Packet filtering at network boundaries, continued
Depending on the provided bandwidth to and from an internal network,
e.g. from home over a modem and PPP (56Kbps, 100 packets/sec),
or an ADSL or (now) NBN router (3-100Mbps, 250,000 packets/sec),
a firewall may be:
- part of a traditional, single, workstation (protecting itself),
- a computer or device protecting several other workstations, or
- a dedicated device doing nothing else but protecting other hosts.
Because a traditional computer, acting as a firewall,
must inspect each packet entering and leaving the internal network via a
number of different network interfaces
(for example, modem, wired-Ethernet, wireless-Ethernet),
they must implement and respond to security policies as quickly as possible.
Such requirements usually place the responsibilities in the
operating system kernel,
with user-level programs used to set, modify, and enquire
about the current state.
This is in contrast to popular 'personal firewall' software for
home computers -
generally user-level programs to which an operating system
passes packets for inspection.
Such personal firewall programs,
often driven by GUI-based software,
run more slowly.
CITS3002 Computer Networks, Lecture 11, Security of TCP/IP, p17, 15th May 2024.
|
CITS3002