Firewalls are arguably one of the best methods of protecting your computer.
Yet very few people understand them.
I will suggest that the reason for this is because Microsoft does a pretty good job of implementing
firewalls within their Windows operating system.
Windows firewalls has been part of the operating systems since its introduction in Windows XP Service
Pack two.
And over time, its functional functionality has increased as a basic description.
Their firewall is designed to either allow or deny network traffic based upon a sort of defined criteria.
So these criteria could be a predefined set of default rules or called the use of created or even combination
of two.
These rules are often referred to as access control entries.
AC and group of them form an access control list ACL, so these criteria could then be applied to outpoint
or egress, trafficked or inbound or increase traffic.
So understanding that a rule can be applied in each direction is important to know.
For example, you may be troubleshooting a connectivity problem between two devices so you won't use
the commonly used I.
S MP tool known as ping signs.
Um, I can be used for malicious purposes and Windows Firewall looks.
It's by default, so you are aware of this and enable and uh and outbound rule to load the traffic out,
but you get no responses back.
This is very likely due to an important rule preventing ICMP traffic back into your PC you.
So in this screenshot, we can see the result of two attempts to ping the IP address 8.8.8.8, which
belongs to the Google's public DNS server and is commonly used by I.T. support staff to test connectivity
to the internet.
So we can see that the ping command at the beginning of this screenshot is useful.
A successful action before running the command the second time I enabled, uh, outpoint firewall,
a rule that blocks ICMP traffic.
As you can see here, the second command does not elicit the same result as the first one.
So a number of firewalls reach for their rules in a sequential manner.
So they read the rules in order until they find one that matches and then apply that rule and doesn't
carry out any further processing.
So what problems called arise from this?
So we have two.
Let's look at the absolute firewall rules.
So the first rule is block all inbound traffic from an IP address between ten point zero points 0.1
and ten point zero point zero point ten.
And the second rule is a low all inbound traffic from at just ten point zero point zero point five.
So the firewall will look for a match for rule, a rule of one first.
And if no one's found it, will then move on to check it out.
Rule two If a match was found against Rule one, then it will the world look traffic and not even look
at Rule two.
So that's a real and good.
But what happens to any in that traffic from ten point zero point zero point five?
Despite that, others explicitly being a law to the at the rule tool, it matches a certain criteria
at Rule one.
So it would be blocked.
So a better way of doing this will be to reverse the order of the rule.
So the first rule will be a law all in one traffic from IP address ten point zero point zero point five.
And the second rule will block all inbound traffic from an address from an IP address between ten point
zero points 0.1 and ten point zero point zero point ten.
So by reversing the rules and inbound traffic from ten point zero points, zero point five will be received
by the firewall and cooperate against Rule one.
So in this case, rule one is a match, so the traffic is allowed and Rule two never gets checked.
So Windows Firewall is an example of host based firewall, so a host based firewall is one that is either
built into the operating system or installed on the device.
So, uh, the limitation of this is that you need to configure the firewall on each device and it only
protects that device.
So, you know, one saving grace if you are in a domain environment, is that you can deploy these settings
to each machine using group policy project object actually not project and network based firewall,
on the other hand, provides protection to all of your networks and monitors traffic going in and out
of the network.
So this may be true the dedicated hardware device or the future on another network device, such as
a writer in an organization, you may find network based firewalls are in operating operation between
your own networks and not just between your internal network and the outside world.
So reading to them, as you can see in the screenshot, you may be thinking that the network based firewalls
is a better of the two as it protects the entire network.
However, now I will, uh, write some diagram here.
Well, let's open our diagram of the Are you here?
Can you see it?
Yes.
All that increase the size and the bit.
Here.
So you can see here, so the upon that.
So let's go to new pitch here.
So now I will create a firewall diagram here for better understanding and illustration.
So let's create we need for, uh, for this, we need actually to come to Rome Firewall and one closed
and one router.
So here let's create that diagram.
And like here.
So this will be our comfortable on.
He is home preacher a.
And this will be our computer will be computer we.
Yes.
So these two computers connect to charter routers.
Yes.
For example, like that, so it is computers connected to disrupters.
One.
Two of.
Yes.
One two.
Yeah.
And these rioters, these rioters connects to firewall network based firewall.
For example.
Yes.
So this is the network based firewall.
Network based.
Just prior to.
It'll make it.
And so this rather connects to this network based firewall here.
Oh, that's actually decrease the size of it.
And these firewall calls to internet.
Lieutenant.
Yes, internal.
It's right.
Okay.
But his firewall then goes to internet.
So, uh, as you can see in this diagram, you may be thinking that network based firewall is the better
of the two as it protects the entire network.
However, look at this diagram here.
So I actually let me.
Watch this.
Is this recording, yes.
So however, look at this tiger stall.
As you can see here and pay particular attention to the placement of the firewall here.
So it's only inspecting traffic that transmits trotted.
But what will happen if a computer age here is compromised from attacking computer B, if this comes
after a attacks who come to be?
Then what happens?
So, so is host based firewall better, so it will certainly prevent the present you where computer
a year attacks to come to me.
So but.
It's certain to prevent the present and gives you very comfortable I attack comfortably, of course,
but it leaves your network susceptible to an attack from outside.
So then internet can attack to your comfort or comfortably without justifiable.
So you may be thinking that's OK, because the host base firewalls will protect the system, but this
may be correct for some systems, but not all network devices have the capability to have a host based
firewall.
A lot of Internet of Things do our Internet of Things devices are a prime example of this because of
this.
It's recommended to any network you run has bought host based and network based firewalls to provide
what is known as defense in depth.
So.
Careful consideration needs to take place in respect of positioning the network based firewalls to ensure
that there is no gaps and there is no gaps, and to allow you to play your roles out particularly.
So.
Actually, in next lecture, we will create, um, actually we will cover the various different types
of firearms in more detail in next, uh, in this course, actually.
But for now, I would like to look at the built in Windows firewall.
So in next lecture, we will, um, create and edit our built in Windows Firewall.
So I'm waiting on this lecture.