Firewalls

The isolation of the inside network resulting from the use of private addresses gives it a measure of security. In the real world this security proved inadequate. Non-compliant routers can forward to private addresses, and address "spoofing" technique (substituting false addresses for correct ones) can be used to confuse computers. For example, a malicious outside connection can masquerade as an innocent one originating from the inside network, and therefore to be trusted.

Enter the use of firewalls. A firewall is a program installed on the gateway host. It analyzes and filters the information traffic flowing between the inside network and the outside world. The function of the firewall is to block all traffic deemed harmful from entering the inside network. The "block/no block" decision is based on a set of criteria or rules of what constitute harmful traffic.

A simple rule for our example network would be to block all connections from private IP addresses (e.g. 168.0.0.7) arriving on the outside interface (i.e. from the Internet.) In an ideal world, this would never happen. Remember – routers are prohibited from forwarding to/from such addresses. However, non-compliant routers and address spoofing make it possible, creating the need for protection.

Creating firewall filtering rules is a whole science, but obviously the more the firewall knows about the nature of the connection the better filtering job it can do. More about that later.