Firewall Policies

To protect private networks and individual machines from the dangers of the greater Internet, a firewall can be employed to filter incoming or outgoing traffic based on a predefined set of rules called firewall policies.

Policy Actions

• Packets flowing through a firewall can have one of three outcomes:

1. Accepted: permitted through the firewall
2. Dropped: not allowed through with no indication of failure
3. Rejected: not allowed through, accompanied by an attempt to inform the source that the packet was rejected

• Policies used by the firewall to handle packets are based on several properties of the packets being inspected, including the protocol used, such as:

1. TCP or UDP
2. the source and destination IP addresses
3. the source and destination ports
4. the application-level payload of the packet (e.g., whether it contains a virus).

Blacklists and White Lists

There are two fundamental approaches to creating firewall policies (or rulesets) to effectively minimize vulnerability to the outside world while maintaining the desired functionality for the machines in the trusted internal network (or individual computer).

• Blacklist approach

1. All packets are allowed through except those that fit the rules defined specifically in a blacklist.
2. This type of configuration is more flexible in ensuring that   service to the internal network is not disrupted by the firewall, but is naïve from a security  perspective in that it assumes the network administrator can enumerate all of the properties of malicious traffic.

• Whitelist approach

1. A safer approach to defining a firewall ruleset is the default-deny policy, in which packets are dropped or rejected unless they are specifically allowed by the firewall.

All Done!