Popular Products > Computers > Firewall

A PC based firewall is somewhat similar to a real firewall used in buildings and other constructions. The former type of a firewall is used to keep intruders at bay while the latter type is used to contain fires and prevent them from escaping outside the firewall. A PC based firewall is essentially software or an appliance which can allow or prevent network and internet traffic based on a set of pre-defined rules.

Traffic that reaches a PC originates from different trust zones. For example, if traffic is coming from within an office network, then it has a higher trust zone in comparison to traffic originating from the web. Traffic can also come from an intermediate trust zone which is sometimes called a demilitarized zone (DMZ) or a perimeter network.

The function of a firewall is to regulate all the different types of traffic, but to do this effectively a firewall needs to be configured properly. Often it is tempting to use a “default-deny” setting where only traffic that has been given specific permission is allowed to trickle through. However, only advanced firewall experts should try this since it requires a comprehensive understanding of the network and firewall management. At the other extreme, people often use a “default-allow” setting in which all traffic is allowed to come through unless it has been specifically forbidden. Such a setting might compromise the security of the network because it allows practically free entry to worms, viruses and all sorts of malicious codes.

The firewall was born in the late 1980s after the Morris Worm breached the security of many computers. While it was not malicious in intent, this email sent by a NASA employee managed to raise awareness about the lack of safeguards and gave birth to the concept of a firewall. The first generation of packet filters was quickly developed followed by the second generation of stateful filters and the third generation application layers and so on until the mid 1990s when Firewall 1 was born.

The modern firewall uses one of three ways to regulate and monitor traffic, although some firewalls can use a combination of two or more methods. Firewalls can analyse packets of data that enter a system and compare these packets with set filters. Packets that match the filter are allowed to go through the firewall and reach the end user while others are discarded. This is called “packet filtering”. Firewalls can also use a “proxy service” or they can use the newer method of “stateful inspection”. Here, the firewall doesn’t examine the contents of each packet but compares certain portions of it with a trusted database.