Firewall

Firewall is a system designed to prevent unauthorized access to or from a private network. protects networked computers from intentional hostile intrusion that could compromise confidentiality or result in data corruption or denial of service.Firewalls can be implemented in both hardware and software program running on a secure host computer, or a combination of both. In either case, it must have at least two network interfaces, one for the network it is intended to protect, and one for the network it is exposed to.

Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

A firewall sits at the junction point or gateway between the two networks, usually a private network and a public network such as the Internet. The earliest firewalls were simply routers. The term firewall comes from the fact that by segmenting a network into different physical subnetworks, they limited the damage that could spread from one subnet to another just like firedoors or firewalls.

How does a firewall work?

Firewalls operate at different layers to use different criteria to restrict traffic. The lowest layer at which a firewall can work is layer three. In the OSI model this is the network layer. In TCP/IP it is the Internet Protocol layer. This layer is concerned with routing packets to their destination. At this layer a firewall can determine whether a packet is from a trusted source, but cannot be concerned with what it contains or what other packets it is associated with. Firewalls that operate at the transport layer know a little more about a packet, and are able to grant or deny access depending on more sophisticated criteria. At the application level, firewalls know a great deal about what is going on and can be very selective in granting access.


Firewalls fall into four broad categories:

1. Packet Filtering Firewall:

• In a packet filtering firewall, the firewall examines five characteristics of a packet:
  

1. Source IP address
2. Source port
3. Destination IP address
4. Destination port
5. IP protocol (TCP or UDP)
   

• Based upon rules configured into the firewall, the packet will either be allowed through, rejected, or dropped. If the firewall rejects the packet, it sends a message back to the sender letting him know that the packet was rejected. If the packet was dropped, the firewall simply does not respond to the packet. The sender must wait for the communications to time out. Dropping packets instead of rejecting them greatly increases the time required to scan your network. Packet filtering firewalls operate on Layer 3 of the OSI model, the Network Layer. Routers are a very common form of packet filtering firewall.

• Looks at each packet entering or leaving the network and accepts or rejects it based on user-defined rules. Packet filtering is fairly effective and transparent to users, but it is difficult to configure. In addition, it is susceptible to IP spoofing.
  

2. Stateful Inspection Firewall:

• Stateful inspection is a firewall architecture that works at the network layer. Unlike static packet filtering, which examines a packet based on the information in its header, stateful inspection tracks each connection traversing all interfaces of the firewall and makes sure they are valid.

• An example of a stateful firewall may examine not just the header information but also the contents of the packet up through the application layer in order to determine more about the packet than just information about its source and destination. A stateful inspection firewall also monitors the state of the connection and compiles the information in a state table. Because of this, filtering decisions are based not only on administrator-defined rules (as in static packet filtering) but also on context that has been established by prior packets that have passed through the firewall.

• As an added security measure against port scanning, stateful inspection firewalls close off ports until connection to the specific port is requested.
  

3. Application-Level Gateway(Application Proxy):

• The Application Level Gateway acts as a proxy for applications, performing all data exchanges with the remote system in their behalf. This can render a computer behind the firewall all but invisible to the remote system.

• It can allow or disallow traffic according to very specific rules, for instance permitting some commands to a server but not others, limiting file access to certain types, varying rules according to authenticated users and so forth. This type of firewall may also perform very detailed logging of traffic and monitoring of events on the host system, and can often be instructed to sound alarms or notify an operator under defined conditions.

• Application-level gateways are generally regarded as the most secure type of firewall. They certainly have the most sophisticated capabilities.

• A disadvantage is that setup may be very complex, requiring detailed attention to the individual applications that use the gateway.

• An application gateway is normally implemented on a separate computer on the network whose primary function is to provide proxy service.

4. Circuit-Level Gateway:

• A circuit level gateway is sometimes described as a second generation firewall. It is a fast unrestricted passage through the firewall based on predefined rules maintained in the TCP/IP kernel.

• A circuit level gateway operates at the transport layer of the OSI or internet reference models and, as the name implies, implements circuit level filtering rather than packet level filtering. It checks the validity of connections (i.e. circuits) at the transport layer (typically TCP connections) against a table of allowed connections, before a session can be opened and data exchanged. The rules defining a valid session prescribe, for example, the destination and source addresses and ports, the time of day, the protocol being used, the user and the password. Once a session is allowed, no further checks, for example at the level of individual packets, are performed.

• A circuit level gateway acts as a proxy and has the same advantage as an application level gateway in hiding the internal host from the serving host, but it incurs less processing than an application level gateway.

• Disadvantages of circuit level gateways include the absence of content filtering and the requirement for software modifications relating to the transport function.

• Circuit level gateways can be implemented within application level gateways or as stand-alone systems. Implementation within an application level gateway allows screening to be asymmetric, with a circuit level gateway in one direction and an application level gateway in the other.
  

What is a virtual private network (VPN)?



Basically, VPN gives extremely secure connections between private networks linked through the Internet. It allows remote computers to act as though they were on the same secure, local network.

A virtual private network (VPN) is a network that uses a public telecommunication infrastructure, such as the Internet, to provide remote offices or individual users with secure access to their organization's network. A virtual private network can be contrasted with an expensive system of owned, using a dedicated, real-world connection or leased lines that can only be used by one organization. A VPN uses "virtual" connections routed through the Internet from the company's private network to the remote site or employee. The goal of a VPN is to provide the organization with the same capabilities, but at a much lower cost.

Virtual private networks help distant colleagues work together, much like desktop sharing.

A VPN works by using the shared public infrastructure while maintaining privacy through security procedures and tunneling protocols such as the Layer Two Tunneling Protocol (L2TP). In effect, the protocols, by encrypting data at the sending end and decrypting it at the receiving end, send the data through a "tunnel" that cannot be "entered" by data that is not properly encrypted. An additional level of security involves encrypting not only the data, but also the originating and receiving network addresses.

Advantages

• Allows you to be at home and access your company's computers in the same way as if you were sitting at work.

• Almost impossible for someone to tap or interfer with data in the VPN tunnel.

• If you have VPN client software on a laptop, you can connect to your company from anywhere in the world.
  

Disadvantages

• Setup is more complicated than less secure methods. VPN works across different manufacturers' equipment, but connecting to a non-NETGEAR product will add to difficulty, since there may not documentation specific to your situation.

• The company whose network you connect to may require you to follow the company's own policies on your home computers

VPN goes between a computer and a network (client-to-server), or a LAN and a network using two routers (server-to-server). Each end of the connection is an VPN "endpoint", the connection between them is a "VPN tunnel". When one end is a client, it means that computer is running VPN client software.The two types of VPN:

1. VPN Client-to-Server (Client-to-Box)
2. VPN Server-to-Server (Box-to-Box)