Lesson 46 · Network security: attacks and defences

Defence: firewalls and ACLs

Start on the defender's side: a server with nothing in front of it receives a ping sweep and then SYN probes, answers each one as the ping and TCP standards say it should, and so hands an attacker a map of its open services. Then a firewall is switched on in front of it. Watch it read each packet's 5-tuple against an ordered rule list, let only port 443 through, remember the connections it allowed so their replies pass, and drop a forged reply that a simple stateless filter would have let in.

14 min13 steps5 questionsIntermediate

Fig 46 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01With no firewall, a SYN probe to port 80 comes back with a RST. What does the scanner learn?

TCP answers a SYN to a closed port with a RST (RFC 9293). Nothing listens on that port, but the answer itself proves a host is there. A SYN-ACK would have meant open; silence would have meant filtered.

02An attacker sends a forged packet with only the ACK flag set, pretending to be a reply, to port 3306. What happens?

A stateless ACL judges each packet alone, so a rule that admits anything with ACK set is fooled by a forged one. A stateful firewall checks its state table: no allowed connection matches, and a lone ACK cannot open one, so it is dropped.

03A packet matches rule 2 and rule 5. Which rule decides what happens to it?

Rules are read from the top and the first match wins. Rules below it are never read for that packet, which is why order matters.

04Why did the scanner see 'filtered' for ports 80 and 3306 instead of 'closed'?

A closed port on an unprotected server answers with a RST, which still proves a machine is there. A silent drop leaves the scanner unable to tell closed from absent.

05A home router's NAT already drops unsolicited packets. Why still use a real firewall, and a host firewall on the server?

NAT rewrites addresses; it is not a security mechanism (RFC 4864). A firewall drops by rule, on purpose. The network firewall guards the edge, and the host firewall guards one machine even from devices that never cross that edge.

Key terms

Glossary

Ping sweep: Host discovery: a ping (ICMP echo request) sent to every address in a range; each echo reply marks a live machine.
Port scan: Probes (usually SYNs) sent to many ports; the replies show each port as open (SYN-ACK), closed (RST) or filtered (silence).
Exposed service: A program on a machine that strangers can reach over the network, such as SSH on port 22 or HTTPS on 443.
Firewall: A device or program that checks every packet against rules and lets through only what the rules allow.
Default deny: The policy that anything not explicitly allowed is dropped, usually as an implicit last rule, deny all.
ACL: Access control list: an ordered list of allow and deny rules. A plain ACL is stateless: it judges each packet on its own.
Stateful firewall: A firewall that remembers allowed connections in a state table, so their replies pass without a rule of their own.
Host firewall: A firewall running on one machine itself, guarding it even from devices on the same network.

Fine print

Notes and sources

Host discovery does not need pings: a sweep can send TCP probes instead, and any answer, even a RST, proves a machine is at that address (NIST SP 800-115 §4.1).
Open, closed and filtered are what a scanner infers from replies: SYN-ACK from a listening port, RST from a closed one (RFC 9293), and silence or an ICMP destination unreachable error (RFC 792, type 3) when something in the path blocked the probe.
203.0.113.10, 192.0.2.7, 192.0.2.66 and 198.51.100.0/24 are RFC 5737 documentation addresses; client port numbers are illustrative.
Dropping silently is the usual choice for internet-facing rules. A firewall may instead reject (answer with a RST or an ICMP error), which is friendlier for honest clients but tells a scanner the firewall is there.
Firewalls differ in detail: some read a lone ACK with no row as invalid and drop it at once (as shown), others pass it on to the rules, where deny all drops it. Either way it does not get in.
Because the first match wins, put specific rules above broad ones. A broad allow placed first makes every rule below it dead.

Quiz Unlocks after the last step.