Lec-85: What is Firewalls and How it Works | Packet Filtering firewall explained in Hindi Part-1

Summary

This video provides an in-depth explanation of firewalls in network security, covering both host-based and network-based firewalls. It outlines the concept of firewalls as devices (either hardware, software, or a combination) that monitor and control incoming and outgoing traffic based on predefined rules. The video compares firewalls to security at the gates of a college, ensuring only authorized access. It explains the types of firewalls, including packet filtering and proxy firewalls, and explores key features such as blocking IP addresses, networks, and specific services like HTTP and FTP. The focus is on how firewalls protect networks from external threats.

Takeaways

• 😀 Firewalls are security devices (hardware, software, or a combination) that monitor and control incoming and outgoing network traffic based on predefined security rules.
• 😀 A firewall acts as a barrier, allowing authorized traffic to pass and blocking unauthorized or malicious traffic, similar to a security checkpoint at a metro station or university gate.
• 😀 Host-based firewalls are installed on individual devices (e.g., personal computers) and function as software, while network-based firewalls are used at the organization level and typically involve dedicated hardware.
• 😀 Network-based firewalls offer higher performance and better security because they use dedicated hardware and are designed to handle large-scale network traffic.
• 😀 Firewalls can be implemented at the main gateway of an organization's network to control access from external sources (e.g., the internet).
• 😀 There are two main types of firewalls: Packet Filtering Firewalls and Proxy (Application) Firewalls. Packet filtering works at Layers 3 and 4, inspecting IP and TCP headers, while Proxy firewalls inspect higher layers for application-level traffic.
• 😀 Packet Filtering Firewalls analyze packet headers, checking IP addresses and port numbers to decide whether traffic should be allowed or blocked.
• 😀 Common firewall rules include blocking specific IP addresses, entire networks, or specific services (like HTTP or FTP), based on security requirements.
• 😀 The Default Allow Policy allows all traffic by default, except for traffic that matches defined blocking rules. This policy focuses on denying known threats while permitting other traffic.
• 😀 Firewalls help protect organizations from external threats, such as denial-of-service attacks, and ensure that only trusted internal users and authorized services are allowed network access.

Q & A

What is a firewall in network security?

A firewall is a device (hardware, software, or a combination of both) that monitors and controls incoming and outgoing network traffic based on predefined rules. It serves as a barrier to prevent unauthorized access and threats from entering or leaving a network.

How does a firewall function?

A firewall monitors network traffic, checking the source and destination of packets. It applies predefined rules to allow or deny certain traffic. The firewall can block specific IP addresses, networks, or services, ensuring that only authorized data flows in and out of the system.

What are the two main types of firewalls?

The two main types of firewalls are host-based firewalls, which are software-based and run on individual machines, and network-based firewalls, which are dedicated hardware systems used to protect entire networks in organizations.

What is a host-based firewall?

A host-based firewall is installed on an individual device, such as a computer or laptop. It primarily functions as software and controls the traffic going in and out of that specific device.

What is a network-based firewall?

A network-based firewall is used to protect an entire network within an organization. It typically involves dedicated hardware and firewall software running on that hardware to filter traffic across the entire network.

What is packet filtering in firewall operations?

Packet filtering is the process where a firewall checks the headers of incoming and outgoing packets, typically at the network and transport layers. It inspects IP and TCP headers to decide whether to allow or deny the packet based on predefined rules.

What are the key components that packet filtering checks in a packet?

Packet filtering checks the IP header and TCP header of a packet. The most important aspects are the IP address (in the IP header) and the port number (in the TCP header).

What does the default allow policy in a firewall mean?

The default allow policy means that the firewall will allow all incoming traffic except for those packets that match explicitly defined deny rules. In other words, the firewall blocks only traffic that is specifically mentioned to be denied.

Can a firewall block services, and how?

Yes, a firewall can block services by filtering packets based on port numbers. For example, it can block HTTP traffic on port 80 or FTP traffic on port 21 to prevent access to certain services from unauthorized users.

What are some examples of firewall rules that can be implemented?

Firewall rules can block specific IP addresses, entire networks, or services based on port numbers. For example, a firewall can block traffic from a specific IP address, block an entire network from accessing the internal network, or block HTTP or FTP services.