What a network firewall does, and what it cannot stop

A network firewall controls a boundary choke point

A building’s firewall stops fire spreading between sections. For networks, the lecture prefers a castle’s moat: entry and exit pass through controlled points, keeping attackers away from the other defences.

A network firewall creates a choke point for traffic between trusted and untrusted networks. Rules there cover only traffic that passes through it.

A network firewall gives controlled access at the network level. It is installed where a protected subnetwork connects to a less trusted network. Unless a question says otherwise, assume the firewall sits between the Internet and the local network.

The ports that connect the firewall to each network are its interfaces. The default naming is the Internet interface for the port facing the Internet and the LAN interface for the port facing the local network. Later rule tables use inet and lan for these.

Do not confuse this with a host-based firewall. The lecture stresses that difference with its own slide: a network firewall guards a whole subnetwork from the boundary, and a host-based firewall runs on one machine.

Incoming and outgoing depend on the observer

Incoming and outgoing depend on where you stand when you look at the packet.

• LAN administrator’s view. Incoming is from the Internet to the local network. Outgoing is from the local network to the Internet.
• Firewall documentation’s view (the man page). Look from inside the firewall. On each interface there are incoming packets, those entering the firewall through that interface, and outgoing packets, those leaving through it. A packet that crosses the firewall is incoming on one interface and outgoing on another.

The two views give opposite answers for the same packet in some cases. A reply from the Internet to a LAN host is incoming for the administrator. For the firewall documentation it is incoming on the inet interface and then outgoing on the lan interface.

Compare

LAN administrator's view

Incoming means Internet to local network. Outgoing means local network to Internet. One direction each, defined by the boundary of the protected network.

Firewall documentation's view

Incoming means entering the firewall through any interface. Outgoing means leaving the firewall through any interface. Every interface has both.

Pitfall

Do not answer a question about direction until you know whose viewpoint it uses. A packet that is incoming for the LAN administrator can be outgoing on one of the firewall’s own interfaces.

A firewall cannot protect traffic that bypasses it

An attacker who is already inside, or who reaches the network over a path the firewall does not see, never has to get past the rules. Each limitation below is a version of this: the firewall can only judge traffic that crosses it.

Exam detail

The lecture lists what a firewall cannot do. Learn the list and the reason behind each item.

• Malicious insiders. The attacker is already on the protected side.
• Connections that do not go through it. A route around the firewall is not filtered at all.
• Completely new threats. Rules describe what the administrator already knows to allow or deny.
• Viruses, fully. If viruses spread through email and the email service is allowed through, which is typically the case, the firewall passes them.
• Cryptographic operations. A firewall does not authenticate messages. It is often co-located with VPN endpoints, and the VPN does the cryptography.
• Setting itself up correctly. Someone has to write the rules, and a wrong rule is a hole.

The lecture adds that firewalls work at specific layers of the protocol stack, so they can miss threats at higher layers such as email-based attacks and data-driven exploits in message headers, and that filtering at higher layers adds complexity and lowers processing speed. It also names human problems a firewall cannot solve, such as non-cooperation and transitive trust, where an indirect relationship between trusted networks brings in risk. Firewall software can also contain errors. A firewall used badly gives a false sense of security.

Optional aside

The last page of this module covers the setups built to limit the damage when one firewall is compromised, such as a DMZ with two firewalls.

Recall

A company allows email through its firewall. Name two limitations of the firewall that this one decision already exposes.

A virus carried by email passes, because the firewall allows the email service. A malicious insider can also send data out by email, because the traffic starts inside and leaves on a permitted service. Both are on the lecture’s list of things a firewall cannot stop.