Why a firewall and how it works

As soon as a site is connected to the Internet and its millions of users, it can be attacked by facetious or malicious individuals. Attacks can crash disk contents, squatt internal resources such as disk space or CPU power, but also lead to physical damage when a host controls vital or expensive equipment.

Hundreds of computers administered by different individuals cannot be secure.

Protecting the site's network at a single entrance by filtering communications and logging any abnormal activity is a much simpler way to do it: this is the aim of a firewall. The firewall stands between the Internet and the site's networks, and selectively allows connections between internal and external systems as shown in the section titled Architecture. Note that inter-Institute communications do not cross the firewall.

It may seem like putting all your eggs in the same basket, but you can guard that basket very carefully (Brent Chapman).

However, the firewall is not an unbreakable gate beyond which all internal hosts are totally secure, but rather a chicane where the hackers are slowed down and hopefully tracked before they can do harm. Thereby, care still has to be taken regarding security on a host-per-host basis: unguessable passwords, limited network services, etc.

The firewall permits users to carry out certain basic operations (Site access policy section) via application-level gateways called proxies .

Therefore, the firewall is not transparent: external hosts can only reach the firewall itself (plus several hosts dedicated to World Wide Web and anonymous ftp).

Only the IP subnetwork where the firewall and the www/ftp servers are located is accessible from outside (i.e. addressable). This subnetwork is often referred to as the DMZ (DeMilitarized Zone).

No user account is required on the firewall, the proxy only controls authorizations before making the actual connection pass through.