6-1 Firewall Basics Explained

Firewalls are essential components of network security, acting as barriers between a trusted internal network and untrusted external networks such as the internet. Understanding firewall basics is crucial for the MikroTik Certified Network Associate (MTCNA) certification.

Key Concepts

1. Firewall Overview

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a filter, allowing or blocking data packets based on the rules set by the network administrator.

2. Firewall Types

There are several types of firewalls, including:

• Packet Filtering Firewall: Filters packets based on source and destination IP addresses, protocol, and port numbers.
• Stateful Inspection Firewall: Tracks the state of active connections and allows packets that belong to established connections.
• Application Layer Firewall: Inspects data within the application layer of the OSI model, providing deeper analysis and protection.

3. Firewall Rules

Firewall rules define the conditions under which a packet is allowed or denied. These rules are based on criteria such as source IP address, destination IP address, protocol, port number, and action (allow or deny).

4. Firewall Chains

Firewall chains are sequences of rules that packets traverse. Common chains include:

• Input Chain: Handles incoming packets.
• Output Chain: Handles outgoing packets.
• Forward Chain: Handles packets being routed through the firewall.

Detailed Explanation

Firewall Overview

Firewalls operate at various layers of the OSI model, from the network layer to the application layer. They analyze packets based on predefined rules to determine whether they should be allowed to pass through or blocked.

Firewall Types

Packet filtering firewalls are the simplest and operate at the network layer. Stateful inspection firewalls provide more security by tracking the state of connections. Application layer firewalls offer the highest level of protection by inspecting data at the application level.

Firewall Rules

Firewall rules are created by network administrators to control traffic. For example, a rule might allow HTTP traffic (port 80) from a specific IP address while denying all other traffic. Rules are evaluated in order, and the first matching rule determines the action taken.

Firewall Chains

Firewall chains are used to manage different types of traffic. The input chain handles packets destined for the firewall itself, the output chain handles packets generated by the firewall, and the forward chain handles packets passing through the firewall.

Examples and Analogies

Example: Firewall Overview

Think of a firewall as a security guard at a building entrance. The guard checks each person (packet) against a list of rules (firewall rules) to decide whether they can enter (allow) or not (deny).

Example: Firewall Types

Consider a packet filtering firewall as a basic security checkpoint that only checks the ID (source and destination IP addresses) of each person. A stateful inspection firewall is like a checkpoint that also checks the person's purpose (connection state). An application layer firewall is like a checkpoint that inspects the contents of the person's bag (application data).

Example: Firewall Rules

Imagine a firewall rule as a sign at a gate that says, "Only allow cars with license plates starting with 'ABC' to enter." This rule would allow certain cars (packets) to pass while blocking others.

Example: Firewall Chains

Think of firewall chains as different lanes at a toll booth. The input chain is like the lane for cars entering the toll booth, the output chain is like the lane for cars leaving the toll booth, and the forward chain is like the lane for cars passing through the toll booth without stopping.

By mastering firewall basics, you can effectively protect your network from unauthorized access and malicious traffic, ensuring a secure and reliable network environment.