An approach to improve performance of a packet-filtering firewall

Abstract

Firewalls are generally used to protect private network from unauthorized access. The software based firewalls commonly use large number of rules to govern acceptance or discarding of packets exchanged. Such rules can be implemented in access control lists (ACLs) in the firewalls commonly known as packet filters. These access control rules define contents of the fields like source IP address, destination IP address, source port number, destination port number and the protocol used. Based on the values contained in these fields, the packets are either permitted or denied entry into or out of a network. Conventionally, the rules are applied in the sequential order on the packets arriving at the firewall. This results in poor efficiency due to delay incurred in forwarding the packets through the firewall. In this paper, a method is proposed that reduces the packet matching time, thus improving the performance of the firewall. To achieve this, the ACL rules are rearranged using clustering index method. Also the rules are prioritized based on their usage. The results show that the proposed method results in significant reduction of packet matching time in packet filtering firewalls.