Security Portal: Firewalls - OverviewAug 23, 2000, 20:38 (0 Talkback[s])
(Other stories by Kurt Seifried)
"A firewall is generally a separator and protector between one thing and another. Traditionally used in building to help contain fires and prevent their rapid spread, the modern firewall is a computer running software allowing it to filter information passing through. A firewall can work at several layers of the network - at the highest level, application, and at the lowest usually the datalink layer (MAC hardware address). Most firewalls operate at the network and transport layer. They examine the TCP-IP data packet and then usually make a decision based on the IP it came from, the IP it is going to, the port it came from, the port it is going to, or any combination of these. You can also look at the header options and block based on those. Rules typically follow the lines of "let anything connect to the mail server on port 25" or "block access from anywhere to any port from 1 to 1024." Firewalls working at the application level can filter based on content, checking for viruses, keywords and so on."
"There aren't too many alternatives to firewalls - something that blocks traffic is generally classified as a firewall by definition. While there are different levels of firewalls (applications, packet, etc.), they are all related closely in actual function: They take the data, inspect it, and then decide whether to pass it or not. Some "packet mangling," the rewriting of header information, may take place as well. Because of this design, firewalls share a common set of problems. All firewalls run an OS, usually UNIX-based, such as FreeBSD or Linux. (NT can be used as well, hopefully stripped down to reduce the number of potential problems, and integrated with the OS, or set on top of it is a firewall package.) The problem is that all modern OSs have far more features and capabilities than most firewalls require, and many vendors of add-on firewall packages, such as Firewall-1, do not force the user to strip down the OS - and many admins do not. As a result, there are numerous possible attacks against most firewalls. NAI's Gauntlet actually had a flaw that allowed a remote attacker to gain full control of the firewall."