Chapter 1 – Introduction and Description
Multi-Tech RouteFinder RF650VPN User Guide
13
The Firewall
The characteristic tasks of a firewall as a connection between WAN, LAN and DMZ are:
·
Protection from unauthorized access
·
Access control
·
Ensure information integrity
·
Perform analysis of protocols
·
Alert the administrator of relevant network events
·
Conceal internal network structure
·
Decoupling of servers and clients via proxies
·
Ensure confidentiality
There are several generic network components that, brought together under the heading Firewall, are
responsible for these tasks. The following sections provide a brief look at some of the forms and their
derivatives.
Network Layer Firewalls: Packet filter
As the name suggests, this is where IP packets (consisting of address information, some flags and the
payload) are filtered. With this kind of firewall you can grant or deny access to services, according to
different variables. Some of these variables are:
·
The source address
·
The target address
·
The protocol (e.g. TCP, UDP, ICMP)
·
The port number
The great advantage of a network layer firewall is its independence of both the operating system and the
applications running on the machine.
In more complex network layer firewall implementations, the packet filtering process includes the
interpretation of the packet payload. The status of every current connection is analyzed and recorded.
This process is called stateful inspection.
The packet filter records the state of every connection and only lets packets pass that meet the current
connection criteria. This is especially useful for establishing connections from a protected network to an
unprotected network.
If a system establishes a connection to a protected network, the Stateful Inspection Packet Filter lets a
host’s answer packet pass back into the protected network. If the original connection is closed, no system
from the unprotected network can send packets into the protected network any longer – unless you
explicitly allow it.
Well Known Ports are controlled and assigned by the IANA, and on most systems can only be used by
system (or root) processes or by programs run by privileged users. Ports are used in TCP (RFC793) to
name the ends of logical connections which carry long term conversations, and typically, these same port
assignments are used with UDP (RFC768). The assigned ports are in the range 0-1023. IETF RFC 1700
provides a list of the well-known port number assignments.
IETF RFCs are available on the Internet from a number of sources.
