What are the main functions of a firewall?

The purpose of a firewall is to establish a security control point between network connections, and to audit and control services and access to and from the internal network by allowing, denying, or redirecting the flow of data through the firewall.

To control network and device traffic, firewalls are divided into software firewalls and hardware firewalls, which have basically the same functions and can be used together.

1. Intrusion detection:

One of the main functions of network firewall technology is the intrusion detection function, which mainly includes anti-port scanning, denial of service tool detection, CGI IIS server intrusion, Trojan or network worm attack, buffer overflow attack and other functions, which can greatly reduce the intrusion of network threat factors and effectively block most network security attacks.

The use of firewall technology can effectively realize the IP address translation of the internal network or the external network, which can be divided into source address translation and destination address translation, that is, SNAT and mainly used to hide the internal network structure, avoid illegal access and malicious attacks from the external network, and effectively alleviate the shortage of address space, while DNAT is mainly used for external network hosts to access intranet hosts, so as to avoid internal network attacks.

3. Audit and monitoring of network operations

Through this function, all operations of system management and security information can be effectively recorded, and statistics on network usage can be provided, which is convenient for computer network management for information tracking.

What about the technology of the firewall?

Firewall technology is a technology that helps computer networks build a relatively isolated protective barrier between their internal and external networks by organically combining various software and hardware devices used for security management and screening, so as to protect the security of user data and information.

The function of firewall technology is mainly to discover and deal with the security risks and data transmission problems that may exist in the operation of the computer network in a timely manner, and the processing measures include isolation and protection, and at the same time, the various operations in the computer network security can be recorded and detected, so as to ensure the security of the computer network operation, protect the integrity of user data and information, and provide users with a better and safer computer network experience.

The main functions of a firewall are:

1) Cyber security barriers.

Firewalls can greatly improve the security of internal networks by reducing risk by filtering out insecure services. Since only selected and authorized application protocols can pass through the firewall, the network environment becomes more secure. Firewalls can prohibit protocols such as insecure NFS from entering and exiting a protected network, making it impossible for attackers to exploit these vulnerable protocols to attack internal networks.

The firewall also protects the network from route-based attacks such as source route attacks in the IP option and ICMP redirect paths. The firewall rejects all packets of the above types of attacks and notifies the firewall administrator of the situation in a timely manner.

2) Strengthen network security strategies.

Configured through a firewall-centric security scheme. All security software (such as passwords, encryption, authentication, etc.) can be configured on the firewall. Centralized security management of firewalls is more economical than dispersing network security issues across hosts.

For example, when accessing a network, the one-at-a-time password system and other authentication systems can be centralized in the firewall instead of being distributed across hosts.

3) Monitor and audit network access and accessSince all access must go through the firewall, the firewall can not only make complete logs, but also provide statistics on network usage. When suspicious action occurs, the firewall provides appropriate alerts and provides detailed information about whether the network is being monitored and attacked. In addition, it is important to collect information about the use and misuse of a network.

This not only helps to understand whether the firewall controls are resistant to attackers and attacks, and whether the firewall controls are adequate and effective, but also helps to make network requirements analysis and threat analysis.

4) Prevent the leakage of internal information.

By using the firewall to divide the internal network, the key network segments in the internal network can be isolated, and the mutual access between different departments in the internal network can be restricted, so as to ensure the security of sensitive data in the network. In addition, privacy is a very important concern in internal networks, and inconspicuous details in an internal network may contain clues about security that may be of interest to external attackers, or even expose some security vulnerabilities in the internal network. Use a firewall to hide services that reveal internal details, such as finger, DNS, etc.

finger displays the username, real name, last logon time, and shell type of all users of the host. However, the information displayed by the finger is very easy for attackers to understand. Attackers can know how often a system is used, whether the system has users connected to the Internet, whether the system attracts attention when attacked, and so on.

Firewalls can similarly block DNS information about the internal network, so that a host's domain name and IP address are not known to the outside world.