depending on their structure. Each type of
firewall serves a distinct purpose while providing the
same functionality. However, having both is
recommended for maximum protection.
A hardware firewall is a physical piece of equipment that
connects a computer network to a gateway. Consider a
broadband router as an example. An Appliance Firewall is
another name for a hardware firewall.
A software firewall is a simple program that is installed on
a computer and operates via port numbers and other
installed software. This type of firewall is also known as a
Host Firewall.

6. There are four different types of firewalls.
 Packet Filtering Firewalls. Packet filtering firewalls are
the oldest, most basic type of firewalls.
 Circuit-Level Gateways.
 Stateful Inspection Firewalls.
 Application-Level Gateways (Proxy Firewalls)

7. Firewall is a software or hardware
 The main difference between a hardware firewall and a
software firewall is that the hardware firewall runs on
its own physical device, while a software firewall is
installed on another machine.
 A common example of a software firewall is the
firewall built into most operating systems like
Windows and macOS. These OS firewalls are bundled
with the operating system and can run on any
compatible hardware.

8. Packet Filtering Firewall
 A packet filtering firewall is a network security feature
that controls the flow of incoming and outgoing network
data. The firewall examines each packet, which comprises
user data and control information, and tests them
according to a set of pre-established rules.
 If the packet completes the test successfully, the firewall
allows it to pass through to its destination.
 It rejects those that don't pass the test.
 Firewalls test packets by examining sets of rules,
protocols, ports and destination addresses.

9. Why do firewalls use packet filtering
 Packet filtering is an efficient defense system against
intrusions from computers or networks outside a local area
network (LAN).
 It is also a standard, and cost-effective means of protection
as most routing devices possess integrated filtering
capabilities, so there is no need to set a new firewall
device.

10. Where is packet filtering firewall
used:
 Packet-filtering firewalls operate at the network
layer (Layer 3) of the OSI model.
 Packet-filtering firewalls make processing decisions
based on network addresses, ports, or protocols.
 Packet-filtering firewalls are very fast because there is
not much logic going behind the decisions they make.

11. How is packet filtering used
 Packet filtering is a firewall technique used to control
network access by monitoring outgoing and incoming
packets and allowing them to pass or halt based on the
source and destination Internet Protocol (IP) addresses,
protocols and ports.
 Packets are structured data units. Because they divide
communications into small bits and transport them
independently across the network, these networks are
fault-tolerant.
 In order to display accurate information, packages are
reordered after passing through the firewall and arriving at
their destination.

12. Packets include two essential components:
 Data is directed to the correct location using packet
headers. They include internet protocol (IP) elements,
addressing, and any other data needed to deliver packets to
their destination.
 The user data contained within the packet is referred to as
the payload. This is the data that is trying to get
somewhere.

13. Example of Packet Filtering Firewalls:
 Denying outsiders access to port 80, for example, would
prevent all outside access to the HTTP server, because
most HTTP servers run on port 80.
 You can also configure your firewall to allow only packets
intended for your mail or web server while rejecting all
others.

14. Packet filtering firewalls allow or deny network
packets based on the following criteria:
 The source IP address is where the packet is being sent
from.
 The packet’s address is the destination IP address.
 Protocols: Protocols include data transfer protocols such as
session and application protocols (TCP, UDP, ICMP).
 Ports include source and destination ports, as well as ICMP
types and codes.
 Flags include TCP header flags such as whether the packet
is a connect request.
 The physical interface (NIC) that the packet is passing
through (incoming or outgoing).

15. Benefits of Packet Filtering Firewalls
 Packet filtering firewalls is best efficient method
because Routers typically operate at high speeds,
accepting and rejecting packets as quickly as possible
based on their destinations, source ports, and
addresses
 Packet filtering is extremely cost-effective because
only one filtering router is required to secure the
internal network.
 Packet filtering is an appealing option due to its low
cost and ease of use

16. Drawbacks of using a Packet Filtering
firewall
 The primary disadvantage of packet filtering is that it is
based on IP address and port number rather than context
or application information.
 Lack of Logging Capabilities: If the packet filter lacks
logging capabilities, it can pose a problem for a company
that must meet compliance and reporting requirements.
 Packet filtering is that it is fundamentally stateless, which
means that it monitors each packet independently,
regardless of the established connection or previous
packets that have passed through it. As a result, the ability
of firewalls to protect against severe threats and attacks is
quite limited.