What Does a Firewall Actually Block?

[SpinXOR]

I am writing an article about servers within a LAN, and the importance of installing a firewall. I found myself wondering though what it is that a firewall actually blocks. I get that they obviously block connections to ports, but if there is nothing listening on that port, what is the risk?

Take for instance a LAN based web server with services (SSH & HTTP) listening on ports 22 and 80. What additional protection is the firewall offering by blocking connections to all other ports if there is nothing listening on those ports?

[IanW]

Firewalls provide an element of your defense in depth strategy.

You assume by the question that if you configure only ssh and http access on a server that is all that will ever be configured on that server.

So what happens when someone makes a mistake and enables another service that shouldn't be there? Or if someone compromises the http server and uploads code that allows them to open a back dorr on another port? If there is a firewall in front of the serverit will stop access to unwanted connections on these ports.

Also how do you manage the server? I assume via ssh but do you want that open to anyone on the Internet or locked down to only certain networks? A firewall can do this for you.

Finally, modern firewalls such as a Fortigate do not just provide control to IP address and ports, they have a number of services such as DoS mitigation, user based access control, deep packet inspection, etc.....

Ian

[ede_pfau]

Don't forget to mention that even if a Known Port is usually used for a 'benign' and essential service, such like DNS, this port still can be used for anything else.

Taking DNS for example, which must be open to the internet all the time, a malicious software could use it's port to communicate to it's command&control server on the 'net. A FGT, employing Application Control, can detect this form of 'DNS tunneling' and block it.

In comparison to such behavioral analysis a simple port filter is of little to no use nowadays. Real protection is based on deep packet inspection and behavior analysis (IPS, AppCtrl).

[emnoc]

And to go even farther,   the firewall today provide stateful-inspect.

In the OP example, I could easily flood ssh/http with tcp-half opens if a fwirewall was not installed

And lastly, modern firewalls  provide nexgen protection to protect AV and other nasties. In your   example, HTTP could be a delivery for downloading malicious code, virsus, trojans,etc... or a source or receiever

Ken

[rwpatterson]

On top of that, they mask the real IP addresses of networks and devices behind them. On the Internet, they may see a single IP address. You could be hosting dozens of publicly accessible servers behind that single IP address and no one would be the wiser.

I have a single dynamic IP address for example. Behind that single address and published to the web I have:

 * Web server (Win based)

 * Radio server hosting two streams (Disco and Jazz)

 * My utility server currently hosting a Christmas radio stream (seasonal)

 * my file sharing server

 * An FTP/SFTP server

 * Test web server (Linux based) 

All have unique ports which is how I can get away with that.

The firewall will not permit access to my devices with private IP addresses from the Internet except on ports that are published there. If someone tries to hack my web server, the cannot get to 192.168.xxx.yyy from anywhere outside my network. This concept is extremely important in the security world because once a hacker gets past the firewall, they now have the keys to the castle and can roam freely from the inside. This is also the real concept of a DMZ. This will allow a hacker to roam aimlessly around servers which usually only pass traffic back and forth between the databases and the Internet. These servers shouldn't hold much else and usually shouldn't have anything of value on them. It's a very good first layer of defense.