Packet filtering allows the decision of allowing or blocking a packet to be based on any or all of these eight components. In addition, since the router knows the interface on which the packet arrives and the interface on which the packet goes out. Various fields of each packet header are examined:Īny or all of these may be used to accept or deny a packet. Most routers and firewall products support packet filtering. A screening router, on the other hand, determines the route (destination) and also decides whether the packet should be routed or dropped. Ordinary routers simply look at the destination address of each packet and pick the best interface on which to send the packet to its destination. A router that can perform packet filtering is known as a screening router (Figure 2). Packets can be accepted or blocked from transmission in a way that reflects the security policy of a site. This firewall serves as a form of a gateway that forwards packets from one network to another, allowing only certain packets to flow into the internal network. Packet filtering is the selective routing of packets between internal and external hosts. The two major approaches to building a firewall are packet filtering and application proxies. A solution is to protect the junction between a trusted internal network of computers from the external network with a firewall. Unfortunately we are often not content to remain disconnected from the rest of the world (there’s a lot of cool stuff out there).

In some cases, this may be easy: move all the machines onto a private network and do not allow untrusted people onto the machines or the network. The next step is to isolate this trusted group of machines from the rest of the untrusted world. We basically have two domains of machines: a trusted domain (our machines on our network or networks) and an untrusted domain – all the external machines. Certain network services, such as database access or perhaps even a network login, may need to be present on some of our machines but should not be accessible by others outside of our local network. While we’d like to communicate with all machines: those on our network and other systems, we do not want systems trying to penetrate our network.

Bastion host firewall