Section 7.4.

Firewalls Page 1 of 10

7.4. Firewalls
Firewalls were officially invented in the early 1990s, but the concept really reflects the reference
monitor (described in Chapter 5) from two decades earlier. The first reference to a firewall by that
name may be [RAN92]; other early references to firewalls are the Trusted Information Systems
firewall toolkit [RAN94] and the book by Cheswick and Bellovin [updated as CHE02].

What Is a Firewall?
A firewall is a device that filters all traffic between a protected or "inside" network and a less
trustworthy or "outside" network. Usually a firewall runs on a dedicated device; because it is a
single point through which traffic is channeled, performance is important, which means nonfirewall
functions should not be done on the same machine. Because a firewall is executable code, an
attacker could compromise that code and execute from the firewall's device. Thus, the fewer pieces
of code on the device, the fewer tools the attacker would have by compromising the firewall.
Firewall code usually runs on a proprietary or carefully minimized operating system.

The purpose of a firewall is to keep "bad" things outside a protected environment. To accomplish
that, firewalls implement a security policy that is specifically designed to address what bad things
might happen. For example, the policy might be to prevent any access from outside (while still
allowing traffic to pass from the inside to the outside). Alternatively, the policy might permit
accesses only from certain places, from certain users, or for certain activities. Part of the challenge
of protecting a network with a firewall is determining which security policy meets the needs of the
installation.

People in the firewall community (users, developers, and security experts) disagree about how a
firewall should work. In particular, the community is divided about a firewall's default behavior. We
can describe the two schools of thought as "that which is not expressly forbidden is
permitted" (default permit) and "that which is not expressly permitted is forbidden" (default deny).
Users, always interested in new features, prefer the former. Security experts, relying on several
decades of experience, strongly counsel the latter. An administrator implementing or configuring a
firewall must choose one of the two approaches, although the administrator can often broaden the
policy by setting the firewall's parameters.

Design of Firewalls
Remember from Chapter 5 that a reference monitor must be

always invoked

tamperproof

small and simple enough for rigorous analysis

A firewall is a special form of reference monitor. By carefully positioning a firewall within a network,
we can ensure that all network accesses that we want to control must pass through it. This
restriction meets the "always invoked" condition. A firewall is typically well isolated, making it
highly immune to modification. Usually a firewall is implemented on a separate computer, with

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 2 of 10

direct connections only to the outside and inside networks. This isolation is expected to meet the
"tamperproof" requirement. And firewall designers strongly recommend keeping the functionality of
the firewall simple.

Types of Firewalls
Firewalls have a wide range of capabilities. Types of firewalls include

packet filtering gateways or screening routers

stateful inspection firewalls

application proxies

guards

personal firewalls

Each type does different things; no one is necessarily "right" and the others "wrong." In this
section, we examine each type to see what it is, how it works, and what its strengths and
weaknesses are. In general, screening routers tend to implement rather simplistic security policies,
whereas guards and proxy gateways have a richer set of choices for security policy. Simplicity in a
security policy is not a bad thing; the important question to ask when choosing a type of firewall is
what threats an installation needs to counter.

Because a firewall is a type of host, it often is as programmable as a good-quality workstation.

While a screening router can be fairly primitive, the tendency is to host even routers on complete
computers with operating systems because editors and other programming tools assist in
configuring and maintaining the router. However, firewall developers are minimalists: They try to
eliminate from the firewall all that is not strictly necessary for the firewall's functionality. There is a
good reason for this minimal constraint: to give as little assistance as possible to a successful
attacker. Thus, firewalls tend not to have user accounts so that, for example, they have no
password file to conceal. Indeed, the most desirable firewall is one that runs contentedly in a back
room; except for periodic scanning of its audit logs, there is seldom reason to touch it.

Packet Filtering Gateway

A packet filtering gateway or screening router is the simplest, and in some situations, the most
effective type of firewall. A packet filtering gateway controls access to packets on the basis of
packet address (source or destination) or specific transport protocol type (such as HTTP web
traffic). As described earlier in this chapter, putting ACLs on routers may severely impede their
performance. But a separate firewall behind (on the local side) of the router can screen traffic
before it gets to the protected network. Figure 7-34 shows a packet filter that blocks access from
(or to) addresses in one network; the filter allows HTTP traffic but blocks traffic using the Telnet
protocol.

Figure 7-34. Packet Filter Blocking Addresses and Protocols.

[View full size image]

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 3 of 10

For example, suppose an international company has three LANs at three locations throughout the
world, as shown in Figure 7-35. In this example, the router has two sides: inside and outside. We
say that the local LAN is on the inside of the router, and the two connections to distant LANs
through wide area networks are on the outside. The company might want communication only
among the three LANs of the corporate network. It could use a screening router on the LAN at
100.24.4.0 to allow in only communications destined to the host at 100.24.4.0 and to allow out
only communications addressed either to address 144.27.5.3 or 192.19.33.0.

Figure 7-35. Three Connected LANs.

Packet filters do not "see inside" a packet; they block or accept packets solely on the basis of the
IP addresses and ports. Thus, any details in the packet's data field (for example, allowing certain
Telnet commands while blocking other services) is beyond the capability of a packet filter.

Packet filters can perform the very important service of ensuring the validity of inside addresses.
Inside hosts typically trust other inside hosts for all the reasons described as characteristics of
LANs. But the only way an inside host can distinguish another inside host is by the address shown

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 4 of 10

in the source field of a message. Source addresses in packets can be forged, so an inside
application might think it was communicating with another host on the inside instead of an outside
forger. A packet filter sits between the inside network and the outside net, so it can know if a
packet from the outside is forging an inside address, as shown in Figure 7-36. A screening packet
filter might be configured to block all packets from the outside that claimed their source address
was an inside address. In this example, the packet filter blocks all packets claiming to come from
any address of the form 100.50.25.x (but, of course, it permits in any packets with destination
100.50.25.x).

Figure 7-36. Filter Screening Outside Addresses.

The primary disadvantage of packet filtering routers is a combination of simplicity and complexity.
The router's inspection is simplistic; to perform sophisticated filtering, the filtering rules set needs
to be very detailed. A detailed rules set will be complex and therefore prone to error. For example,
blocking all port 23 traffic (Telnet) is simple and straightforward. But if some Telnet traffic is to be
allowed, each IP address from which it is allowed must be specified in the rules; in this way, the
rule set can become very long.

Stateful Inspection Firewall

Filtering firewalls work on packets one at a time, accepting or rejecting each packet and moving on
to the next. They have no concept of "state" or "context" from one packet to the next. A stateful
inspection firewall maintains state information from one packet to another in the input stream.

One classic approach used by attackers is to break an attack into multiple packets by forcing some
packets to have very short lengths so that a firewall cannot detect the signature of an attack split
across two or more packets. (Remember that with the TCP protocols, packets can arrive in any
order, and the protocol suite is responsible for reassembling the packet stream in proper order
before passing it along to the application.) A stateful inspection firewall would track the sequence
of packets and conditions from one packet to another to thwart such an attack.

Application Proxy

Packet filters look only at the headers of packets, not at the data inside the packets. Therefore, a
packet filter would pass anything to port 25, assuming its screening rules allow inbound
connections to that port. But applications are complex and sometimes contain errors. Worse,
applications (such as the e-mail delivery agent) often act on behalf of all users, so they require
privileges of all users (for example, to store incoming mail messages so that inside users can read
them). A flawed application, running with all users' privileges, can cause much damage.

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 5 of 10

An application proxy gateway, also called a bastion host, is a firewall that simulates the
(proper) effects of an application so that the application receives only requests to act properly. A
proxy gateway is a two-headed device: It looks to the inside as if it is the outside (destination)
connection, while to the outside it responds just as the insider would.

An application proxy runs pseudoapplications. For instance, when electronic mail is transferred to a
location, a sending process at one site and a receiving process at the destination communicate by a
protocol that establishes the legitimacy of a mail transfer and then actually transfers the mail
message. The protocol between sender and destination is carefully defined. A proxy gateway
essentially intrudes in the middle of this protocol exchange, seeming like a destination in
communication with the sender that is outside the firewall, and seeming like the sender in
communication with the real destination on the inside. The proxy in the middle has the opportunity
to screen the mail transfer, ensuring that only acceptable e-mail protocol commands are sent to
the destination.

As an example of application proxying, consider the FTP (file transfer) protocol. Specific protocol
commands fetch (get) files from a remote location, store (put) files onto a remote host, list files
(ls) in a directory on a remote host, and position the process (cd) at a particular point in a
directory tree on a remote host. Some administrators might want to permit gets but block puts,
and to list only certain files or prohibit changing out of a particular directory (so that an outsider
could retrieve only files from a prespecified directory). The proxy would simulate both sides of this
protocol exchange. For example, the proxy might accept get commands, reject put commands, and
filter the local response to a request to list files.

To understand the real purpose of a proxy gateway, let us consider several examples.

A company wants to set up an online price list so that outsiders can see the products and
prices offered. It wants to be sure that (a) no outsider can change the prices or product list
and (b) outsiders can access only the price list, not any of the more sensitive files stored
inside.

A school wants to allow its students to retrieve any information from World Wide Web
resources on the Internet. To help provide efficient service, the school wants to know what
sites have been visited and what files from those sites have been fetched; particularly
popular files will be cached locally.

A government agency wants to respond to queries through a database management system.

However, because of inference attacks against databases, the agency wants to restrict
queries that return the mean of a set of fewer than five values.

A company with multiple offices wants to encrypt the data portion of all e-mail to addresses
at its other offices. (A corresponding proxy at the remote end will remove the encryption.)

A company wants to allow dial-in access by its employees, without exposing its company
resources to login attacks from remote nonemployees.

Each of these requirements can be met with a proxy. In the first case, the proxy would monitor the
file transfer protocol data to ensure that only the price list file was accessed, and that file could
only be read, not modified. The school's requirement could be met by a logging procedure as part
of the web browser. The agency's need could be satisfied by a special-purpose proxy that
interacted with the database management system, performing queries but also obtaining the
number of values from which the response was computed and adding a random minor error term
to results from small sample sizes. The requirement for limited login could be handled by a
specially written proxy that required strong user authentication (such as a challengeresponse

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 6 of 10

system), which many operating systems do not require. These functions are shown in Figure 7-37.

Figure 7-37. Actions of Firewall Proxies.

[View full size image]

The proxies on the firewall can be tailored to specific requirements, such as logging details about
accesses. They can even present a common user interface to what may be dissimilar internal
functions. Suppose the internal network has a mixture of operating system types, none of which
support strong authentication through a challengeresponse token. The proxy can demand strong
authentication (name, password, and challengeresponse), validate the challengeresponse itself,
and then pass on only simple name and password authentication details in the form required by a
specific internal host's operating system.

The distinction between a proxy and a screening router is that the proxy interprets the protocol
stream to an application, to control actions through the firewall on the basis of things visible within
the protocol, not just on external header data.

Guard

A guard is a sophisticated firewall. Like a proxy firewall, it receives protocol data units, interprets
them, and passes through the same or different protocol data units that achieve either the same
result or a modified result. The guard decides what services to perform on the user's behalf in
accordance with its available knowledge, such as whatever it can reliably know of the (outside)
user's identity, previous interactions, and so forth. The degree of control a guard can provide is
limited only by what is computable. But guards and proxy firewalls are similar enough that the
distinction between them is sometimes fuzzy. That is, we can add functionality to a proxy firewall
until it starts to look a lot like a guard.

Guard activities can be quite sophisticated, as illustrated in the following examples:

A university wants to allow its students to use e-mail up to a limit of so many messages or so

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 7 of 10

many characters of e-mail in the last so many days. Although this result could be achieved by
modifying e-mail handlers, it is more easily done by monitoring the common point through
which all e-mail flows, the mail transfer protocol.

A school wants its students to be able to access the World Wide Web but, because of the slow
speed of its connection to the web, it will allow only so many characters per downloaded
image (that is, allowing text mode and simple graphics, but disallowing complex graphics,
animation, music, or the like).

A library wants to make available certain documents but, to support fair use of copyrighted
matter, it will allow a user to retrieve only the first so many characters of a document. After
that amount, the library will require the user to pay a fee that will be forwarded to the
author.

A company wants to allow its employees to fetch files via ftp. However, to prevent
introduction of viruses, it will first pass all incoming files through a virus scanner. Even
though many of these files will be nonexecutable text or graphics, the company administrator
thinks that the expense of scanning them (which should pass) will be negligible.

Each of these scenarios can be implemented as a modified proxy. Because the proxy decision is
based on some quality of the communication data, we call the proxy a guard. Since the security
policy implemented by the guard is somewhat more complex than the action of a proxy, the
guard's code is also more complex and therefore more exposed to error. Simpler firewalls have
fewer possible ways to fail or be subverted.

Personal Firewalls
Firewalls typically protect a (sub)network of multiple hosts. University students and employees in
offices are behind a real firewall. Increasingly, home users, individual workers, and small
businesses use cable modems or DSL connections with unlimited, always-on access. These people
need a firewall, but a separate firewall computer to protect a single workstation can seem too
complex and expensive. These people need a firewall's capabilities at a lower price.

A personal firewall is an application program that runs on a workstation to block unwanted

traffic, usually from the network. A personal firewall can complement the work of a conventional
firewall by screening the kind of data a single host will accept, or it can compensate for the lack of
a regular firewall, as in a private DSL or cable modem connection.

Just as a network firewall screens incoming and outgoing traffic for that network, a personal
firewall screens traffic on a single workstation. A workstation could be vulnerable to malicious code
or malicious active agents (ActiveX controls or Java applets), leakage of personal data stored on
the workstation, and vulnerability scans to identify potential weaknesses. Commercial
implementations of personal firewalls include Norton Personal Firewall from Symantec, McAfee
Personal Firewall, and Zone Alarm from Zone Labs (now owned by CheckPoint).

The personal firewall is configured to enforce some policy. For example, the user may decide that
certain sites, such as computers on the company network, are highly trustworthy, but most other
sites are not. The user defines a policy permitting download of code, unrestricted data sharing, and
management access from the corporate segment, but not from other sites. Personal firewalls can
also generate logs of accesses, which can be useful to examine in case something harmful does slip
through the firewall.

Combining a virus scanner with a personal firewall is both effective and efficient. Typically, users
forget to run virus scanners daily, but they do remember to run them occasionally, such as

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 8 of 10

sometime during the week. However, leaving the virus scanner execution to the user's memory
means that the scanner detects a problem only after the factsuch as when a virus has been
downloaded in an e-mail attachment. With the combination of a virus scanner and a personal
firewall, the firewall directs all incoming e-mail to the virus scanner, which examines every
attachment the moment it reaches the target host and before it is opened.

A personal firewall runs on the very computer it is trying to protect. Thus, a clever attacker is likely
to attempt an undetected attack that would disable or reconfigure the firewall for the future. Still,
especially for cable modem, DSL, and other "always on" connections, the static workstation is a
visible and vulnerable target for an ever-present attack community. A personal firewall can provide
reasonable protection to clients that are not behind a network firewall.

Comparison of Firewall Types

We can summarize the differences among the several types of firewalls we have studied in depth.
The comparisons are shown in Table 7-8.

Table 7-8. Comparison of Firewall Types.

Packet Stateful Application Guard Personal
Filtering Inspection Proxy Firewall
Simplest More complex Even more Most complex Similar to
complex packet
filtering
firewall
Sees only Can see either Sees full data Sees full text Can see full
addresses and addresses or portion of of data portion of
service data packet communication packet
protocol type
Auditing Auditing Can audit Can audit Canand
difficult possible activity activity usually
doesaudit
activity
Screens based Screens based Screens based Screens based Typically,
on connection on information on behavior of on screens based
rules across proxies interpretation on information
packetsin of message in a single
either header content packet, using
or data field header or data
Complex Usually Simple proxies Complex guard Usually starts
addressing preconfigured can substitute functionality in "deny all
rules can to detect for complex can limit inbound"
make certain attack addressing assurance mode, to
configuration signatures rules which user
tricky adds trusted
addresses as
they appear

Example Firewall Configurations

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 9 of 10

Let us look at several examples to understand how to use firewalls. We present situations designed
to show how a firewall complements a sensible security policy and architecture.

The simplest use of a firewall is shown in Figure 7-38. This environment has a screening router
positioned between the internal LAN and the outside network connection. In many cases, this
installation is adequate when we need only screen the address of a router.

Figure 7-38. Firewall with Screening Router.

However, to use a proxy machine, this organization is not ideal. Similarly, configuring a router for a
complex set of approved or rejected addresses is difficult. If the firewall router is successfully
attacked, then all traffic on the LAN to which the firewall is connected is visible. To reduce this
exposure, a proxy firewall is often installed on its own LAN, as shown in Figure 7-39. In this way
the only traffic visible on that LAN is the traffic going into and out of the firewall.

Figure 7-39. Firewall on Separate LAN.

For even more protection, we can add a screening router to this configuration, as shown in Figure
7-40. Here, the screening router ensures address correctness to the proxy firewall (so that the
proxy firewall cannot be fooled by an outside attacker forging an address from an inside host); the
proxy firewall filters traffic according to its proxy rules. Also, if the screening router is subverted,
only the traffic to the proxy firewall is visiblenot any of the sensitive information on the internal
protected LAN.

Figure 7-40. Firewall with Proxy and Screening Router.

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011
Section 7.4. Firewalls Page 10 of 10

Although these examples are simplifications, they show the kinds of configurations firewalls
protect. Next, we review the kinds of attacks against which firewalls can and cannot protect.

What Firewalls Canand CannotBlock

As we have seen, firewalls are not complete solutions to all computer security problems. A firewall
protects only the perimeter of its environment against attacks from outsiders who want to execute
code or access data on the machines in the protected environment. Keep in mind these points
about firewalls.

Firewalls can protect an environment only if the firewalls control the entire perimeter. That is,
firewalls are effective only if no unmediated connections breach the perimeter. If even one
inside host connects to an outside address, by a modem for example, the entire inside net is
vulnerable through the modem and its host.

Firewalls do not protect data outside the perimeter; data that have properly passed
(outbound) through the firewall are just as exposed as if there were no firewall.

Firewalls are the most visible part of an installation to the outside, so they are the most
attractive target for attack. For this reason, several different layers of protection, called
defense in depth, are better than relying on the strength of just a single firewall.

Firewalls must be correctly configured, that configuration must be updated as the internal
and external environment changes, and firewall activity reports must be reviewed periodically
for evidence of attempted or successful intrusion.

Firewalls are targets for penetrators. While a firewall is designed to withstand attack, it is not
impenetrable. Designers intentionally keep a firewall small and simple so that even if a
penetrator breaks it, the firewall does not have further tools, such as compilers, linkers,
loaders, and the like, to continue an attack.

Firewalls exercise only minor control over the content admitted to the inside, meaning that
inaccurate data or malicious code must be controlled by other means inside the perimeter.

Firewalls are important tools in protecting an environment connected to a network. However, the
environment must be viewed as a whole, all possible exposures must be considered, and the
firewall must fit into a larger, comprehensive security strategy. Firewalls alone cannot secure an
environment.

mk:@MSITStore:C:\Users\PANKY\AppData\Local\Temp\Rar$DI00.700\Pfleeger%20-%... 5/10/2011