Firewalls, intrusion detection, and attacks on infrastructure
Beyond encryption, networks need defences that control and monitor traffic, and protection for core infrastructure such as routing and DNS.
Packet-filtering firewalls
A firewall enforces rules about which traffic may pass between networks. Stateless packet filters examine each packet's header fields, such as source and destination addresses, ports, and protocol, against an ordered rule list, for example blocking all inbound traffic except to port 443 on the web server. They are fast but cannot tell whether a packet belongs to a legitimate conversation.
Stateful firewalls
Stateful firewalls track connections, allowing reply packets for conversations initiated from inside while blocking unsolicited inbound packets. Home routers combine NAT with this behaviour. A common policy is default deny: block everything not explicitly permitted, which limits exposure if a new service is accidentally started.
Application gateways and next-generation firewalls
Application-level gateways, or proxies, understand specific protocols, such as HTTP, and can filter requests by content, authenticate users, and log activity. Next-generation firewalls and web application firewalls (WAFs) combine filtering with application awareness, blocking attacks such as SQL injection in web requests, though encryption limits what they can see unless they terminate TLS.
Intrusion detection and prevention
Intrusion detection systems (IDS) monitor traffic for signs of attack, using signatures of known attacks or anomaly detection that flags unusual behaviour; Snort and Suricata are well-known open-source tools. Intrusion prevention systems (IPS) sit inline and block suspicious traffic. They generate false positives and negatives, so tuning and skilled analysts matter.
Defending against DDoS
DDoS defences include over-provisioning capacity, rate limiting, filtering obvious junk, and scrubbing services that absorb attack traffic across large global networks before passing clean traffic on. Reflection and amplification attacks spoof a victim's address and send small requests to services, such as open DNS resolvers or memcached servers, that send much larger replies to the victim; closing open services and filtering spoofed addresses at network edges (BCP 38) reduces them.
Protecting routing and DNS
Routing hijacks, in which networks announce prefixes they do not own, can divert or black-hole traffic; RPKI route origin validation lets networks reject unauthorised announcements. DNS can be attacked by cache poisoning, hijacked registrar accounts, or DDoS on authoritative servers; DNSSEC, registry locks, multi-factor authentication for registrar accounts, and multiple DNS providers reduce the risk.
Security operations
Defence is ongoing. Organisations collect logs and network flow records into security information and event management (SIEM) systems, segment networks so a compromise in one area cannot easily spread, patch devices promptly, and practise incident response. Many breaches begin with stolen credentials or phishing rather than network exploits, so identity security matters as much as firewalls.
Worked example
A firewall policy for a small company: allow established and related connections; allow inbound TCP 443 to the web server at 192.0.2.10; allow inbound TCP 22 only from the administrator's VPN range; allow outbound DNS to the company resolver; deny everything else and log it. A scan from the internet to port 3389 on an office PC matches no allow rule, so it is dropped and logged, while employees' outgoing web browsing works because replies match established connections.
Key takeaways
Firewalls enforce traffic rules: stateless filters check headers per packet; stateful firewalls track connections and usually default deny. Proxies, next-generation firewalls, and WAFs inspect application traffic, limited by encryption. IDS and IPS detect or block attacks using signatures and anomalies, with tuning needed. DDoS defences include capacity, rate limiting, and scrubbing; amplification attacks abuse open services and spoofing, countered by closing services and BCP 38 filtering. RPKI protects routing; DNSSEC, registry locks, and MFA protect DNS. Security operations rely on logging, SIEM, segmentation, patching, and incident response.
Flashcard
Enforces rules on traffic between networks
Check your understanding
Why does a stateful firewall allow a reply from a website while blocking an unsolicited packet to the same port?