“A firewall is generally a separator and protector between
one thing and another. Traditionally used in building to help
contain fires and prevent their rapid spread, the modern firewall
is a computer running software allowing it to filter information
passing through. A firewall can work at several layers of the
network – at the highest level, application, and at the lowest
usually the datalink layer (MAC hardware address). Most firewalls
operate at the network and transport layer. They examine the TCP-IP
data packet and then usually make a decision based on the IP it
came from, the IP it is going to, the port it came from, the port
it is going to, or any combination of these. You can also look at
the header options and block based on those. Rules typically follow
the lines of “let anything connect to the mail server on port 25”
or “block access from anywhere to any port from 1 to 1024.”
Firewalls working at the application level can filter based on
content, checking for viruses, keywords and so on.”
“There aren’t too many alternatives to firewalls – something
that blocks traffic is generally classified as a firewall by
definition. While there are different levels of firewalls
(applications, packet, etc.), they are all related closely in
actual function: They take the data, inspect it, and then decide
whether to pass it or not. Some “packet mangling,” the rewriting of
header information, may take place as well. Because of this design,
firewalls share a common set of problems. All firewalls run an OS,
usually UNIX-based, such as FreeBSD or Linux. (NT can be used as
well, hopefully stripped down to reduce the number of potential
problems, and integrated with the OS, or set on top of it is a
firewall package.) The problem is that all modern OSs have far more
features and capabilities than most firewalls require, and many
vendors of add-on firewall packages, such as Firewall-1, do not
force the user to strip down the OS – and many admins do not. As a
result, there are numerous possible attacks against most firewalls.
NAI’s Gauntlet actually had a flaw that allowed a remote attacker
to gain full control of the firewall.”