A firewall is a network security device that monitors incoming and outgoing network traffic and permits or blocks data packets based on a set of security rules. Its purpose is to establish a barrier between your internal network and incoming traffic from external sources (such as the internet) in order to block malicious traffic like viruses and hackers.

The Windows Firewall is used to protect your Windows system from network-based threats. You can control who has access to your system and what access is granted. … In the Windows Firewall section of the Control Panel, you have two options: Check firewall status and Allow a program through Windows Firewall

Windows Firewall

Windows Firewall is a stateful firewall that comes installed with most modern versions of Windows by default. On Windows 2008 Server machine, the firewall is enabled by default, blocking many of the ports that cause so much trouble in otherwise unprotected Windows systems. On virtual servers, the Windows Firewall ensures that only the services necessary for the chosen function are exposed (the firewall will automatically configure itself for new server roles, for instance, and when certain server applications are installed). As members of your domain, the Windows Firewall of your virtual servers can be managed remotely, or through Group Policy.

Types of firewalls

Firewalls can either be software or hardware, though it’s best to have both. A software firewall is a program installed on each computer and regulates traffic through port numbers and applications, while a physical firewall is a piece of equipment installed between your network and gateway.

Packet-filtering firewalls, the most common type of firewall, examine packets and prohibit them from passing through if they don’t match an established security rule set. This type of firewall checks the packet’s source and destination IP addresses. If packets match those of an “allowed” rule on the firewall, then it is trusted to enter the network.

Packet-filtering firewalls are divided into two categories: stateful and stateless. Stateless firewalls examine packets independently of one another and lack context, making them easy targets for hackers. In contrast, stateful firewalls remember information about previously passed packets and are considered much more secure.

While packet-filtering firewalls can be effective, they ultimately provide very basic protection and can be very limited—for example, they can’t determine if the contents of the request that’s being sent will adversely affect the application it’s reaching. If a malicious request that was allowed from a trusted source address would result in, say, the deletion of a database, the firewall would have no way of knowing that. Next-generation firewalls and proxy firewalls are more equipped to detect such threats.

Next-generation firewalls (NGFW) combine traditional firewall technology with additional functionality, such as encrypted traffic inspection, intrusion prevention systems, anti-virus, and more. Most notably, it includes deep packet inspection (DPI). While basic firewalls only look at packet headers, deep packet inspection examines the data within the packet itself, enabling users to more effectively identify, categorize, or stop packets with malicious data. 

Proxy firewalls filter network traffic at the application level. Unlike basic firewalls, the proxy acts an intermediary between two end systems. The client must send a request to the firewall, where it is then evaluated against a set of security rules and then permitted or blocked. Most notably, proxy firewalls monitor traffic for layer 7 protocols such as HTTP and FTP, and use both stateful and deep packet inspection to detect malicious traffic.

Network address translation (NAT) firewalls allow multiple devices with independent network addresses to connect to the internet using a single IP address, keeping individual IP addresses hidden. As a result, attackers scanning a network for IP addresses can’t capture specific details, providing greater security against attacks. NAT firewalls are similar to proxy firewalls in that they act as an intermediary between a group of computers and outside traffic.

Stateful multilayer inspection (SMLI) firewalls filter packets at the network, transport, and application layers, comparing them against known trusted packets. Like NGFW firewalls, SMLI also examine the entire packet and only allow them to pass if they pass each layer individually. These firewalls examine packets to determine the state of the communication (thus the name) to ensure all initiated communication is only taking place with trusted sources.

Functions Of firewalls

Firewalls carefully analyze incoming traffic based on pre-established rules and filter traffic coming from unsecured or suspicious sources to prevent attacks. Firewalls guard traffic at a computer’s entry point, called ports, which is where information is exchanged with external devices. For example, “Source address 172.18.1.1 is allowed to reach destination 172.18.2.1 over port 22.”

Think of IP addresses as houses, and port numbers as rooms within the house. Only trusted people (source addresses) are allowed to enter the house (destination address) at all—then it’s further filtered so that people within the house are only allowed to access certain rooms (destination ports), depending on if they’re the owner, a child, or a guest. The owner is allowed to any room (any port), while children and guests are allowed into a certain set of rooms (specific ports).

IMPORTANCE OF FIREWALL

While antivirus software helps to protect the file system against unwanted programs, a firewall helps to keep attackers or external threats from getting access to your system in the first place.

Other threats travel from computer to computer without the knowledge of the user. They can find a computer that has lower security settings or unpatched vulnerabilities, and insert themselves onto that system without the user ever knowing what is happening. Many worms and Trojan horses, often known as “bots”, travel this way. They utilize the Internet to find computers to infect. The user will never know that their system has been compromised because the threat enters their computer quietly.

This is exactly where a firewall help protect you.

The firewall monitors all network traffic and has the ability to identify and block unwanted traffic. Since most computers these days are connected to the Internet, attackers have many opportunities to find victim computers. These attackers probe other computers on the Internet to determine if they are vulnerable to various types of attacks. When they find a suitable computer, they can compromise it and insert themselves onto that computer. At that point the attacker can make the victim computer perform almost any task he desires. Attackers will often try to steal personal information for the purposes of financial fraud. All of this activity takes place in the background without the user knowing what is happening.

There are two basic types of firewalls: client firewalls and appliance firewalls.

A client firewall is software that resides on the computer itself and monitors all of the network traffic on that computer.

An appliance firewall is a hardware device that is connected between the Internet and your computer.

These devices are often used in small network environments where several computers need to share the same Internet connection. The small routers that many people use in their offices and homes usually have built-in firewalls. If you use a router, make sure it has a firewall.

Both types of firewalls can keep the attackers from gaining unwanted access to your computer.

Users who travel should always have a client firewall installed on their system. You don’t want to take any chances when you are connected to the Internet away from the office or home.

While antivirus software is a great tool to help keep you safe, adding a firewall will give the bad guys out there the one-two punch that will be a knockout.

Drop your comment.