Tutorial:Internet
How To Build And
Run A Firewall
We take a look at some of the issues involved in choosing, setting up and running a firewall.
By Simon Bisson
N
ow that corporate access to the
Bastion Host
extra services should be disabled, and
Internet is seen as a business
user accounts kept to a minimum. If it
advantage, more and more
Keeping the network itself secure is
is possible to only allow logins from
companies are finding themselves
the job of the bastion host. Taking its
trusted hosts or the system console, all
having to think long and hard about
name from the fortified gateways of a
other access routes should be removed.
the security implications of a connec 
feudal Norman castle, this is what is
Some firewall packages make the
tion.
often thought of as the firewall but is
DMZ more secure by using a third net 
With attacks on business computer
really only part of a layered firewall
work interface to host public services
systems becoming more visible (and
architecture.
and using the firewall software to pro 
potentially more expensive), and with
The bastion host is a machine with
tect them rather than a choke router.
holes in operating systems more pub 
only one purpose: to pass packets be 
lic, some form of Internet security pol 
tween your network and the Internet.
Firewall Policies
icy is essential. This can include
Usually, it's a dedicated machine with
everything from limiting the number
two separate network interfaces. The
It's sometimes best to think of In 
of machines and systems with an In 
bastion host will act as an active router,
ternet security policies in terms of the
ternet connection, to controlling what
linking your private network to the
 Four Ps , namely Paranoia, Pragma 
files can enter or leave a company net 
Internet, monitoring the state of con 
tism, Permissiveness and Promiscuity.
work. A security policy alone won't
nection and blocking packets that
Each approach is the result of a differ 
prevent attacks and intrusions, so
don't meet the rules you have defined.
ent assessment of the risks involved in
some form of defence is required, often
If you use it for anything else than
opening a corporate network to the
implemented in the form of a firewall.
as an Internet gateway, you may be
Internet:
adding weaknesses to a security archi 
Definition
tecture. For example, if you use the
G
A Paranoid network is never con 
machine for reading email, it's possible
nected to the Internet.
A firewall is a set of tools designed
for someone to send an email with an
G
A Pragmatic network only permits
to prevent unauthorised access to a
embedded ActiveX control so that,
selected applications and services
network, and can mix hardware and
when you read the message, the con 
access to the Internet, and blocks all
software solutions to provide a layered
trol turns off the firewall.
others.
defence. A typical firewall architecture
You must make sure that the
G
A Permissive network lets all appli 
is based around two concepts: the
bastion's operating system is config 
cations have access to the Internet,
 choke router  and the  bastion host 
ured to prevent any packets being
except for those specifically seen as
[refer also to Understanding Firewalls,
routed directly between its network in 
a threat.
File S0499, PCNA Issue 86   Ed.].
terfaces. Most commercial packages will
G
A Promiscuous network is con 
Most routers allow you to define
handle this for you, but if you are un 
nected directly to the Internet, and
access control lists, which can control
sure, you can configure most dialects
lets all applications and services
exactly which IP packets are routed
of Unix to stop any internal routing.
have full access to and from the In 
and to where. Whilst choking an In 
ternet.
ternet connection this way is an all or 
The DMZ
nothing security mechanism, you can
One of the best techniques for secur 
use router access control lists to explic 
Between the choke router and the
ing a network is to hide it from the
itly deny access to your network for
bastion host lies the  Demilitarised
Internet. A range of IP addresses is
specific packet types, or to make sure
Zone . The DMZ is a partially pro 
reserved for intranet use, and allows
that certain packets are only delivered
tected area, where you can install pub 
you to build as large a network as you
to specific machines so that, for exam 
lic services. Machines in the DMZ
like, as long as you use some form of
ple, mail is only delivered to your mail
should not be fully trusted, and should
network address translation to allow
server or Web access is only to your
only be used for single purposes   such
packets to travel into and out of your
public Web server or Web proxies.
as a Web server or an ftp server. Any
network.
Issue 95 (May 1998) page 3
File: T1803.1
PC Network Advisor
Next page  >
New! The best sites for quality inkjet printer cartridges and the best sites for cheap inkjet cartridges
Windows Help Desk Home