Firewall Details & Types of Firewalls

 

What is Firewall?

A firewall is a secure and trusted machine that sits between a private network and a public network. The firewall machine is configured with a set of rules that determine which network traffic will be allowed to pass and which will be blocked or refused. In some large organizations, you may even find a firewall located inside their corporate network to segregate sensitive areas of the organization from other employees. Many cases of computer crime occur from within an organization, not just from outside.

Firewalls can be constructed in quite a variety of ways. The most sophisticated arrangement involves a number of separate machines and is known as a perimeter network. Two machines act as "filters" called chokes to allow only certain types of network traffic to pass, and between these chokes reside network servers such as a mail gateway or a World Wide Web proxy server.

According to use of firewall

Hardware Firewall:
 A Hardware Firewall is a physical piece of equipment that sits between the Internet and your computer. An example of a hardware firewall is a broadband router, a common form of Internet connection. The benefit of using a hardware firewall, is that it has the ability to protect multiple computer systems that are connected to it at the same time. This makes it an effective firewall for use in businesses that have multiple computers connected to the Internet, as well as in homes that have more than one computer system.

Software Firewall:
 Software Firewalls work in the same way as a hardware firewall, by monitoring and blocking information that comes to your computer via the Internet, however software firewalls must be installed as a program on your computer. These software firewalls can either be installed from a computer disk that you have purchased, or downloaded over the Internet. Software firewalls are the most common type of firewall. Programs such as Norton 360, Norton Internet Security, ESET Smart Security, and Kaspersky Internet Security all have a firewall bundled with

Types of Firewalls

Some of the most powerful firewall software on the market is designed to run on an ordinary computer — probably a dedicated server if you're securing a large network. Other firewall software is designed to run on proprietary hardware that you have to buy along with the software, turning the bundle into a "security appliance." As a general rule, appliances are faster, easier to install and operate — and also more expensive. But there's no guarantee that an appliance will do a better job than a software-only firewall. Software firewalls tend to be more flexible, and it's easier to upgrade the hardware it's running on.

Network-Level Firewalls

The first generation of firewalls (c. 1988) worked at the network level by inspecting packet headers and filtering traffic based on the IP address of the source and the destination, the port and the service. Some of these primeval security applications could also filter packets based on protocols, the domain name of the source and a few other attributes.

Network lavel firewall are fast, and today you'll find them built into most network appliances, particularly routers. These firewalls, however, don't support sophisticated rule-based models. They don’t understand languages like HTML and XML, and they are capable of decoding SSL-encrypted packets to examine their content. As a result, they can’t validate user inputs or detect maliciously modified parameters in an URL request. This leaves your network vulnerable to a number of serious threats.

Circuit Level Firewall:

These applications, which represent the second-generation of firewall technology, monitor TCP handshaking between packets to make sure a session is legitimate. Traffic is filtered based on specified session rules and may be restricted to recognized computers only. Circuit-level firewalls hide the network itself from the outside, which is useful for denying access to intruders. But they don't filter individual packets.

Application Firewall:

Recently, application-level firewalls (sometimes called proxies) have been looking more deeply into the application data going through their filters. By considering the context of client requests and application responses, these firewalls attempt to enforce correct application behavior, block malicious activity and help organizations ensure the safety of sensitive information and systems. They can log user activity too. Application-level filtering may include protection against spam and viruses as well, and be able to block undesirable Web sites based on content rather than just their IP address.

If that sounds too good to be true, it is. The downside to deep packet inspection is that the more closely a firewall examines network data flow, the longer it takes, and the heavier hit your network performance will sustain. This is why the highest-end security appliances include lots of RAM to speed packet processing. And of course you'll pay for the added chips.


Stateful Multi level Firewall:

SML vendors claim that their products deploy the best features of the other three firewall types. They filter packets at the network level and they recognize and process application-level data, but since they don't employ proxies, they deliver reasonably good performance in spite of the deep packet analysis. On the downside, they are not cheap, and they can be difficult to configure and administer.