📄 ch14.htm
字号:
<HTML><HEAD><TITLE>Chapter 14 -- How Firewalls Work</TITLE><META></HEAD><BODY TEXT="#000000" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#551A8B" ALINK="#CE2910"><H1><FONT SIZE=6 COLOR=#FF0000>Chapter 14</FONT></H1><H1><FONT SIZE=6 COLOR=#FF0000>How Firewalls Work</FONT></H1><HR><P><CENTER><B><FONT SIZE=5><A NAME="CONTENTS">CONTENTS</A></FONT></B></CENTER><UL><LI><A HREF="#HowFirewallsWork">How Firewalls Work</A></UL><HR><P>All intranets are vulnerable to attack. Their underlying TCP/IParchitecture is identical to that of the Internet. Since the Internetwas built for maximum openness and communication, there are countlesstechniques that can be used to attack intranets. Attacks can involvethe theft of vital company information and even cash. Attackscan destroy or deny a company's computing resources and services.Attackers can break in or pose as a company employee to use thecompany's intranet resources.<P><I>Firewalls</I> are hardware and software combinations that blockintruders from access to an intranet while still allowing peopleon the intranet to access the resources of the Internet. Dependingon how secure a site needs to be, and on how much time, money,and resources can be spent on a firewall, there are many kindsthat can be built. Most of them, though, are built using onlya few elements. Servers and routers are the primary componentsof firewalls.<P>Most firewalls use some kind of <I>packet filtering</I>. In packetfiltering, a <I>screening router</I> or <I>filtering router</I>looks at every packet of data traveling between an intranet andthe Internet. See <A HREF="ch13.htm" >Chapter 13</A> for more information on filtering.<P><I>Proxy servers</I> on an intranet are used when someone fromthe intranet wants to access a server on the Internet. A requestfrom the user's computer is sent to the proxy server instead ofdirectly to the Internet. The proxy server contacts the serveron the Internet, receives the information from the Internet, andthen sends the information to the requester on the intranet. Byacting as a go-between like this, proxy servers can filter trafficand maintain security as well as log all traffic between the Internetand the network.<P><I>Bastion hosts</I> are heavily fortified servers that handleall incoming requests from the Internet, such as FTP requests.A single bastion host handling incoming requests makes it easierto maintain security and track attacks. In the event of a breakin, only that single host has been compromised, instead of theentire network. In some firewalls, multiple bastion hosts canbe used, one for each different kind of intranet service request.<H2><A NAME="HowFirewallsWork"><FONT SIZE=5 COLOR=#FF0000>How Firewalls Work</FONT></A></H2><P>Firewalls protect intranets from any attacks launched againstthem from the Internet. They are designed to protect an intranetfrom unauthorized access to corporate information, and damagingor denying computer resources and services. They are also designedto stop people on the intranet from accessing Internet servicesthat can be dangerous, such as FTP. <OL><LI>Intranet computers are allowed access to the Internet onlyafter passing through a firewall. Requests have to pass throughan <I>internal screening router</I>, also called an <I>internalfiltering router</I>or <I>choke router</I>. This router preventspacket traffic from being sniffed remotely. A choke router examinesall pack-ets for information such as the source and destinationof the packet.<FONT COLOR=#FFFFFF>1</FONT><LI>The router compares the information it finds to rules in a<I>filtering table</I>, and passes or drops the packets basedon those rules. For example, some services, such as rlogin, maynot be allowed to run. The router also might not allow any packetsto be sent to specific suspicious Internet locations. A routercan also block every packet traveling between the Internet andthe internal network, except for e-mail. System administratorsset the rules for determining which packets to allow in and whichto block.<LI>When an intranet is protected by a firewall, the usual internalintranet services are available-such as e-mail, access to corporatedatabases and Web services, and the use of groupware.<LI>Screened subnet firewalls have one more way to protect theintranet-an <I>exterior screening router</I>, also called an <I>exteriorfiltering router</I> or an <I>access router</I>. This router screenspackets between the Internet and the perimeter network using thesame kind of technology that the interior screening router uses.It can screen packets based on the same rules that apply to theinternal screening router and can protect the network even ifthe internal router fails. It also, however, may have additionalrules for screening packets specifically designed to protect thebastion host.<LI>As a way to further protect an intranet from attack, the bastionhost is placed in a <I>perimeter network</I>-a subnet-inside thefirewall. If the bastion host was on the intranet instead of aperimeter network and was broken into, the intruder could gainaccess to the intranet.<LI>A bastion host is the main point of contact for connectionscoming in from the Internet for all services such as e-mail, FTPaccess, and any other data and requests. The bastion host servicesall those requests-people on the intranet contact only this oneserver, and they don't directly contact any other intranet servers.In this way, intranet servers are protected from attack. Bastionhosts can also be set up as proxy servers. See <A HREF="ch15.htm" >Chapter 15</A> formore information about proxy servers and <A HREF="ch16.htm" >Chapter 16</A> for more informationabout bastion hosts.</OL><HR><CENTER><P><A HREF="ch13.htm"><IMG SRC="PC.GIF" BORDER=0 HEIGHT=88 WIDTH=140></A><A HREF="#CONTENTS"><IMG SRC="CC.GIF" BORDER=0 HEIGHT=88 WIDTH=140></A><A HREF="contents.htm"><IMG SRC="HB.GIF" BORDER=0 HEIGHT=88 WIDTH=140></A><A HREF="ch15.htm"><IMG SRC="NC.GIF" BORDER=0 HEIGHT=88 WIDTH=140></A><HR WIDTH="100%"></P></CENTER></BODY></HTML>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -