Firewalls and ACLs

How a Firewall Protects Your Network

Firewalls sit on the outside of your network and protect the inside of your network from the rest of the world, from the rest of the internet. Hackers are trying to constantly break into your network, and the firewall is designed to stop them from breaking in. Traffic from the outside is not allowed to come into your network unless it's traffic that's been requested. Let's say this machine sends out a request for a web server that's out there in the internet. What that web server does is reply back to that computer, and that firewall is going to allow that traffic to come back in and return to the computer.

That is generally how firewalls work, but we do have some granular control over this firewall. We can set it up where it only allows certain traffic out, and maybe it does allow certain traffic in. In the case like this DMZ, maybe it does allow some traffic in to this DMZ zone to a web server that's in there. So there are some configurations that we can configure, but generally speaking a firewall allows traffic to go out to the rest of the world but doesn't allow traffic to come back in unless it's traffic that's been requested, or this firewall is specifically set up to allow that traffic to come in.

Ways a Firewall Can Filter

A firewall can function in many different ways. First of all, we can do filtering based off of IP, and it can allow or deny traffic from a certain IP to get into the network, or it can allow or deny certain traffic to an IP to get into the network. So it could be based off of source or destination IP address, and whether it allows or disallows that traffic to come in or out of the firewall.

Another way that we could filter this is by port or service. By port or service means that maybe it's allowed traffic to come into this web server, so port 80 traffic can come into this, or port 443 traffic can come into this. A lot of times we will want to do it by both, because we have a specific web server that will allow traffic into that network.

The other thing that we could do is we could also do URL filtering, that perhaps we are filtering traffic. Maybe we don't want some of our traffic internally to get out to certain web pages, and we don't want that traffic to come back, so we want to filter it by the URL. I set this up at schools where I'd have a firewall that would do filtering so that students can get to sites that they shouldn't be getting to.

Then another thing that you can do is a stateful packet inspection. A stateful packet inspection will identify traffic once again that's going out, and it will allow then traffic to come back in through the firewall to get back to the destination. A stateful packet inspection is where it actually opens up the packets and takes a look inside of the packets at what traffic is going back and forth with this, to identify if there's any kind of malicious activity at play. These are types of firewalls, or different ways that a firewall can do inspection or can do filtering, out here on the front end of your network.

Access Control Lists

As I mentioned, most firewalls are set up so that traffic can go out but only return traffic can come back in, and all other traffic gets stopped right at the front door. But there are times when you want to allow traffic to something like a web server here, and you want to allow this traffic so that way you can have a company website hosted internally on your network. We can control how a firewall works with access control lists.

An access control list is a list of statements that can allow or deny certain traffic from being able to get into this network. That's what an access control list does. It helps us program a firewall in order to allow or deny certain traffic. It also can be used on a router to allow or deny certain traffic from coming into a network, or between networks within your company. So we can use access control lists for a lot of filtering, and to filter out certain traffic on our networks.

That's not the only thing it can do, though. We can use access control lists to specify certain ranges of traffic for other purposes. For now, we're just going to use it in the sense that we're talking about now, as blocking traffic or allowing certain traffic. And we can do that. We can allow or block traffic for security reasons to protect our network, or for access reasons to allow access to certain resources. Perhaps we need to allow a certain amount of traffic, or we need to block it right at the front door so that way it's not bugging the rest of our network. We can limit some of the traffic that comes into our network to increase performance, and there are some things that we can use it for, things like flow control or providing some sort of priority for certain packets.

Standard and Extended Lists

These are what access control lists look like. These are two different types of access control lists. We have a standard access control list and an extended access control list. We're not going to get too much into the details of these access control lists, but you can see here where we specified an IP address. This one here specifies a range of IP addresses, and this is what's called a wildcard mask. We have the access control list number right here and a permit or deny statement.

A standard access control list blocks traffic or accepts traffic based off of a source IP address. So if it comes in and matches this statement right here, then it's going to deny. Otherwise, it's going to permit it, if it matches this network right here.

This extended one right here adds some additional information. As you can see, we add the TCP in here, and then we also add that it's port 80. So this is going to port 80, so we're filtering it off of a service. We added the service here. We have a source and a destination, so we have both a source host and a destination host, so we can get much more granular with it. So really the difference between the standard and the extended is we can get a lot more granular with the details in an extended list.

Applying a List to an Interface and a Direction

Access control lists are put onto interfaces. So here we have a network right here, and I could put an access control list on this interface, on this interface, on this interface, or, as I mentioned before, we use them on firewalls but we also use them on routers, so I could put it on this interface or this interface.

But not only do I put it on an interface, I put it on a direction on each one of these interfaces. So I could put it on this interface right here, and then I could either specify whether it's outgoing or ingoing, or I could call that egress or ingress. Ingress is coming in, egress is going out, and it's from the perspective of the firewall. So if you look at the middle of the firewall and you want to put an access control list as filtering traffic that's going out this interface, that is the egress right there. And then if I wanted it to be put on the incoming on that interface, that would be the ingress. Same thing with this interface right here: if I want it coming into this network right here, it's actually going out of this interface, it's coming from the middle of this firewall out, so that is the egress. But if I want it to come into the firewall, that would be the ingress.

So the rule is that every interface can have an access control list per direction, ingress or egress. So for this firewall right here with three interfaces, each one of those interfaces could have an access control that's going in and then coming out. So then I can have a total of six different access control lists applied to these different interfaces on this firewall. I have a router here, and it has two interfaces. For each one of those interfaces, it can come into the router or go out, the ingress or egress, and since I have those two directions, I can have four access control lists put on the two interfaces of this router. So that is access control lists, and depending on whether you put it on the ingress or egress could drastically affect how that access control list functions. So you do have to be careful on whether you're monitoring the traffic that's going out of an interface or monitoring the traffic that's coming into the interface.

How the Statements Are Processed

So now, how this processing happens. Let's say there is something coming in the interface, and this is a standard access list, so it's monitoring for the source IP address. It's looking for the source IP address, and maybe the, let's say 55. So now what it's going to do as it comes in is it's going to look for what the source IP address is and then compare it for each one of these statements. So it compares it to the first statement, and it says access list 42 deny 10.1.1.5, does it match? And it says no, this is actually a different address, because it's 555, it's not five, so it does not match this.

So then it goes to the next statement, and it then looks at the next statement, and this says, okay, does it match the 10.1.0 or 10.1.1.0? And this has a wildcard of this, that means it's a range, so it's anything within this network right here. We're not going to get into the wildcard mask, but it does actually match this. It is one of the addresses in this range. And so then what it says is, okay, what do I do with it? Oh, I'm going to permit this, and then it allows that packet to come into the network or out of the, it's either ingress or egress, so either way.

So that is the access list. It's going to continue to go down all of the statements until it makes a match, and then it's going to stop progressing after that. So let's say it did see one came in from a 10.1.1.5, came into this, and it's analyzing it, and it takes a look and it says, oh well, this does match this first statement, and it's a deny, so I am not going to allow the traffic from 10.1.1.5, and then it drops the packet there.

Implicit and Explicit

There is something magical about these access control lists at the end of it. But first of all, we've got to understand what the difference is between implicit and explicit. Implicit and explicit are just two terms that you'll see now and then from a security perspective, and you'll just see out there as a term out there.

So implicit, you can think of it as a bouncer's list. There is a bouncer at the front door that's allowing people to get into a club, and if you walk up there and say what your name is, and they take a look at your list and you are not on the list, then you are denied entry into that club. This is implicit. That means you have to be on the list in order to get in.

Then there is explicit. Explicit means that if you are on the list, they won't let you in, but everybody else can come into the club. So implicit is a little more exclusive versus explicit. Explicit is inviting of all unless you're on the list, perhaps that they had issues with somebody in the past and that's why they have a list that doesn't allow certain people to get into that club. So that's the difference between implicit and explicit.

What's hidden, what's magical on these access control lists, is there is a hidden access end list to all of this, and it is an implicit deny any. So that means that if you are not on the list, if for some reason you don't fall under any of the other access control statements in this list right here, then you are going to get denied.

What that means is if you've created an access list that doesn't have any statements in it and you apply it to an interface, it's going to kill all the traffic on that interface. And I've actually done that before, so don't do that. You have to have statements, some sort of permit statement to allow some sort of traffic, for that access control list to allow some traffic through there. Otherwise, everything is going to hit this deny any and then kill whatever traffic is going through that interface.

So here's what it looks like when an access control list is applied to the ingress of this firewall that's right here. And maybe that ingress statement is it's going to allow certain traffic to get into this web server. Maybe it's going to allow any traffic to get to this server, so whatever IP address that is on port 80, and it allows the traffic to get to that server on port 80. But all other traffic it's going to deny or not allow in, because of that implicit deny any at the end of it, and then that traffic will get terminated.

Firewalls and access control lists work together to secure your network, although access control lists do have many other functions that they can perform. Firewalls also usually have a lot of features, it's not just strictly blocking or permitting certain traffic. But there are some other things that firewalls can do that are pretty cool.