Skip to main content
SpinXOR
SpinXOR
New Member
November 29, 2017
Question

What Does a Firewall Actually Block?

  • November 29, 2017
  • 1 reply
  • 5134 views

I am writing an article about servers within a LAN, and the importance of installing a firewall. I found myself wondering though what it is that a firewall actually blocks. I get that they obviously block connections to ports, but if there is nothing listening on that port, what is the risk?

Take for instance a LAN based web server with services (SSH & HTTP) listening on ports 22 and 80. What additional protection is the firewall offering by blocking connections to all other ports if there is nothing listening on those ports?

    1 reply

    IanW
    IanW
    New Member
    December 13, 2017

    Firewalls provide an element of your defense in depth strategy.

    You assume by the question that if you configure only ssh and http access on a server that is all that will ever be configured on that server.

    So what happens when someone makes a mistake and enables another service that shouldn't be there? Or if someone compromises the http server and uploads code that allows them to open a back dorr on another port? If there is a firewall in front of the serverit will stop access to unwanted connections on these ports.

    Also how do you manage the server? I assume via ssh but do you want that open to anyone on the Internet or locked down to only certain networks? A firewall can do this for you.

    Finally, modern firewalls such as a Fortigate do not just provide control to IP address and ports, they have a number of services such as DoS mitigation, user based access control, deep packet inspection, etc.....

    Ian

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    December 13, 2017

    Don't forget to mention that even if a Known Port is usually used for a 'benign' and essential service, such like DNS, this port still can be used for anything else.

    Taking DNS for example, which must be open to the internet all the time, a malicious software could use it's port to communicate to it's command&control server on the 'net. A FGT, employing Application Control, can detect this form of 'DNS tunneling' and block it.

    In comparison to such behavioral analysis a simple port filter is of little to no use nowadays. Real protection is based on deep packet inspection and behavior analysis (IPS, AppCtrl).

    emnoc
    emnoc
    New Member
    December 13, 2017

    And to go even farther,   the firewall today provide stateful-inspect.

     

    In the OP example, I could easily flood ssh/http with tcp-half opens if a fwirewall was not installed

     

    And lastly, modern firewalls  provide nexgen protection to protect AV and other nasties. In your   example, HTTP could be a delivery for downloading malicious code, virsus, trojans,etc... or a source or receiever

     

     

    Ken

    Terms & ConditionsAccessibility statement