Firewall

Understanding Firewalls via an Analogy

Peng Liu College of IST

1

The confusing concepts

• A network receives packets and sends out packets – What is a network?– What is a packet?

• The attacker hacks a network via packets– Why a packet can enable the attacker to break into the network?

• Firewalls can protect a network– Why?

2

A network = a military base

3

outside outside

Network Military base

Weaponbuilding

Soliderbuilding

C & Cbuilding

Road

LAN

Customerdatabase

Webserver

OrderProcessingServer

MissionCritical!Money

Critical!

A packet = a van

4

outside

Network Military base

Weaponbuilding

Soliderbuilding

C & Cbuilding

Road

LAN

Customerdatabase

Webserver



Critical!

Pack

et

Pack

et

Good packets vs. bad packets

5

A good packet = a truck with chocolate

A bad packet = a truck with terrorists and bombs

Useful data

Malicious code

A bad packet can hack the network if you let it in!

6Network Military base

Weaponbuilding

Soliderbuilding

C & Cbuilding

Road

LAN

Customerdatabase

Webserver



Critical!

Pack

et

Pack

et

Look Into a Bad Packet

7

A network needs a firewall = a military base needs a guard


Weaponbuilding

Soliderbuilding

C & Cbuilding

Road

LAN

Customerdatabase

Webserver


Pack

et

Pack

etCheckpointFirewall

A packet filtering firewall = a guard that only checks the driver

9

Useful data

Header Payload Driver Payload

So a packet filtering firewall only checks the header

Which base are you from?Source IP address

Which unit are you from?

Which base are you to?

Which unit are you to?

… …

Source port number

Dest IP address

Dest port number

… …

A proxy firewall = a pseudo center


RealC&Ccenter

PseudoC & Ccenter

TelnetProxyserver

RealTelnetServer

Pack

et

Engineering

Firewall