Get Informed



A firewall is a combination of software and hardware components that controls the traffic that flows between a secure network (usually a company LAN) and an insecure network (usually, but not necessarily, the Internet), using rules defined by the system administrator. The firewall sits at the connection between the two networks. All traffic, from one network to the other, passes through the firewall. The firewall either allows, rejects or drops the traffic based on the security policy (rules programmed into the firewall).

Rejecting traffic sends a message back to the sender explaining that the message has been rejected. Dropping traffic simply ignores the packets concerned. The latter approach lengthens the time it would take for a network scan to complete since the sender is made to wait for the communication to time out.

The secure trusted network is said to be 'inside' the firewall; the insecure untrusted network is said to be 'outside' the firewall.

Firewalls are an essential part of Internet security. However, it is important to remember that they cannot provide complete security. They can do nothing to guard against insider threats, and they can do nothing to protect against threats that bypass the firewall (such as individual dialup connections to the Internet).

Furthermore, the firewall has to be configured to allow some traffic through - otherwise nobody on the inside could access the Internet nor send Internet e-mail. The fact that it allows some traffic through provides a channel that could potentially be exploited - and could certainly carry viruses.

So, while a firewall is essential, it is essential that it be only a part of an overall security policy.

One type of firewall involves routers that incorporate packet filtering. These are known as screening routers. Packets are intercepted and examined. Those packets not conforming to predefined rules are rejected, while the others were allowed to pass. Advantages of this approach are that it is efficient, widely available, and a single screening router can help to protect an entire network. Disadvantages are that packet filtering routers are complex to configure, difficult to test, and reduce router performance.

An 'improvement' to this approach is the addition of 'stateful inspection'. In this case the firewall 'remembers' conversations between the two systems, and it is only necessary to fully examine only the first packet of a conversation. This improves performance.

Another approach is to provide proxy services - also known as application-level gateways. A proxy service requires two components: a proxy server and a proxy client (which in some configurations can be normal client programs). A client inside the firewall will talk to the proxy server which 'pretends' to be the real (Internet) server outside of the firewall. In this way it can evaluate the traffic without requiring a direct connection between the secure and insecure networks.

Advantages of this approach include improved logging capabilities, ability to perform intelligent filtering, easier user authentication, capabilities for caching, and potential protection against malformed packets. Disadvantages include the need for new proxies for new services (which may not be immediately available); and the probable need to modify clients, applications or procedures.

History of the Firewall[1]

The first generation of firewall architectures appeared around 1985 and came out of Cisco's IOS software division. These are called packet filter firewalls. The first paper describing the screening process used by packet filter firewalls did not appear until 1988, when Jeff Mogul from Digital Equipment Corporation published his studies.

Around 1989-1990, Dave Presotto and Howard Trickey of AT&T Bell Labs pioneered the second generation of firewall architectures with research in circuit relays: circuit level firewalls. But they neither published any papers describing this architecture nor released a product based upon their work.

The third generation of firewall architectures was independently researched and developed by several people during the late 1980s and early 1990s - in particular, Gene Spafford of Purdue University, Bill Cheswick of AT&T Bell Laboratories, and Marcus Ranum: application layer firewalls. Ranum's work received the most attention in 1991 and took the form of bastion hosts running proxy services. This evolved into the first commercial product: Digital Equipment Corporation's SEAL product. Around 1991, Bill Cheswick and Steve Bellovin began researching dynamic packet filtering. In 1992, Bob Braden and Annette DeSchon at USC's Information Sciences Institute began independently researching dynamic packet filter firewalls for a system that they called "Visas." Check Point Software released the first commercial product based on this fourth generation architecture in 1994. During 1996, Scott Wiegel, Chief Scientist at Global Internet Software Group, Inc., began laying out the plans for the fifth generation firewall architecture: the Kernel Proxy architecture. Cisco Centri Firewall, released in 1997, is the first commercial product based on this architecture.

[1] précised from Evolution of the Firewall Industry, Cisco Systems Inc

See also:
Network Address Translation (NAT)