by Laura S.

Created on: November 15, 2008

Some people define a firewall as a specific box designed to filter Internet traffic-something you buy or build. But you may already have a firewall. Most routers incorporate simple packer filters; depending on your security, such a filter may be all you need. If nothing else, a router can be part of a total firewall system-firewalls need not be one simple box.

We think a firewall is any device, software, or arrangement or equipment that limits network access. It can be a box that you buy or build, or a software layer in something else. Today, firewalls come "for free" inside many devices: routers, modems, wireless base stations, and IP switches, to name a few. Software firewalls are available for (or included with) all popular operating systems. They may be a client shim (a software layer) inside a PC running Windows, or a set of filtering rules implemented in a UNIX kernel.

The quality of all these firewalls can be quite good: The technology has progressed nicely since the dawn of the Internet. You can buy fine devices, and you can build them using free software. When you pay for a firewall, you may get fancier interfaces or more through application level filtering. You may also get customer support, which is not available for the roll-your-own varieties of firewalls.

Firewalls can filter at a number of different levels in a network protocol stack. There are three main categories: Packet Filtering, Circuit gateways, and application gateways. Each of these is characterized by the protocol level it controls, from lowest to highest, but these categories get blurred. For example, a packet filter runs at the IP level, but may peek inside for TCP information, which is at the circuit level. Commonly, more than one of these is used at the same time. As noted earlier, mail is often routed through an application gateway even when no security firewall is used. There is also a fourth type of firewall-a dynamic packet filter is a combination of a packet filter and a circuit-level gateway, and it often has application layer semantics as well.

There are other arrangements that can limit network access. For example, consider a network that has two branches: One contains highly attack-resistant hosts, the other has systems either highly susceptible to attack or with no need to access the Internet (e.g. network printers).Hosts on the first net have routable Intent addresses; those on the second have RFC 1918 addressing. The nets can talk to each other, but people on the Internet can reach only the announced hosts-no addressing is available to reach the second network, unless one can bounce packets off the accessible hosts, or compromise one of them. (In some environments, it's possible to achieve the same effect without even using a router, by having two networks share the same wire).

Learn more about this author, Laura S..
Click here to send this author comments or questions.