Section 10: Firewalls

The Big Picture: A Security Guard at the Door

An apartment building has a guard at the entrance. The guard has a list of rules: "Residents may enter. Delivery drivers may go to the front desk only. Strangers who knock on the door are not let in." The guard checks every person against the list and says allow or deny.

A firewall is the same guard for network traffic. It looks at each packet and decides, using a list of rules, whether to let it through or drop it.

10.1 The Packet Filtering Concept

What it is: A firewall is software or hardware that filters network traffic according to rules. The basic idea is called packet filtering: look at the headers of each packet (Section 1.5) and match them against the rules.

What a rule can look at:

Rules are read in order, top to bottom (for many firewalls). The first rule that matches decides. The last rule is the default: what happens to everything that matched nothing.

 Packet arrives
    │
    ▼
 Rule 1: allow TCP, port 443, any source?     match ──► ALLOW
    │ no match
 Rule 2: allow UDP, port 53?                  match ──► ALLOW
    │ no match
 Rule 3: allow ICMP echo (ping) from LAN?     match ──► ALLOW
    │ no match
 Default rule: deny everything else.                ──► DROP

Default deny. A well-built firewall follows the rule "deny by default, allow by exception". For inbound traffic that is the normal setting: nothing from outside is allowed in unless a rule says so. This is also why a freshly installed program that wants to listen (Section 7) pops up a message from Windows asking if it may be allowed through.

Two main places for a firewall:

They work together. Your home router blocks most unwanted incoming traffic from the Internet (partly thanks to NAT, Section 9). Your PC's firewall protects the PC from other devices on your Wi-Fi, such as a café neighbour or an infected laptop.

 INTERNET ──► [ router: network firewall + NAT ] ──► home network ──► [ PC: host firewall ] ──► programs

Block versus drop. A firewall can reject (send back an error, like "connection refused") or silently drop (send nothing). Silent drop is stealthier but makes connections time out after a wait. This matches the difference in Section 6.3 between a refusal (RST) and a timeout.

Windows Defender Firewall in plain words. Windows ships with a built-in host firewall that is on by default:

Look at it safely (read-only): Press Win, type Windows Security, open Firewall & network protection. You will see the three profiles and which is active. (The Advanced settings link opens a tool that lists all rules. Look only; do not change anything in this course.)

Warning. Do not turn the firewall off "to fix the problem". If a program cannot connect, the safer fix is to add an allow rule for that one program. Turning everything off leaves your PC open to every device on the network.

What a firewall cannot do: It cannot stop a malicious program that you start yourself and that makes outgoing connections (the default outbound rule allows them). It cannot read encrypted web traffic. It is one layer of defence, with updates, antivirus, and sensible clicking.

10.2 Stateful versus Stateless Filtering

What it is: There are two ways for a firewall to decide.

Stateless filtering looks at each packet alone, with no memory. It matches only the header against the rule list.

Stateful filtering also remembers connections. It keeps a state table with one row per conversation (very much like the NAT table in Section 9.2). A packet that is part of a conversation you started is allowed back in automatically.

Why a stateless firewall has a hard job. Say you want your PC to browse the web (outbound, TCP port 443). The replies come back inbound, from port 443 to your ephemeral port (Section 7), for example 50123. A stateless firewall must either:

• allow all inbound traffic from port 443 to ports 49152-65535, even traffic nobody asked for (loose), or
• block it, and break browsing.

A stateful firewall solves it neatly:

 1. You open a connection to 93.184.216.34:443 from port 50123.
    Firewall: outbound allowed. It writes a row in its state table:

    ┌──────────┬──────────────────────┬──────────────────────┬─────────────┐
    │ Protocol │ Local                │ Remote               │ State       │
    ├──────────┼──────────────────────┼──────────────────────┼─────────────┤
    │ TCP      │ 192.168.1.25:50123   │ 93.184.216.34:443    │ ESTABLISHED │
    └──────────┴──────────────────────┴──────────────────────┴─────────────┘

 2. A reply arrives from 93.184.216.34:443 to port 50123.
    It matches a row in the table: it belongs to a connection you opened → ALLOW.

 3. A packet arrives from 203.0.113.99:443 to port 50123 (not in the table).
    No row matches, no rule allows it → DROP.

How the three-way handshake (Section 6.3) fits. A stateful firewall sees the first SYN. It checks the rules. If allowed, it creates the state row. The SYN-ACK and ACK then match the row. A packet that claims to be "in the middle of a connection" but has no row is dropped.

Stateful filtering and UDP. UDP has no connection, but the firewall still tracks it: it remembers "this PC sent a datagram to 8.8.8.8:53 from port 50930" and allows a reply from that address and port for a short time. After a timeout, the row is removed.

Putting the chapter together. Follow one web visit from start to end:

Summary