Lec-86: What is Application(Proxy) Firewall in Hindi | Network Security Part-2

Summary

This video explains the concept of proxy firewalls and application gateways, focusing on their operation at the application layer (Layer 5) of the OSI model. Unlike traditional firewalls, proxy firewalls inspect the actual content of data packets, such as usernames and passwords, to ensure secure and valid access. It discusses how these firewalls perform deep packet inspection, protect against Denial of Service (DoS) attacks, and offer security through user authentication and content filtering. The video also touches on VPNs and proxy usage in environments like schools and businesses to bypass restrictions and enhance security.

Takeaways

• 🔒 Proxy firewalls, also known as application gateways, operate primarily at the Application Layer (Layer 5) of the TCP/IP model.
• 🛡️ Unlike network firewalls, proxy firewalls inspect both the header and the content of data packets for security threats.
• 💻 They validate user authentication by checking usernames and passwords before granting access to web services or databases.
• 🔑 Sensitive data, such as login credentials, is transmitted securely using HTTPS (HTTP over SSL/TLS) and is inspected without exposing plain text.
• 📦 Proxy firewalls perform deep packet inspection, analyzing packet sequences, keywords, and potentially malicious content.
• ⚡ They can prevent Denial-of-Service (DOS) attacks by detecting repeated requests from the same or multiple IP addresses.
• 📧 Similar to email spam filters (e.g., Gmail), proxy firewalls scan for suspicious keywords to identify potential threats.
• 🌐 Network proxies used in schools or organizations block access to specific websites, which is different from the function of proxy firewalls.
• 🛠️ VPNs create secure tunnels that allow users to appear as if they are accessing the internet from a different IP, bypassing restrictions.
• 🔍 Proxy firewalls enhance overall network security by validating users, filtering content, and preventing malicious or unauthorized access.

Q & A

What is a proxy firewall and at which OSI layer does it primarily operate?

A proxy firewall, also called an application gateway, operates primarily at the Application layer (Layer 7) of the OSI model. It inspects the actual data being transmitted, such as usernames, passwords, and application content, rather than just packet headers.

How does a proxy firewall differ from a traditional packet filtering firewall?

A traditional packet filtering firewall works at lower layers (Network and Transport layers) and checks IP addresses and port numbers. A proxy firewall goes further by analyzing application-level data, performing deep inspection to detect malicious content or unauthorized users.

What types of data does a proxy firewall inspect?

Proxy firewalls inspect application-level data, including user credentials (usernames and passwords), messages, keywords in content, and the sequence of packets to detect anomalies or potential threats.

Why is HTTPS important in the context of proxy firewalls?

HTTPS encrypts the data being transmitted, including usernames and passwords. This ensures that sensitive information does not travel in plain text, allowing proxy firewalls to inspect the encrypted data securely after decryption at the firewall level.

What happens when a user's credentials are invalid according to the proxy firewall?

If a user is invalid or unauthorized, the proxy firewall drops the request, preventing access to the web service, main server, or database.

How does a proxy firewall protect against DOS and DDoS attacks?

Proxy firewalls can block repeated requests from the same IP address or detect unusual packet sequences from multiple IPs, preventing network overloads and ensuring the security of the system.

What is deep scanning in the context of proxy firewalls?

Deep scanning involves analyzing the actual content of data packets for suspicious keywords, malware patterns, or anomalies, rather than just inspecting headers. This allows the firewall to identify threats at the application level.

How does a proxy firewall manage sessions for valid users?

For valid users, the proxy firewall creates a secure session that allows them to access web services, databases, or servers safely. All subsequent requests within that session are managed and monitored for security.

How do regular proxies and VPNs differ from proxy firewalls?

Regular proxies and VPNs primarily provide alternate IP addresses or tunnels to bypass network restrictions. Unlike proxy firewalls, they do not inspect application data for security threats or validate user credentials.

Can you give an example of keyword filtering used by proxy firewalls?

Email services like Gmail use keyword filtering to detect spam or malicious content. For example, emails containing suspicious words like 'attack' may be flagged or sent to the junk folder based on deep content inspection.

Why might students confuse regular proxies with proxy firewalls?

Students might confuse the two because both use the term 'proxy.' However, regular proxies in schools or universities are often used to block or bypass certain websites, while proxy firewalls are security devices that inspect and filter data at the application level.