What is a Network Firewall Security Policy?
Network firewall security policy defines those services that will be explicitly allowed or denied, how these services will be used and the exceptions to these rules. An organization's overall
security policy must be determined according to security and business-need analysis. Since a firewall relates to network security alone, a firewall has little value unless the overall security
policy is properly defined. Every rule in the network firewall security policy should be implemented on a firewall. Generally, a firewall uses one of the following methods.
Everything not specifically permitted is denied.
This approach blocks all traffic between two networks except for those services and applications that are permitted. Therefore, each desired service and application should be implemented one
by one. No service or application that might be a potential hole on the firewall should be permitted. This is the most secure method, denying services and applications unless explicitly allowed
by the administrator. On the other hand, from the point of users, it might be more restrictive and less convenient. This is the method we will use in our Firewall configuration files in this book.
Everything not specifically denied is permitted
This approach allows all traffic between two networks except for those services and applications that are denied. Therefore, each untrusted or potentially harmful service or application should be
denied one by one. Although this is a flexible and convenient method for the users, it could potentially cause some serious security problems.
What is Packet Filtering?
Packet Filtering is the type of firewall built into the Linux kernel. A filtering firewall works at the network level. Data is only allowed to leave the system if the firewall rules allow it. As
packets arrive they are filtered by their type, source address, destination address, and port information contained in each packet.
Most of the time, packet filtering is accomplished by using a router that can forward packets according to filtering rules. When a packet arrives at the packet-filtering router, the router extracts
certain information from the packet header and makes decisions according to the filter rules as to whether the packet will pass through or be discarded.
The following information can be extracted from the packet header:
Source IP address
Destination IP address
TCP/UDP source port
TCP/UDP destination port
ICMP message type
Encapsulated protocol information (TCP, UDP, ICMP or IP tunnel)
|
Because very little data is analyzed and logged, filtering firewalls take less
CPU power and create less latency in your network. There are lots of ways to structure your network to protect your systems
using a firewall.
