Preface

What is a firewall, and what does it do for you? A firewall is a way to restrict access between the Internet and your internal network. You typically install a firewall at the point of maximum leverage, the point where your network connects to the Internet. The existence of a firewall at your site can greatly reduce the odds that outside attackers will penetrate your internal systems and networks. The firewall can also keep your own users from compromising your systems by sending dangerous information -- unencrypted passwords and sensitive data -- to the outside world.

The attacks on Internet-connected systems we are seeing today are more serious and more technically complex than those in the past. To keep these attacks from compromising our systems, we need all the help we can get. Firewalls are a highly effective way of protecting sites from these attacks. For that reason, we strongly recommend you include a firewall in your site's overall Internet security plan. However, a firewall should be only one component in that plan. It's also vital that you establish a security policy, that you implement strong host security, and that you consider the use of authentication and encryption devices that work with the firewalls you install. This tutorial will touch on each of these topics while maintaining its focus on firewalls.

Scope of this tutorial

Part I, "Network Security", explores the problem of Internet security and focuses on firewalls as part of an effective strategy to address that problem.

• "Why Internet Firewalls?", introduces the major risks associated with using the Internet today; discusses what to protect, and what to protect against; discusses various security models; and introduces firewalls in the context of what they can and can't do for your site's security.
• "Internet Services", outlines the services users want and need from the Internet, and summarizes the security problems posed by those services.
• "Security Strategies", outlines the basic security principles an organization needs to understand before it adopts a security policy and invests in specific security mechanisms.

• "Packets and Protocols ", describes the basic network concepts firewalls work with.
• "Firewall Technologies", explains the terms and technologies used in building firewalls.
• "Firewall Architectures", describes the major architectures used in constructing firewalls, and the situations they are best suited to.
• "Firewall Design", presents the process of designing a firewall.
• "Packet Filtering" describes how packet filtering systems work, and discusses what you can and can't accomplish with them in building a firewall.
• "Proxy Systems", describes how proxy clients and servers work, and how to use these systems in building a firewall.
• "Bastion Hosts", presents a general overview of the process of designing and building the bastion hosts used in many firewall configurations.
• "Unix and Linux Bastion Hosts", presents the details of designing and building a Unix or Linux bastion host.
• "Windows 2000 Bastion Hosts ", presents the details of designing and building a Windows bastion host.

• "Internet Services and Firewalls", describes the general issues involved in selecting and configuring services in the firewall environment.
• "Intermediary Protocols", discusses basic protocols that are used by multiple services.
• "The World Wide Web", discusses the Web and related services.
• "Electronic Mail and News", discusses services used for transferring electronic mail and Usenet news.
• "File Transfer, File Sharing, and Printing", discusses the services used for moving files from one place to another.
• "Remote Access to Hosts", discusses services that allow you to use one computer from another computer.
• "Real-Time Conferencing Services", discusses services that allow people to interact with each other online.
• "Naming and Directory Services", discusses the services used to distribute information about hosts and users.
• "Authentication and Auditing Services", discusses services used to identify users before they get access to resources, to keep track of what sort of access they should have, and to keep records of who accessed what and when.
• "Administrative Services", discusses other services used to administer machines and networks.
• "Databases and Games", discusses the remaining two major classes of popular Internet services, databases and games.
• "Two Sample Firewalls", presents two sample configurations for basic firewalls.

• "Security Policies", discusses the importance of having a clear and well-understood security policy for your site, and what that policy should and should not contain. It also discusses ways of getting management and users to accept the policy.
• "Maintaining Firewalls", describes how to maintain security at your firewall over time and how to keep yourself aware of new Internet security threats and technologies.
• "Responding to Security Incidents", describes what to do when a break-in occurs, or when you suspect that your security is being breached.

• Appendix A, "Resources", contains a list of places you can go for further information and help with Internet security: World Wide Web pages, FTP sites, mailing lists, newsgroups, response teams, tutorials, papers, and conferences.
• Appendix B, "Tools", summarizes the best freely available firewall tools and how to get them.
• Appendix C, "Cryptography", contains background information on cryptography that is useful to anyone trying to decrypt the marketing materials for security products.