A firewall is a security device that filters traffic that is not allowed in the organization, while allowing legitimate traffic. Firewalls are positioned at the entry point in an organization or between critical network modules to create various security access policies. Most firewalls filter at Layer 4, based on the TCP or UDP port number. Some firewalls can function even at Layer 7, being application aware and filtering traffic based on this.
Modern firewalls offer stateful packet inspection, meaning they understand and keep track of all the flows that pass through the device. It only allows traffic to flow between specific devices, for example, between different clients and a server. The way this functions is by recording the state of each connection (flows and sequence numbers) and automatically allowing the responses associated with that connection back.
Firewalls usually block all traffic, by default. To permit certain types of traffic, you can create a list of rules that reflects firewall behavior. Firewalls generally operate using rules known as tuples, which are a grouping of variables:
- Source IP
- Destination IP
- Port number
- Application
- Packet size
- Time of day
Network Address Translation is a mechanism that allows address conservation and at the same time increases the environment’s security level, as inside devices are not directly reachable from outside the network.
There are multiple ways to configure NAT on a router, depending on your particular requirements. To configure NAT, you need to tell the router which interfaces are on the inside and outside of the NAT network. This is because you could actually swap internal addresses for a pool of NAT addresses, or, at the very least, a single NAT address, and perform NAT between two interfaces on the router.
NAT enables hosts on private networks to access resources on the Internet or other public networks. NAT is an IETF standard that enables a LAN to use one set of IP addresses for internal traffic, typically private address space as defined in RFC 1918, and another set of addresses for external traffic, typically publicly registered IP address space.