Firewalls torn Apart By Ankit Fadia ankit@bol.net.in
_____________________________________________________________________________ 

A firewall is basically something that protects the network from the Internet. 
It is derived from the concept of 
firewalls used in vehicles which is a barrier made of fire resistant material 
protecting the vehicle in case of 
fire. Anyway a firewall is best described as a software or hardware or both 
Hardware and Software packet 
filter that allows only selected packets to pass through from the Internet to 
your private internal network. 
A firewall is a system or a group of systems which guard a trusted network( The 
Internal Private Network 
from the untrusted network (the Internet.) To understand how a firewall works, 
firstly we need to understand 
how exactly data is transferred on the Internet. 

NOTE: The following is a very weird, short and incomplete description of the 
TCP\IP protocol, I have just 
given a general idea of the whole data transmission process so that everyone can 
understand firewalls. 

The TCP\IP suite is responsible for successful transfer of data across a network 
both the Internet and the 
Intranet. The TCP\IP suite is a collection of protocols which are inter-related 
and interdependent and act as a 
set of rules according to which data is transferred across the network. A protocol 
can be defined as a language 
or a standard which is followed while transfer of data takes place. Lets go 
through a brief explanation of how 
data is transferred across a network following the various components of the 
TCP\IP suite. 
The whole process of data transmission begins when a user starts up an Internet 
application like the email 
client or a FTP client. The user types an email in his client and in this way 
provides data to be 
transferred. The email client is said to be a part of the application layer of 
the TCP\IP stack. Now this 
application layer (email client) provides data (the email itself) which has to be 
transferred to the Transmission 
control protocol or TCP which constitutes the Transfer Layer of TCP\IP. TCP breaks 
down the data i.e. the 
email into smaller chunks called packets and hands over the responsibility to the 
Internet Protocol or IP 
which forms the invisible network layer. This Internet Protocol adds some various 
info to each packet to 
ensure that the packet knows for which computer it is meant for and which port 
or application it is going to 
meet and from where it has come. An IP datagram contains: 

1. A header which contains the Source and Destination IP, Time to live info and 
also the protocol 
used. There is also a header checksum present. 
2. Remaining part contains the data to be transferred. 

You do not need to understand all this in detail but just remember that TCP 
breaks data into smaller packets 
and IP adds the source and destination IP's to the packets. When the data reaches 
the other server IP hands 
the packets to TCP again which re assembles the packets. Port numbers are also 
used to ensure that the 
packets know to which application it need to go to. So, basically we can conclude 
that a successful 
transmission of data across a network relies on the source and destination IP 
and also the ports. 

A firewall too relies on the source and destination IP and also the ports to 
control the packet transfer between 
the untrusted network and the trusted network. Firewalls can be classified into 3 
types: 

1. Packet Filter Firewalls 
2. Application proxy Firewalls 
3. Packet Inspection Firewalls 

Packet Filter Firewalls 

They are the earliest and the most criticized firewalls, which nowadays are not 
easily found. They are usually 
Hardware based i.e. Router Based (a router is a piece of device which connects two 
networks together.) 
Whenever a Packet Filter Firewall receives a packet for permission to pass 
through, it compares the header 
information i.e. the source and destination IP address, and port number with a 
table of predefined access 
control rules If the header information matches, then the packet is allowed to 
pass else the packet is 
dropped or terminated. They are not popular due to the fact that they allow 
direct contact between the 
untrusted system and the trusted private system. 
To understand such firewalls lets take the example of the secretary that sits in 
your office. This kind of 
secretary allows only those people who have an appointment to pass but if you 
convince her that her boss 
wants to meet her then she would allow you to pass. 
Such Firewalls can be fooled by using techniques like IP Spoofing in which we 
can change the source 
IP such that the firewall thinks that the packet has come from a trusted system 
which is among the list of 
systems which have access through the firewall. 

Application proxy Firewalls 

The shortcomings of the packet filter firewalls are addressed by the new type of 
firewalls developed by 
the DARPA. It was widely believed that the earlier type of firewalls were not 
secure enough as they allowed 
the untrusted systems to have a direct connection with the trusted systems. This 
problem was solved with 
the use of Proxy servers as firewalls. A proxy server which is used as a 
firewall are called application proxy 
servers. 
This kind of a proxy firewall examines what application or service (running on 
ports) a packet is meant for 
and if that particular service is available only then is the packet allowed to 
pass through and if the service is 
unavailable then the packet is discarded or dropped by the firewall. Once this 
is done, the firewall extracts 
the data and delivers it to the appropriate service. There is not direct 
connection between the untrusted 
systems with the trusted systems as the original data sent by the untrusted 
system is dropped by the firewall 
and it personally delivers the data. 

Let's again take the example of a secretary. Such a secretary would take a gift 
or something else for you 
only if you are available in the office and it would not allow the visitor to 
deliver the thing but would personally 
deliver it to you. Although they are somewhat slower, they are much more 
secure as they do not allow 
a direct contact between an untrusted network and a trusted network. 

Packet Inspection Firewalls 

It can be also known as an extension of the Packet Filter Firewall. It not only 
verifies the source and 
destination IP's and ports, it also takes into consideration or verifies that 
content of the data before passing it 
through. There are two ways in which this kind of a firewall verifies the data to 
be passed: 
State and Session. 
In case of state inspection, an incoming packet is allowed to pass through only 
if there is a matching 
outward bound request for this packet. This means that the incoming packet is 
allowed to pass through only 
if the trusted server had requested for it or had sent an invitation for it. 
In case of session filtering, the data of the incoming is not verified, but 
instead the network activity is traced 
and once a trusted system ends the session, no further packets from that system 
pertaining to that session 
are allowed to pass through. This protects against IP spoofing to a certain 
extend. 
Such firewalls can also be configured beforehand to act according to pre defined 
rules when it is attacked. It 
can also be configured to disconnect from the Internet in case of an attack. 

All along you will come across many Firewalls on various systems, basically a 
firewall can be established 
or setup in two ways: 

1. Dual-homed gateway 
2. Demilitarized zone (DMZ) 

In a dual homed gateway firewall, there is a single firewall with 2 connections, 
one for the trusted network 
and the other for the untrusted network. 
In the case of a Demilitarized Firewall or a DMZ there are two firewalls, each 
with two connections, but there 
is a slight difference in the case of a DMZ setup. 
In the case of a DMZ setup, there are two firewalls, the first having two 
connections, one leading to the 
untrusted network and the other leading to the host systems like the email 
server or the FTP server etc. 
These host systems can be accessed from the untrusted network. These host systems 
are connected with the 
internal private trusted systems through another firewall. Thus there is no 
direct contact between the 
untrusted network and the trusted internal network. The area or region between 
the two firewalls is termed as 
the demilitarized zone. 
In the case of a Dual Homed Gateway the untrusted network is connected to the 
host systems (email 
and FTP servers etc) through a firewall and these host systems are connected to 
the internal private 
network. There is no second firewall between the host systems and the internal 
private trusted network. 
The basic structure of the DMZ setup declares it to be a more secure system as 
even if an attacker gets 
through the first firewall, he just reaches the host systems, while the internal 
network is protected by another 
firewall. 

Do Firewalls provide enough Security for my Network? 

The answer is a simple no. There is no such thing that a firewall is enough to 
fulfill or satisfy all your 
security concerns. Yes it does protect the trusted systems from the untrusted 
ones, but they are definitely 
not enough for all your security needs. We need to protect our systems to secure 
the company data. The 
most common methods used to break into networks are brute force password 
cracking and social 
engineering. A firewall in no way can prevent such occurrences. 

There are other ways in which attackers can steal or destroy company data. Phone 
Tapping and the use of 
spy gadgets has become a common occurance.Although providing safety to the 
network to a large extend, a 
firewall is still not able to protect the company data from Viruses and Trojans, 
although some firewalls do 
provide for scanning everything being downloaded, the rate at which new HTML, 
Java and other viruses are 
propping up, it is becoming very difficult for firewalls to detect all 
viruses. Anyway firewalls provide no 
physical protection to the networks. It also provides no protection from fire, 
tornados etc.Yet another 
shortcoming is the fact that if the attacker is able to break into a trusted 
system which is provided access by 
the firewall, then he can easily gain access to the data at your network, as the 
firewall will think that he is 
actually the trusted party. 

Ankit Fadia 
ankit@bol.net.in 

http://www.crosswinds.net/~hackingtruths 

To receive more tutorials on Hacking, Cracking (Assembly), Perl, C++ and 
Viruses/Trojans and 
more join my mailing list: 

Send an email to programmingforhackers-subscribe@egroups.com to join it. 

Visit my Site to view all tutorials written by me at: 
http://www.crosswinds.net/~hackingtruths