3Com 3036, Руководство по настройке

Страница: 552 / 762

548 C
HAPTER
39: C
ONFIGURING
F
IREWALL
Classification of Firewalls
Usually firewalls are divided into two types: network layer firewalls and application
layer firewalls. A network layer firewall mainly obtains the packet head
information of data packets, such as protocol number, source address and source
port, destination address and destination port, or directly obtains the data of a
packet head. But an application layer firewall analyzes the whole information
stream.
Commonly used firewalls include the following:
■
Application Gateway: checks the application layer data of all data packets
passing through this gateway. For example, the FTP application gateway will be
a FTP server to a connected client end, but will be an FTP dlient to the server
end. All FTP data packets transmitted on the connection must pass through this
FTP application gateway.
■
Packet Filtering: filters each data packet using the user-defined items. For
example, to check if the source address and destination address of a data
packet meet the rules.
Packet filtering does not check call status, nor does it
analyze the data. If data packets with port 21 or greater than or equal to 1024
are allowed to pass, then once a port meets this condition, the data packet can
pass this firewall. If the rules are configured, then many data packets with
hidden security troubles can be filtered out on this layer.
■
Proxy: normally refer to address proxy on a proxy server or a router. It replaces
the IP address and port of a host inside the network with the IP address and
port of a server or router. For example, the intranet address of an enterprise is
129.0.0.0 network segment, and its formal external IP address is
202.38.160.2-202.38.160.6. When the internal host 129.9.10.100 accesses a
certain external server in WWW mode, the IP address and port might become
202.38.160.2:6080 after passing through the proxy server. An address
mapping table is maintained in the proxy server. When the external WWW
server returns the result, the proxy server will convert this IP address and port
into the internal IP address and port 80 of the network. The proxy server is used
so that all access between the external network hosts and the internal network
occurs through this proxy server. In this way, the access to internal devices that
contain important resources can be controlled.
Packet Filtering Usually, packet filtering refers to filtering for IP data packets forwarded. For the
data packets that need to be forwarded by a router, first the packet header
information, including the number of the upper layer protocol carried by the IP
layer, the packet's source/destination address and source/destination port is
obtained. Then the information is compared with the set rules. Finally, it is decided
whether to transfer or discard the data packet according to the comparison result.
Packet filtering (for IP data packets) selects the following elements for judgment
(in the figure, the upper layer protocol carried by IP is TCP), as shown in the figure
below.