知识库

1. 主页
2. What is ...

文章 85

What is a firewall?

A firewall is a system designed to reinforce the security of data flowing between an internal network and an outside network. Most firewalls combine two or more of the following methods because none provides adequate security by itself.

Packet Filtering

Packet filtering works at the Internet Protocol layer and accepts, rejects, or drops packets based on IP addresses, ports, or protocols. Packet filters apply configurable rules called policies. Packet filtering is the original and most basic type of firewalling, and most routers support it.

Disadvantages of packet filtering include:

• Address information in a packet can potentially be spoofed or falsified.
• The data contained in allowed packets cannot be checked and may contain exploits.
• Packet filters cannot provide application-level or user-level authentication.
• Once a protocol is allowed, external hosts can establish direct connections to internal hosts using that protocol, potentially exposing the private network configuration.

Packet filters are fast and transparent to users.

Application Gateway

An application gateway applies security mechanisms to specific applications, such as FTP and Telnet servers. This is effective but can reduce performance.

Circuit-Level Gateway

A circuit-level gateway applies security mechanisms when a TCP or UDP connection is established. After the connection has been made, packets can flow between the hosts without further checking.

Proxy Server

A proxy server intercepts messages entering and leaving the network and hides the true network addresses.

Stateful Inspection

Stateful inspection compares key parts of each packet with a database of trusted connection information. Outbound traffic is monitored for defining characteristics, and incoming traffic is compared with those characteristics. If the comparison produces a reasonable match, the traffic is allowed through.

References

For more information, see Wikipedia: Firewall.