Training & Professional Development

Packet-Filtering Routers

Most organizations with an Internet connection have a router as the interface to the Internet at the perimeter between the organization’s internal networks and the external service provider. Many of these routers can be configured to reject packets that the organization does not allow into the network.

The drawbacks to this type of system include a lack of auditing and strong authentication and the fact that the complexity of the access control lists used to filter the packets can grow and degrade network performance.

Screened Host Firewalls

This architecture combines the packet-filtering router with a separate, dedicated firewall, such as an application proxy server, allowing the router to prescreen packets to minimize the network traffic and load on the internal proxy.

The application proxy examines an application layer protocol and performs the proxy services. This separate host is often referred to as a bastion host or sacrificial host; it can be a rich target for external attacks and should be thoroughly secured.

Dual-Homed Host Firewalls

With this approach, the bastion host contains two NICs. One NIC is connected to the external network, and one is connected to the internal network, providing an additional layer of protection. With two NICs, all traffic must go through the firewall to move between the internal and external networks.

Implementation of this architecture often makes use of NAT. NAT is a method of mapping assigned IP addresses to special ranges of non-routable internal IP addresses, thereby creating yet another barrier to intrusion from external attackers.

Screened Subnet Firewalls (with DMZ)

The dominant architecture used today, the screened subnet firewall provides a DMZ. The DMZ can be a dedicated port on the firewall device linking a single bastion host, or it can be connected to a screened subnet.

A common arrangement finds the subnet firewall consisting of two or more internal bastion hosts behind a packet-filtering router, with each host protecting the trusted network:

• Connections from the outside or untrusted network are routed through an external filtering router.
• Connections from the outside or untrusted network are routed into—and then out of—a routing firewall to the separate network segment known as the DMZ.
• Connections into the trusted internal network are allowed only from the DMZ bastion host servers.

The screened subnet is an entire network segment that performs two functions:

• It protects the DMZ systems and information from outside threats by providing a network of intermediate security.
• It protects the internal networks by limiting how external connections can gain access to internal systems.

DMZs can also create extranets, segments of the DMZ where additional authentication and authorization controls are put in place to provide services that are not available to the public.

Limitations of Firewalls

Firewalls should not be the only form of protection for a network. They should be part of an overall security plan and should be used in conjunction with other forms of protection, including ID cards, passwords, and employee rules of conduct.