Firewalls

Overview

A firewall is a network security system that controls incoming and outgoing traffic based on configurable security rules called firewall rules. Network-based firewalls are positioned between two or more networks. Host-based firewalls are deployed directly on a host, usually as a part of an operating system.

Packet-Filtering Firewalls

A packet-filtering firewall acts as a router. It forwards or discards packets whose headers meet (or fail to meet) its configured firewall rules. Packet-filtering firewalls are further categorized as stateless or stateful.

DMZs

A demilitarized zone (DMZ) is a physical or logical subnet that contains and exposes an organization's external-facing services to an untrusted network (e.g. the Internet). More recently, this is called a screened subnet.

In a single firewall architecture, a single firewall with 3 network interfaces can be used to connect an intranet, extranet/DMZ, and the Internet. This setup is also called the three-legged model.

In a dual firewall architecture, one firewall separates the extranet/DMZ and internet while another firewall separates the intranet from the extranet. This setup is also called the back-to-back model.

Proxy Firewalls

A proxy firewall is essentially a host running one or more application-layer gateways. Connections initiated from inside a network terminate at the proxy firewall, which opens a separate connection to the desired end host.