[Day 6] 1. Firewall and its Types

A Firewall is a unit (hardware, software, or a combination of both) used to control network traffic. It allows authorized traffic and blocks unauthorized traffic to protect the network.

---

Classification of Firewalls

1. Single-Tier Firewall:

• Definition: A single-tier firewall connects two networks—one side is connected to the Local Area Network (LAN), and the other is connected to the Wide Area Network (WAN).
• Purpose: It acts as a simple boundary, controlling and filtering traffic between two networks (like a home network and the internet).
• Example: A small office or home setup where only two networks (internal and external) need to be separated.

2. Two-Tier Firewall:

• Definition: A two-tier firewall uses a router with three Network Interface Cards (NICs). Each NIC connects to different networks:

  • One NIC connects to the LAN.
  • Another NIC connects to the Internet (WAN).
  • The third NIC connects to the DMZ (Demilitarized Zone).

• Purpose: The two-tier architecture adds an extra layer of security by placing publicly accessible services (like FTP or web servers) in the DMZ, keeping them separate from the internal network. This prevents direct access to the internal LAN from the internet while still allowing necessary services to be exposed.

• Key Points:

  • LAN: The local network, connected to the internet but not directly exposed to it. It contains sensitive, internal systems.
  • DMZ: The Internet-facing zone where servers that need to be accessed from the internet (e.g., FTP, web servers) are placed. This is a buffer between the internal LAN and the external internet.

• Example: A company that has a public-facing website or email server but wants to keep its internal systems (HR, accounting) protected from direct access by external users.

3. N-Tier Firewall (3-Tier or Multi-Tier Firewall):

• Definition: An N-Tier firewall (also known as a 3-Tier firewall) involves more than two levels of security between different layers of a network infrastructure. It is commonly used in large-scale systems and enterprises where multiple layers are required to secure various applications and data.

• Purpose: The N-Tier firewall separates different parts of a network or application (e.g., web servers, application servers, and databases) into multiple tiers, ensuring that each layer has its own firewall protection. This setup helps prevent threats from one layer of the infrastructure reaching other critical systems.

• Example:

  1. You make a product search on an e-commerce website (e.g., Amazon).
  2. Your request first passes through a firewall (protecting the web server).
  3. The request then reaches the Application Engine (which processes the data), which is secured by a second firewall.
  4. Finally, the request accesses the Database (containing product details), where a third firewall protects it from unauthorized access.

  Each firewall layer ensures that traffic and data are secured at different levels of the architecture, from the public-facing web server to the internal database, ensuring a strong, multi-layered security structure.

Key Differences Between the Architectures:

• Single-Tier Firewall: Basic, only separates two networks (LAN and WAN).
• Two-Tier Firewall: Adds an extra layer with the DMZ, providing a buffer zone for publicly accessible servers.
• N-Tier Firewall: Complex, used in large systems where multiple firewalls protect different layers of the infrastructure for enhanced security.

Each type of firewall architecture increases the level of security by adding layers, ensuring that traffic is filtered and controlled more effectively as it moves through the network.

---

2. Based on Type

1. Hardware Firewall

   • More reliable and robust than software firewalls.
   • Costly but provides high reliability.
   • Typically includes a software firewall as part of its functionality.

2. Software Firewall

   • Less reliable than hardware firewalls.
   • Relatively cheaper and easier to implement.

---

DMZ (Demilitarized Zone)

A DMZ is a buffer zone between a private network (LAN) and the public Internet (WAN).

• Key Characteristics:
  • Contains public-facing servers (e.g., web servers, mail servers).
  • Protects the private network by minimizing direct exposure to external threats.
  • Can be considered part of both LAN and WAN.

---

Firewall Implementation Methods

Firewalls can be implemented using two primary methodologies:

1. Permit All (Default)

   • Allows all traffic by default.
   • Blocks traffic only through explicit denial rules.

2. Deny All (Default)

   • Blocks all traffic by default.
   • Allows traffic only through explicit permit rules.

---

Firewall Filtering Techniques

1. Packet Filtering

   • Only inspects packets from outside the network (Layers 1 to 4 of the OSI model).
   • Known as First-Generation Firewall.

2. Application Proxies

   • Inspects both packets and the data they carry (all OSI layers).
   • Used for in-depth traffic analysis and filtering.
   • Example: Squid Proxy.
   • Known as Second-Generation Firewall.

---