The firewall
What a firewall is, its five families (stateless filter, stateful filter, proxy, web application firewall, host firewall), where to place it and what it does not stop.
- 26 cards
- 6 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- On the diagram
- Scenarios
- Understand
A few cards from the deck
Stateless packet filter: what is it?
Show the answer
A firewall that judges each packet on its own, from its addresses, port and protocol, without remembering earlier packets.
It is fast and simple, but cannot tell whether an incoming packet answers an outgoing request: ports have to be opened wide to let replies through.
An internal machine opens a connection to a website. What does a stateful firewall do with the reply packet coming from the site?
- It lets it through, because it matches a connection it saw being opened
- It blocks it, because no rule allows incoming traffic
- It lets it through, because every reply is allowed without any check
- It blocks it, because the site's source address is external to the network
Show the answer
It lets it through, because it matches a connection it saw being opened
The stateful firewall keeps the connection opened from inside in memory. The reply is recognised as part of it. An incoming packet with no matching connection is refused.
With a … policy, any flow that no rule allows is ….
Show the answer
With a default deny policy, any flow that no rule allows is blocked.
It is the opposite of a permissive policy: a forgotten or misordered rule opens fewer doors.
Stateful firewall: what is it?
Show the answer
A firewall that remembers open connections and lets their replies through without a rule of their own.
Allowing the outgoing request is enough: the connection table allows the return, and any incoming packet that matches nothing is refused.