A firewall is a choke point that controls and monitors interconnects between networks with differing trust levels. It imposes restrictions on network services to only allow authorized traffic and can implement alarms for abnormal behavior. Firewalls are classified based on the protocol level they control, including packet filtering, circuit gateways, and application gateways. Packet filtering firewalls filter network packets based on their header values.

1. FirewallsFirewalls
V.PRADEEPAV.PRADEEPA
II – M.SC(CS&IT)II – M.SC(CS&IT)
NADAR SARASWATHI COLLEGE OF ARTS AN SCIENCE,THENINADAR SARASWATHI COLLEGE OF ARTS AN SCIENCE,THENI..

2. What is a Firewall?What is a Firewall?
 AA choke pointchoke point of control and monitoringof control and monitoring
 Interconnects networks with differing trustInterconnects networks with differing trust
 Imposes restrictions on network servicesImposes restrictions on network services
 only authorized traffic is allowedonly authorized traffic is allowed
 Auditing and controlling accessAuditing and controlling access
 can implement alarms for abnormal behaviorcan implement alarms for abnormal behavior
 Itself immune to penetrationItself immune to penetration
 ProvidesProvides perimeter defenceperimeter defence

3. Classification of FirewallClassification of Firewall
Characterized by protocol level it controls inCharacterized by protocol level it controls in
 Packet filteringPacket filtering
 Circuit gatewaysCircuit gateways
 Application gatewaysApplication gateways
 Combination of above is dynamic packet filterCombination of above is dynamic packet filter

4. Firewalls – Packet FiltersFirewalls – Packet Filters

5. Solution 1:Solution 1:
Example 2:Example 2:
Now suppose that we want to implement theNow suppose that we want to implement the
policy “any inside host can send mail to thepolicy “any inside host can send mail to the
outside”.outside”.

6. Solution 2:Solution 2:
This solution allows calls to come from anyThis solution allows calls to come from any
port on an inside machine, and will direct themport on an inside machine, and will direct them
to port 25 on the outside. Simple enough…to port 25 on the outside. Simple enough…
So why is it wrong?So why is it wrong?

7. Firewalls -Firewalls - Application LevelApplication Level
Gateway (or Proxy)Gateway (or Proxy)

8. Firewalls -Firewalls - Circuit Level GatewayCircuit Level Gateway

9. Figure 9.7: A typical SOCKS connection through interface A,
and rogue connection through the external interface, B.

10. Screened Host ArchitectureScreened Host Architecture

11. 1.2.3.4
Intended connection from 1.2.3.4 to 5.6.7.8
5.6.7.81.2.3.45.6.7.8
Firewall
Redialing on a dynamic packet filter. The dashed arrow
shows the intended connection; the solid arrows show the actual
connections, to and from the relay in the firewall box. The
Firewall impersonates each endpoint to the other.

12. Figure 9.2: A firewall router with multiple internal networks.
Filter Rule: Open access to Net 2 means source
address from Net 3
• Why not spoof address from Net 3?
Network TopologyNetwork Topology