Handbook of Information Security: Threats, Vulnerabilities, Prevention, Detection, and Management, Volume 3

Packet Filtering and Stateful Firewalls

Avishai Wool, Tel Aviv University, Israel

Introduction

Observe All Traffic

Differentiate

Work Fast

Basic Packet Filtering

What Is It?

Limitations of Basic Packet Filtering

Stateful Packet Filtering

What Is It?

Advantages of Stateful Filtering

Limitations of Stateful Filtering

Dynamic Port Selection

Matching Algorithms

Common Configuration Errors

Rule Set Complexity

Which Configuration Errors to Count?

Results and Analysis

Complexity Matters: Small Is Beautiful

Direction-Based Filtering

Background

Why Use Direction-Based Filtering?

Usability Problems with Direction-Based Filtering

Advanced Firewall Management

Higher Level Configuration

Firewall Analysis

Glossary

Cross References

References

INTRODUCTION

The Internet is like a system of roads that transport packets of data from one computer network to another, using the transmission control protocol/Internet protocol (TCP/IP) protocol suite. However, not all IP traffic is welcome everywhere. Most organizations need to control the traffic that crosses into and out of their networks: to prevent attacks against their computer systems, to prevent attacks originating from their network against other organizations, to prevent attacks originating from inside of the organization against other parts of the organization (insider threat, i.e., an employee in finance trying to get into the human resources department network), and to conform with various policy choices. The firewall is the primary control ...