Firewall (computing)

In computing, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.^[1][2] A firewall typically establishes a barrier between a trusted network and an untrusted network, such as the Internet.^[3]

History

The term firewall originally referred to a wall intended to confine a fire within a line of adjacent buildings.^[4] Later uses refer to similar structures, such as the metal sheet separating the engine compartment of a vehicle or aircraft from the passenger compartment. The term was applied in the late 1980s to network technology^[5] that emerged when the Internet was fairly new in terms of its global use and connectivity.^[6] The predecessors to firewalls for network security were routers used in the late 1980s. Because they already segregated networks, routers could apply filtering to packets crossing them.^[7]

Before it was used in real-life computing, the term appeared in the 1983 computer-hacking movie WarGames, and possibly inspired its later use.^[8]

Types

See also: Computer security and Comparison of firewalls

Firewalls are categorized as a network-based or a host-based system. Network-based firewalls are positioned between two or more networks, typically between the local area network (LAN) and wide area network (WAN).^[9] They are either a software appliance running on general-purpose hardware, a hardware appliance running on special-purpose hardware, or a virtual appliance running on a virtual host controlled by a hypervisor. Firewall appliances may also offer non firewall functionality, such as DHCP^[10][11] or VPN^[12] services. Host-based firewalls are deployed directly on the host itself to control network traffic or other computing resources.^[13][14] This can be a daemon or service as a part of the operating system or an agent application for protection.

 

An illustration of a network-based firewall within a network

Packet filter

The first reported type of network firewall is called a packet filter, which inspects packets transferred between computers. The firewall maintains an access-control list which dictates what packets will be looked at and what action should be applied, if any, with the default action set to silent discard. Three basic actions regarding the packet consist of a silent discard, discard with Internet Control Message Protocol or TCP reset response to the sender, and forward to the next hop.^[15] Packets may be filtered by source and destination IP addresses, protocol, source and destination ports. The bulk of Internet communication in 20th and early 21st century used either Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) in conjunction with well-known ports, enabling firewalls of that era to distinguish between specific types of traffic such as web browsing, remote printing, email transmission, and file transfers.^[16][17]

The first paper published on firewall technology was in 1987 when engineers from Digital Equipment Corporation (DEC) developed filter systems known as packet filter firewalls. At AT&T Bell Labs, Bill Cheswick and Steve Bellovin continued their research in packet filtering and developed a working model for their own company based on their original first-generation architecture.^[18] In 1992, Steven McCanne and Van Jacobson released paper on BSD Packet Filter (BPF) while at Lawrence Berkeley Laboratory.^[19][20]

Connection tracking

 

Flow of network packets through Netfilter, a Linux kernel module

Main article: Stateful firewall

From 1989–1990, three colleagues from AT&T Bell Laboratories, Dave Presotto, Janardan Sharma, and Kshitij Nigam, developed the second generation of firewalls, calling them circuit-level gateways.^[21]

Second-generation firewalls perform the work of their first-generation predecessors but also maintain knowledge of specific conversations between endpoints by remembering which port number the two IP addresses are using at layer 4 (transport layer) of the OSI model for their conversation, allowing examination of the overall exchange between the nodes.^[22]

Application layer

Main article: Application firewall

Marcus Ranum, Wei Xu, and Peter Churchyard released an application firewall known as Firewall Toolkit (FWTK) in October 1993.^[23] This became the basis for Gauntlet firewall at Trusted Information Systems.^[24][25]

The key benefit of application layer filtering is that it can understand certain applications and protocols such as File Transfer Protocol (FTP), Domain Name System (DNS), or Hypertext Transfer Protocol (HTTP). This allows it to identify unwanted applications or services using a non standard port, or detect if an allowed protocol is being abused.^[26] It can also provide unified security management including enforced encrypted DNS and virtual private networking.^[27][28][29]

As of 2012, the next-generation firewall provides a wider range of inspection at the application layer, extending deep packet inspection functionality to include, but is not limited to:

• Web filtering
• Intrusion prevention systems
• User identity management
• Web application firewall

Endpoint specific

Endpoint-based application firewalls function by determining whether a process should accept any given connection. Application firewalls filter connections by examining the process ID of data packets against a rule set for the local process involved in the data transmission. Application firewalls accomplish their function by hooking into socket calls to filter the connections between the application layer and the lower layers. Application firewalls that hook into socket calls are also referred to as socket filters.^{[citation needed]}

Configuration

Setting up a firewall is a complex and error-prone task. A network may face security issues due to configuration errors.^[30]

Firewall policy configuration is based on specific network type (e.g., public or private), and can be set up using firewall rules that either block or allow access to prevent potential attacks from hackers or malware. ^[31]

See also

• Air gap (networking)
• Distributed firewall
• DMZ (computing)
• Firewall pinhole
• Firewalls and Internet Security
• Golden Shield Project
• Intrusion detection system
• Mobile security § Security software
• Windows Firewall

References

1. Boudriga, Noureddine (2010). Security of mobile communications. Boca Raton: CRC Press. pp. 32–33. ISBN 978-0849379420.
2. Macfarlane, Richard; Buchanan, William; Ekonomou, Elias; Uthmani, Omair; Fan, Lu; Lo, Owen (2012). "Formal security policy implementations in network firewalls". Computers & Security. 31 (2): 253–270. doi:10.1016/j.cose.2011.10.003.
3. Oppliger, Rolf (May 1997). "Internet Security: FIREWALLS and BEYOND". Communications of the ACM. 40 (5): 94. doi:10.1145/253769.253802. S2CID 15271915.
4. Canavan, John E. (2001). Fundamentals of Network Security (1st ed.). Boston, MA: Artech House. p. 212. ISBN 9781580531764.
5. Cheswick, William R.; Bellovin, Steven M. (1994). Firewalls and Internet Security: Repelling The Wily Hacker. ISBN 978-0201633573.
6. Liska, Allan (Dec 10, 2014). Building an Intelligence-Led Security Program. Syngress. p. 3. ISBN 978-0128023709.
7. Ingham, Kenneth; Forrest, Stephanie (2002). "A History and Survey of Network Firewalls" (PDF). Retrieved 2011-11-25.
8. Boren, Jacob (2019-11-24). "10 Times '80s Sci-Fi Movies Predicted The Future". ScreenRant. Retrieved 2021-03-04.
9. Naveen, Sharanya. "Firewall". Retrieved 7 June 2016.
10. "Firewall as a DHCP Server and Client". Palo Alto Networks. Retrieved 2016-02-08.
11. "DHCP". www.shorewall.net. Retrieved 2016-02-08.
12. "What is a VPN Firewall? – Definition from Techopedia". Techopedia.com. Retrieved 2016-02-08.
13. Vacca, John R. (2009). Computer and information security handbook. Amsterdam: Elsevier. p. 355. ISBN 9780080921945.
14. "What is Firewall?". Retrieved 2015-02-12.
15. Peltier, Justin; Peltier, Thomas R. (2007). Complete Guide to CISM Certification. Hoboken: CRC Press. p. 210. ISBN 9781420013252.
16. "TCP vs. UDP : The Difference Between them". www.skullbox.net. Retrieved 2018-04-09.
17. Cheswick, William R.; Bellovin, Steven M.; Rubin, Aviel D. (2003). Firewalls and Internet Security repelling the wily hacker (2 ed.). ISBN 9780201634662.
18. Ingham, Kenneth; Forrest, Stephanie (2002). "A History and Survey of Network Firewalls" (PDF). p. 4. Retrieved 2011-11-25.
19. McCanne, Steven; Jacobson, Van (1992-12-19). "The BSD Packet Filter: A New Architecture for User-level Packet Capture" (PDF).
20. McCanne, Steven; Jacobson, Van (January 1993). "The BSD Packet Filter: A New Architecture for User-level Packet Capture". USENIX.
21. M. Afshar Alam; Tamanna Siddiqui; K. R. Seeja (2013). Recent Developments in Computing and Its Applications. I. K. International Pvt Ltd. p. 513. ISBN 978-93-80026-78-7.
22. "Firewalls". MemeBridge. Retrieved 13 June 2014.
23. "Firewall toolkit V1.0 release". Retrieved 2018-12-28.
24. John Pescatore (October 2, 2008). . Archived from the original on April 29, 2016. Retrieved 2018-12-28.
25. Marcus J. Ranum; Frederick Avolio. "FWTK history".
26. "What is Layer 7? How Layer 7 of the Internet Works". Cloudflare. Retrieved Aug 29, 2020.
27. "5 Firewall Features you Must-Have". Check Point Software. Retrieved 2021-11-08.
28. Stanfield, Nathan (2019-12-04). "11 Firewall Features You Can't Live Without". Stanfield IT. Retrieved 2021-11-08.
29. "Safing Portmaster". safing.io. Retrieved 2021-11-08.
30. Voronkov, Artem; Iwaya, Leonardo Horn; Martucci, Leonardo A.; Lindskog, Stefan (2018-01-12). "Systematic Literature Review on Usability of Firewall Configuration". ACM Computing Surveys. 50 (6): 1–35. doi:10.1145/3130876. ISSN 0360-0300. S2CID 6570517.
31. "What is Firewall Configuration and Why is it Important?". Fortinet.

External links

 

The Wikibook Guide to Unix has a page on the topic of: OpenBSD PF firewall

 

Wikimedia Commons has media related to Firewall.

• Evolution of the Firewall Industry – discusses different architectures, how packets are processed and provides a timeline of the evolution.
• A History and Survey of Network Firewalls – provides an overview of firewalls at various ISO levels, with references to original papers where early firewall work was reported.