Firewalls and ACLs

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It establishes a barrier between trusted internal networks and untrusted external networks (like the Internet). Firewalls can be hardware appliances, software running on a server, or virtual instances in the cloud.

Without a firewall, any device on the Internet can attempt to connect to any service on your network. This exposes services to scanning, exploitation, and denial-of-service attacks. Firewalls reduce the attack surface by permitting only authorized traffic and blocking everything else by default (implicit deny).

Packet filtering is the simplest form. The firewall examines each packet's header fields: source IP, destination IP, source port, destination port, and protocol (TCP/UDP/ICMP). It compares these against a set of rules (the ACL) and either permits or denies the packet. Stateless packet filters treat each packet independently—they have no memory of previous packets. This makes them fast but vulnerable to spoofing and fragmented packet attacks.

Stateful firewalls (also called stateful inspection firewalls) maintain a state table that tracks the state of active connections. For TCP, the firewall monitors the three-way handshake (SYN, SYN-ACK, ACK) and only allows packets that belong to an established connection. For UDP, it creates pseudo-state entries based on source/destination IP and port. This prevents attackers from sending unsolicited packets into the internal network. The default timeout for a TCP session in many firewalls is 60 seconds of inactivity; for UDP, it is typically 30 seconds.

NGFWs combine traditional firewall capabilities with additional features like application awareness, intrusion prevention (IPS), SSL/TLS inspection, and threat intelligence. They can identify applications (e.g., Facebook vs. web browsing) even if they use non-standard ports. On the exam, know that NGFWs operate up to Layer 7 (application layer) of the OSI model.

A proxy firewall acts as an intermediary between clients and servers. The client connects to the proxy, which then establishes a separate connection to the destination server. This hides the client's IP address and allows deep inspection of application data. Proxies are slower but provide the highest security. They are often used for web traffic (HTTP/HTTPS proxies).

ACLs are ordered sets of rules applied to router or switch interfaces. Each rule contains a permit or deny statement and match criteria (IP, port, protocol). ACLs are evaluated top-down: the first matching rule determines the action. If no rule matches, an implicit deny all is applied at the end. Cisco IOS uses numbered ACLs (1-99 for standard, 100-199 for extended) and named ACLs.

Standard ACLs filter only based on source IP address. They are applied as close to the destination as possible because they don't consider destination IP. Example:

access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 deny any

Extended ACLs filter based on source IP, destination IP, protocol, and port numbers. They should be applied close to the source to save bandwidth. Example:

access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
access-list 100 deny ip any any

Every ACL ends with an implicit deny all. Even if you have a permit statement, any traffic not explicitly permitted is denied. This is a common exam point.

ACLs use wildcard masks (inverse subnet masks) to match IP addresses. A 0 means exact match, 1 means ignore. Example: 0.0.0.255 matches any host in the last octet. This is opposite of subnet masks.

Firewalls often divide networks into zones: inside (trusted), outside (untrusted), and DMZ (semi-trusted). Policies are written to control traffic between zones. Typically, traffic from inside to outside is allowed, outside to DMZ is restricted, and outside to inside is blocked.

Network Address Translation (NAT) is often performed on firewalls. Static NAT maps a private IP to a public IP one-to-one. Dynamic NAT uses a pool of public IPs. PAT (Port Address Translation) maps multiple private IPs to a single public IP using different source ports. Firewalls maintain NAT state in their connection table.

On Cisco devices:

show access-lists
show ip interface
show running-config | include access-list

On Linux (iptables):

iptables -L -n -v

A retail company with 50 branch offices uses a stateful firewall at each branch to connect to the corporate HQ over a VPN. The firewall is configured with an ACL that permits only the necessary traffic: HTTPS to the HQ web server (TCP 443), DNS to the HQ DNS server (UDP 53), and ICMP for monitoring. All other outbound traffic is denied. Inbound traffic from the Internet is blocked except for SSH from a management jump box. The firewall also performs NAT to allow branch devices to access the Internet. A common misconfiguration is forgetting to allow return traffic for DNS, which causes name resolution failures. The firewall's stateful nature handles return traffic automatically once the outbound connection is established, but if the state table overflows (e.g., due to a high number of concurrent connections), legitimate traffic may be dropped. Scaling considerations include choosing a firewall with sufficient connection table capacity (e.g., 1 million concurrent connections) and throughput (e.g., 1 Gbps).

A financial institution hosts a public web server and an email server in a DMZ. The perimeter firewall has three interfaces: inside (trusted), outside (untrusted), and DMZ (semi-trusted). The ACL on the outside interface permits HTTP/HTTPS to the web server (TCP 80/443) and SMTP to the email server (TCP 25). All other inbound traffic is denied. The inside interface permits the web server to make outbound database queries to the internal database server (TCP 1433). The DMZ interface is configured with an ACL that only allows the web server to initiate connections to the database server; the database server cannot initiate connections to the web server. This prevents an attacker who compromises the web server from pivoting to the internal database. A common mistake is placing the web server directly on the internal network, exposing internal resources. Performance considerations include enabling hardware acceleration for SSL inspection if HTTPS traffic is decrypted for malware scanning.

A SaaS company uses AWS Security Groups (stateful virtual firewalls) to protect their EC2 instances. Each instance is assigned to a security group that acts as a host-based firewall. The security group rules permit inbound SSH from the company's VPN IP range (TCP 22), HTTP/HTTPS from anywhere (0.0.0.0/0), and all outbound traffic. The stateful nature automatically allows return traffic. Misconfigurations often involve overly permissive rules (e.g., allowing all inbound traffic from 0.0.0.0/0 for debugging) that are left in production. Scaling is handled by AWS, but the rule limit per security group is 60 inbound and 60 outbound rules. Performance is not a concern because AWS implements security groups at the hypervisor level.