Network Warrior, 2nd Edition

Chapter 27. Basic Firewall Theory

A firewall is the wall in a car that protects you from harm when the engine catches fire. At least, that’s the definition that confused my mother when I told her I was writing this chapter. In networking, a firewall is a device that prevents certain types of traffic from entering or leaving your network. Usually, the danger comes from attackers attempting to gain access to your network from the Internet, but not always. Firewalls are often deployed when networks are connected to other entities that are not trusted, such as partner companies.

A firewall can be a standalone appliance, software running on a server or router, or a module integrated into a larger device, like a Cisco 6500 switch. These days, a firewall’s functionality is often included in other devices, such as the ubiquitous cable-modem/router/firewall/wireless access point devices in many homes.

Modern firewalls can serve multiple functions, even when they’re not part of combination devices. VPN services are often supported on firewalls. A firewall running as an application on a server may share the server with other functions such as DNS or mail, though generally, a firewall should restrict its activities to security-related tasks. The Cisco Adaptive Security Appliance (ASA) is a firewall that is bundled with other security features like VPN and IDS/IPS.

Best Practices

One of the things I tell my clients over and over is:

Security is a balance between convenience and paranoia. ...