What is Packet Filtering Firewall? benefits & Types and disadvantage

  Firewall Packet Filtering  

Packet filtering systems route packets between internal and external hosts, but they do it selectively.They allow or block certain types of packets in a way that reflects a site's own security policy, as shown in Figure The type of router  used in a packet filtering firewall is known as a screening router.

Every packet has a set of headers containing certain information. The main information is:

• IP source address

• IP destination address

• Protocol (whether the packet is a TCP, UDP, or ICMP packet)

• TCP or UDP source port

• TCP or UDP destination port

• ICMP message type

• Packet size

The router can also look past the packet headers at data further on in the packet; this allows it, for instance, to filter packets based on more detailed information (like the name of the web page that somebody is requesting) and to verify that packets appear to be formatted as expected for their destination port. The router can also make sure that the packet is valid (it actually is the size that it claims to be and is a legal size, for instance), which helps catch a number of denial of service attacks based on malformed packets.

In addition, the router knows things about the packet that aren't reflected in the packet itself, such as:

• The interface the packet arrives on

• The interface the packet will go out on

Finally, a router that keeps track of packets it has seen knows some useful historical facts, such as:

• Whether this packet appears to be a response to another packet (that is, its source was the destination of a recent packet and its destination is the source of that other packet).

• How many other packets have recently been seen to or from the same host.

• Whether this packet is identical to a recently seen packet.

• If this packet is part of a larger packet that has been broken into parts (fragmented).

To understand how packet filtering works, let's look at the difference between an ordinary router and a screening router.

An ordinary router simply looks at the destination address of each packet and picks the best way it knows to send that packet towards that destination. The decision about how to handle the packet is based solely on its destination. There are two possibilities: the router knows how to send the packet towards its destination, and it does so; or the router does not know how to send the packet towards its destination, and it forgets about the packet and returns an ICMP "destination unreachable" message, to the packet's source.

A screening router, on the other hand, looks at packets more closely. In addition to determining whether or not it can route a packet towards its destination, a screening router also determines whether or not it should. "Should" or "should not" are determined by the site's security policy, which the screening router has been configured to enforce.

Once it has looked at all the information, a straightforward packet filtering router can do any of the following things:

• Send the packet on to the destination it was bound for.

• Drop the packet—just forget it, without notifying the sender.

• Reject the packet—refuse to forward it, and return an error to the sender.

• Log information about the packet.

• Set off an alarm to notify somebody about the packet immediately.

• More sophisticated routers might also be able to do one or more of these things-

• Modify the packet (for instance, to do network address translation).

• Send the packet on to a destination other than the one that it was bound for (for instance, to force transactions through a proxy server or perform load balancing).

• Modify the filtering rules (for instance, to accept replies to a UDP packet or to deny all traffic from a site that has sent hostile packets).

Packet filtering devices that keep track of packets that they see are frequently called stateful packet filters (because they keep information about the state of transactions). They may also be called dynamic packet filters because they change their handling of packets dynamically depending on the traffic they see.

Devices that look at the content of packets, rather than at just their headers, are frequently called intelligent packet filters. In practice, almost all stateful packet filters also are capable of looking at the contents of packets, and many are also capable of modifying the contents of packets, so you may see all these capabilities lumped together under the heading "stateful packet filtering". However, something can legitimately be called a "stateful packet filter" without having the ability to do advanced content filtering or modification.

A packet filtering system is also a logical place to provide virtual private network or network address translation services. Since the packet filter is already looking at all of the packets, it can easily identify packets that are intended for a destination that is part of the virtual private network, encrypt those packets, and encapsulate them in another packet bound for the appropriate destination.

Advantages of Packet Filtering -

• One screening router can help protect an entire network : - One of the key advantages of packet filtering is that a single, strategically placed packet filtering router can help protect an entire network. If only one router connects your site to the Internet, you gain tremendous leverage on network security, regardless of the size of your site, by doing packet filtering on that router.

• Simple packet filtering is extremely efficient : -  Because simple packet filtering requires paying attention only to a few packet headers, it can be done with very low overhead. Proxying is a fairly time- consuming operation, and adding proxying means directing connections through another program, usually on a machine that otherwise wouldn't be necessary to the routing process. Packet filtering takes place on a machine that was already in the critical path, and introduces a much smaller delay.

However, there is no free lunch; the more work your packet filters do, the slower they will be. If your packet filters behave like proxies, doing complicated data- driven operations that require keeping track of multiple packets, they will tend to perform like proxies as well.

• Packet filtering is widely available : -  Packet filtering capabilities are available in many hardware and software routing products, both commercial and freely available over the Internet. Most sites already have packet filtering capabilities available in the routers they use.

Most commercial router products include packet filtering capabilities. Packet filtering capabilities are also available for a number of general-purpose computers.

Disadvantages of Packet Filtering 

Although packet filtering provides many advantages, there are some disadvantages to using packet filtering as well.

• Current filtering tools are not perfect : -  Despite the widespread availability of packet filtering in various hardware and software packages, packet filtering is still not a perfect tool. The packet filtering capabilities of many of these products share, to a greater or lesser degree, common limitations:

1. The packet filtering rules tend to be hard to configure. Although there is arange of difficulty, it mostly runs from slightly mind-twisting to brain- numbingly impossible.

1. Once configured, the packet filtering rules tend to be hard to test.

1. The packet filtering capabilities of many of the products are incomplete, making implementation of certain types of highly desirable filters difficult or impossible.

• Packet filtering reduces router performance : -  Doing packet filtering places a significant extra load on a router. As we discussed previously, more complex filters place more load on the router, but in some cases, simply turning on packet filtering on a given interface can also cost you a lot of performance on some routers, because the filtering is incompatible with certain caching strategies commonly used for performance enhancement. Cisco's "fastpath" functionality is an example of this; normally, fastpath can perform basic routing functions completely on the interface card, without involving the main CPU, but using some forms of filtering requires involving the main CPU for each packet, which is much slower. What enables/disables fastpath depends on the hardware and software version.

• Some policies can't readily be enforced by normal packet filtering routers : - The information that a packet filtering router has available to it doesn't allow you to specify some rules you might like to have  Therefore, you can't enforce restrictions on particular users. Similarly, packets say what port they're going to but not what application; when you enforce restrictions on higher-level protocols, you do it by port number, hoping that nothing else is running on the port assigned to that protocol. Malicious insiders can easily subvert this kind of control.This problem is eased by using more intelligent packet filters.

What is firewall?