- A Packet-Filtering Firewall
- Choosing a Default Packet-Filtering Policy
- Rejecting versus Denying a Packet
- Filtering Incoming Packets
- Filtering Outgoing Packets
- Private versus Public Network Services
- Summary
This chapter is from the book
This chapter is from the book
This chapter is from the book
Choosing a Default Packet-Filtering Policy
As stated earlier in this chapter, a firewall is a device to implement an access control policy. A large part of this policy is the decision on a default firewall policy.
There are two basic approaches to a default firewall policy:
- Deny everything by default, and explicitly allow selected packets through.
- Accept everything by default, and explicitly deny selected packets from passing through.
Without question, the deny-everything policy is the recommended approach. This approach makes it easier to set up a secure firewall, but each service and related protocol transaction that you want must be enabled explicitly (see Figure 2.3). This means that you must understand the communication protocol for each service you enable. The deny-everything approach requires more work up front to enable Internet access. Some commercial firewall products support only the deny-everything policy.
)
Figure 2.3 The deny-everything-by-default policy
The accept-everything policy makes it much easier to get up and running right away, but it forces you to anticipate every conceivable access type that you might want to disable (see Figure 2.4). The danger is that you won’t anticipate a dangerous access type until it’s too late, or you’ll later enable an insecure service without first blocking external access to it. In the end, developing a secure accept-everything firewall is much more work, much more difficult, almost always much less secure, and, therefore, much more error-prone.
)
Figure 2.4 The accept-everything-by-default policy