Chapter 9 - Perimeter Security, DMZs, Remote Access, and VPNs

Abstract

This chapter reviews some basic firewall concepts and briefly discusses the different architectural ways to implement a firewall. It discusses the installation and configuration of free firewalls to run on Linux-based systems. A firewall is basically any component that restricts the flow of network traffic. Some firewalls are limited in capability and others are extremely easy to use. A screened subnet is the simplest and most common firewall implementation. Most small businesses and homes use this type of firewall. This design places the firewall on the edge of the network, dividing everything into internal and external, with nothing in between. The one-legged demilitarized zone (DMZ) still has the advantage of cost, because only a single firewall is used to build a DMZ. Commonly, the firewall interfaces are called internal or inside, external or outside, and DMZ. This type of configuration provides the low cost benefit, but adds some isolation to Internet-based servers. The only real disadvantages to this configuration are complexity, and to a small degree, cost. The true DMZ is generally considered the most secure of firewall architectures. There is an external and internal firewall and between the two is sandwiched any Internet accessible devices. This type of design costs more, but provides increased security.