“In this article I cover some of the design decisions that have
to be made before creating a firewall, from architecture to various
decisions that should be made.”
“A firewall is a device that separates and protects your
network, in most cases, from the Internet. It can restrict traffic
to only what is acceptable and allows monitoring so you can see
what is happening. Firewalls enforce a security policy by
establishing a single point for security decisions to be made. They
also limit exposure to the Internet, and allow you to log
traffic.”
“Firewalls can’t do many things. They can’t protect against
malicious insiders. If someone wants to copy your data onto a disk
and walk out with it, the best firewall known can do nothing about
it. Similarly, firewalls can’t protect connections that don’t pass
through them. If someone has a dialout modem, there is nothing the
firewall can do to protect this connection. And, perhaps most
important, firewalls can’t set themselves up. All firewalls need
some measure of configuration, and all networks are slightly
different. A misconfigured firewall may give you an illusion of
security, which might entice you to act as if you’re protected when
you really aren’t.”