Internet Tips What is a firewall? A simplified explanation The term "fire wall" originally meant, and still means, a fireproof wall intended to prevent the spread of fire from one room or area of a building to another. The Internet is a volatile and unsafe environment when viewed from a computer-security perspective, therefore "firewall" is an excellent metaphor for network security. In computer networking, the term firewall is not merely descriptive of a general idea. It has come to mean some very precise things. A firewall is a system or group of systems that enforces an access control policy between two networks. The actual means by which this is accomplished varies widely, but in principle, the firewall can be thought of as a pair of mechanisms: one which exists to block traffic, and the other which exists to permit traffic. Some firewalls place a greater emphasis on blocking traffic, while others emphasize permitting traffic. Probably the most important thing to recognize about a firewall is that it implements an access control policy. If you don't have a good idea of what kind of access you want to allow or to deny, a firewall really won't help you. It's also important to recognize that the firewall's configuration, because it is a mechanism for enforcing policy, imposes its policy on everything behind it. Why would I want a firewall? The Internet, like any other society, is plagued with the kind of jerks who enjoy the electronic equivalent of writing on other people's walls with spray paint, tearing their mailboxes off, or just sitting in the street blowing their car horns. Some people try to get real work done over the Internet, and others have sensitive or proprietary data they must protect. Usually, a firewall's purpose is to keep the jerks out of your network while still letting you get your job done. A firewall protects your network from unwanted Internet traffic. The primary functions of a firewall are to let good traffic pass through while 'bad' traffic gets blocked. The most important part of a firewall is its access control features that distinguish between good and bad traffic. When installed, a firewall exists between your computer(s) and the Internet. The firewall lets you request web pages, download files, chat, etc. while making sure other people on the internet can not access services on your computer like file or print sharing. Some firewalls are pieces of software that run on your computer. Other firewalls are built into hardware and protect your whole network from attacks. Everyone connected to the Internet should be running some sort of firewall. Programs can be downloaded on the Internet that can scan huge ranges of IP address for vulnerabilities like file sharing services. These programs are easy to download and run. Almost no network knowledge is needed to use these programs to exploit or harm your computer. Any kind of firewall will keep you safe from these types of attacks. Software Firewall Software firewalls are programs that run on your computer and nestle themselves between your modem and your operating system. They intercept attacks before your operating system can even acknowledge them. http://www.homenethelp.com/web/howto/free-firewall.asp list's a number of popular firewalls. Simple NAT firewall The firewalls that are built into broadband routers and software like Microsoft ICS are very simple firewalls. They protect your LAN by not letting anyone figure out how to 'directly' talk to any of the computers on your LAN. This level of protection will keep out almost all kinds of hackers. Advanced hackers may be able to take advantage of certain inadequacies of NAT based firewalls, but they are few and far between. The basic idea behind a simple NAT firewall is that it transparently maps multiple internal network addresses to and from the external Internet address of the firewall, and will only pass specific packets from the external Internet to the internal protected network. The downside is that NAT Firewalls/Routers provide little or no security to control access from local desktop PCs to the internet. So if you need to control what individuals inside your network can access on the internet, then simple NAT firewalls are not going to be a whole solution. Such features can only be provided by more feature rich (and expensive) firewalls or proxy servers. Firewalls with stateful packet inspection The new trend in home networking firewalls is called stateful packet inspection. This is an advanced form of firewall that examines each and every packet of data as it travels through the firewall. The firewall scans for problems in the packet that might be a symptom of a 'denial of service' (dos) attack or advanced attacks. Most people are never subject to these types of attacks, but there are some areas of the Internet that invite these kinds of attacks. Most often, these attacks come from being involved in certain kinds of competitive on-line gaming or participating in questionable mIrc channels. Usually, a firewall's purpose is to keep the jerks out of your network while still letting you get your job done. A firewall is only effective when it is integrated and understood as part of an overall security architecture. Firewalls won't protect against idiots, traitors, or wily hackers who operate from within, who walk out the door with sensitive data on their laptop or a disk in their briefcase; nor can firewalls keep out most viruses. Also note that most firewalls won't prevent computer virus or other destructive programs from getting inside your network via e-mail or by downloading off the web. To stop these problems you need to run anti-virus software on all your PC's and make sure it's virus definitions are updated on a regular basis either automatically or manually at least once a month (preferable weekly). Terminology Firewall A device/program that is used to protect internal computer system(s) from attacks by external systems on the internet. Gateway A system/device that routes packets between a local network to an external network such as a corporate WAN or the internet. NAT / Network Address Translation Firewall This is a very common type of Firewall/Router that is used by home networks and small offices because of easy configuration and transparency to most applications. The down side of this type of firewall it generally does not let you authenticate & control access by individual internal users. Proxy Firewall A firewall that runs application specific Proxy for each protocol that is to be used for accessing external sites. Proxies of this type typically handle web, FTP, and mail traffic and are typically used in large offices and corporation where there is staff to administer it. The upside of this type of firewall is that it allows a lot of filtering and user authentication to be done at the firewall. Filtering can include virus scanning of all incoming data and filtering out banned sites. The downside with a strait proxy firewall is if there no proxy available for a particular protocol / application then you cannot use it though the firewall. For this reason Proxy Firewalls will contain NAT features to let them handle protocols for which they have no proxy. Bug Is a generic term used to describe an error of some sort in computer code. Bugs in programs can cause them to behave in unintended ways under specific circumstances, usually with undesirable consequences. FTP Short for File Transfer Protocol, FTP is one of the key protocols used to shuffle files from servers to people requesting them. FTP for most users has been largely replaced by HTTP a simpler protocol created for the world wide web. HTTP Short for Hyper Text Transfer Protocol, HTTP is the primary protocol of the world wide web and is the protocol that is used by all web servers. HTTP and HTML was invented by Tim Berbers-Lee in 1989 when working in CERN (European Agency for High Energy Physics) as a way to easily view and link documents together. SMTP Short for Simple Mail Transport Protocol, SMTP is the language that e-mail servers on the internet use to talk to each other. SMTP is a very mature protocol since it was one of the first protocols implemented when the internet started.