A firewall is a network security system that monitors and controls the incoming and outgoing network traffic based on predetermined security rules. Packet filter is a hardware or software designed to block or allow transmission of packets based on criteria such as port, IP address, protocol.

1. SHREE SWAMI ATMANAND SARASWATI INSTITUTE
OF TECHNOLOGY
Cyber Security (2150002)
PREPARED BY: ( Group:2)
BHUMI AGHERA(130760107001)
MONIKA DUDHAT(130760107007)
RADHIKA TALAVIYA(130760107029)
RAJVI VAGHASIYA(130760107031)
Firewall and Packet Filters
GUIDED BY:
Prof. Disha Goradiya

2. Firewall
• “A firewall is a network security system that monitors and controls the incoming and
outgoing network traffic based on predetermined security rules.”
• A firewall typically establishes a barrier between a trusted, secure internal network
and another outside network, such as the Internet, that is assumed to not be secure or
trusted.
• Firewalls are often categorized as either network firewalls or host-based firewalls.
• Network firewalls are a software appliance running on general purpose hardware or
hardware-based firewall computer appliances that filter traffic between two or more
networks.
• Host-based firewalls provide a layer of software on one host that controls network
traffic in and out of that single machine.

3. Firewall
• A network firewall is similar to firewalls in building construction, because in both
cases they are intended to isolate one "network" or "compartment“ from another.
Firewall

4. Relevant OSI Layers for Firewall Operation

5. Firewall OSI Layer
• Firewalls operate at different layers in network
• Firewalls that can examine information at more than one layer is more thorough and
effective
• A firewall that works with layers 2 and 3 does deal with specific users
• A firewall at application layer like an application-proxy gateway firewall
• can enforce user authentication as well as logging events to specific users.

6. Firewall Characteristics
• Design goals:
1. All traffic form the inside to outside must pass through the firewall (physically
blocking all access to the local network except via firewall).
2. Only Authorized traffic ( defined by the local security policy) will be allowed to
pass.
3. The firewall itself is immune to penetration(use of trusted systems with secure
operating system)

7. Firewall Characteristics
• Four General Technologies:
1. Service Control: determines the types of the internet services that can be accessed,
in bounded or out bounded.
2. Direction Control: determines the direction in which particular services requests are
allowed to flow.
3. User Control: controls access to a service according to which user is attempting to
access it.
4. Behavior Control: controls how particular service are used(e.g. filter e-mail).

8. Firewall Policies
• To protect private networks and individual machines from the dangers of the greater
Internet, a firewall can be employed to filter incoming or outgoing traffic based on a
predefined set of rules called firewall policies.

9. Policy Actions
• Packets flowing through a firewall can have one of three outcomes:
– Accepted: permitted through the firewall
– Dropped: not allowed through with no indication of failure
– Rejected: not allowed through, accompanied by an attempt to inform the source
that the packet was rejected
• Policies used by the firewall to handle packets are based on several properties of the
packets being inspected, including the protocol used, such as:
– TCP or UDP
– the source and destination IP addresses
– the source and destination ports
– the application-level payload of the packet (e.g., whether it contains a virus).

10. Blacklists and White Lists
• There are two fundamental approaches to creating firewall policies (or rulesets) to
effectively minimize vulnerability to the outside world while maintaining the desired
functionality for the machines in the trusted internal network (or individual computer).
• Blacklist approach
– All packets are allowed through except those that fit the rules defined specifically in
a blacklist.
– This type of configuration is more flexible in ensuring that service to the internal
network is not disrupted by the firewall, but is naïve from a security perspective in
that it assumes the network administrator can enumerate all of the properties of
malicious traffic.
• Whitelist approach
– A safer approach to defining a firewall ruleset is the default-deny policy, in which
packets are dropped or rejected unless they are specifically allowed by the firewall.

11. State
• A state is a dynamic rule created by the firewall containing the source-destination port
combination, allowing the desired return traffic to pass the firewall.
• A single computer could have hundreds of states depending on the number of
established connection.
• Consider a server supporting POP3, FTP, WWW, and Telnet/SSH access.It could have
thousands of states.
• Without state, your request for traffic would leave the firewall but the reply would be
blocked.

12. Firewall Types
• packet filters (stateless)
– If a packet matches the packet filter's set of rules, the packet filter will drop or
accept it.
• "stateful" filters
– it maintains records of all connections passing through it and can determine if a
packet is either the start of a new connection, a part of an existing connection, or is
an invalid packet.
• application layer
– It works like a proxy it can “understand” certain applications and protocols.
– It may inspect the contents of the traffic, blocking what it views as inappropriate
content (i.e. websites, viruses, vulnerabilities, ...)

13. Stateless Firewalls
• A stateless firewall doesn’t maintain any remembered context (or “state”) with respect
to the packets it is processing. Instead, it treats each packet attempting to travel
through it in isolation without considering packets that it has processed previously.

14. Stateless Restrictions
• Stateless firewalls may have to be fairly restrictive in order to prevent most attacks.

15. Statefull Firewalls
• Stateful firewalls can tell when packets are part of legitimate sessions originating
within a trusted network.
• Stateful firewalls maintain tables containing information on each active connection,
including the IP addresses, ports, and sequence numbers of packets.
• Using these tables, stateful firewalls can allow only inbound TCP packets that are in
response to a connection initiated from within the internal network.

16. Statefull Firewall Example
• Allow only requested TCP connections.

17. Why use a firewall?
• Protect a wide range of machines from general probes and many attacks.
• Provides some protection for machines lacking in security.
• Prevent viruses and worms on your network.
• Prevent malicious attackers from getting into your network.
• Prevent adware, malware, and spyware.
• Prevent loss of sensitive or valuable company information.
• Prevent Denial of Service (DoS) attack.
• Acting as a forensics tool.
• Authenticate users, log users (accounting), and authorize users only for certain content
or application.

18. Windows Firewall
• In 2003, Sasser worm and blaster worm attacked a large number of Windows
machines, taking advantage of flaws in the RPC Windows service. Adding to that,
Microsoft was criticized for not being active in protecting customers from threats.
Therefore, Microsoft decided to improve both functionality and the interface of
Windows XP’s built-in firewall, and rebrand it as: “Windows Firewall”.
• Windows Firewall helps protecting your computer by preventing unauthorized users
from gaining access to your computer through a network or internet.

19. Windows Firewall

20. Linux Firewall
• Use GUI (Applications ->System Settings-> Security Level) to activate the firewall
• Allow standard services and any specific port based application
• All other services and ports are blocked

21. Linux Firewall- SELinux
• Malicious or broken software can have root-level access to the entire system by
running as a root process.
• SELinux (Security Enhanced Linux) provides enhanced security.
• Through SELinux policies, a process can be granted just the permissions it needs to be
functional, thus reducing the risk
• SELinux can take one of these three values
1. Enforcing: SELinux security policy is enforced.
2. permissive: SELinux prints warnings instead of enforching.
3. Disabled: SELinux is fully disabled.

22. SELinux Configuration
• Use GUI (Applications ->System Settings-> Security Level) to activate SELinux
• Enable/Disable SELinux
• Allow standard features in various services (http,nis,nfs,dns etc.)
• All other services and features are blocked

23. Packet Filter
• “Packet filter is a hardware or software designed to block or allow transmission of
packets based on criteria such as port, IP address, protocol.”
• To control movement of traffic through the network perimeter, know how packets are
structured and what goes into packet headers
• Packet filter inspects packet headers before sending packets on to specific locations
within the network.
• Packet filter operate on 2/3 OSI layer.
• A variety of hardware devices and software programs perform packet filtering.
 Router: Probably most common packet filters
 Operating system: Some have built-in utilities to filter packets on TCP/IP stack of
the server software.
 Software firewall: Most enterprise-level programs and personal firewalls filter
packets.

24. Anatomy of a Packet
Header
• Header
– Contains IP source and destination addresses
– Not visible to end users
• Data
– Contains the information that it is intending to send (e.g., body of an e-mail
message)
– Visible to the recipient
stnusers
Data
Contains the information that it is intending to send (e.g., body of an e-mail message)
Visible to the recipient

25. Anatomy of a Packet

26. Packet-Filtering Rules
• Packet filtering: procedure by which packet headers are inspected by a router or
firewall to make a decision on whether to let the packet pass
• Header information is evaluated and compared to rules that have been set up (Allow
or Deny)
• Packet filters examine only the header of the packet (application proxies examine data
in the packet)
• Drop all inbound connection; allow only outbound connection on ports 80, 25,and 21.
• Eliminate packets bound for ports that should not be available to the internet(e.g.,
NetBIOS)

27. Packet-Filtering Rules
• Filter out ICMP redirect or echo(ping) message (may indicate hackers are attempting
to locate open ports or host IP addresses)
• Drop packets that use IP header source routing feature.
• Set up an access list that includes all computers in the local network by name or IP
address so communications can flow between them
• Allow all traffic between “trusted” hosts
• Set up rules yourself

28. Common Ports
80 HTTP
443 HTTPS
21 FTP
23 Telnet
22 SSH
25 SMTP