Effectiveness of firewalls at protecting a network
Discuss the effectiveness of firewalls at protecting a network
In this lesson
- How a firewall inspects and filters incoming and outgoing traffic using rules, whitelists and blacklists
- The strengths and limitations of firewalls
- How NAT adds to a network's security
LearnWhat a firewall does
A firewall is hardware or software that sits between two networks, usually a local network and the internet, and decides which traffic may pass in each direction.
CheckQuick check
A firewall's rules allow incoming traffic only to the company's mail server on port 25, and its default policy is to block everything else. Which approach is this?
LabConfigure a school firewall
This firewall protects a school network that also hosts the school website on a web server inside it. Inside addresses are shown as private addresses. Watch how each packet is treated as you switch rules, reorder them, change the default policy and turn on stateful inspection. Can you block the address on the block-list without stopping parents from opening the school website?
Rules (checked from the top)
- 1Incoming, port 443, any outside address (school website)
- 2Any direction, port any, outside address 203.0.113.66 (address on a block-list)
- 3Outgoing, port 443, any outside address (web browsing)
- 4Outgoing, port 53, any outside address (DNS look-ups)
Traffic
4 allowed, 2 blocked.
- A student opens a news websiteout · 10.0.0.25 → 198.51.100.7:443✓ allowedRule 3 matches first, so the packet is allowed.
- The news website repliesin · 198.51.100.7 → 10.0.0.25:51000✕ blockedNo rule matches, so the default policy applies: block everything not explicitly allowed.
- A parent opens the school websitein · 192.0.2.40 → 10.0.0.80:443✓ allowedRule 1 matches first, so the packet is allowed.
- The address on the block-list tries the school websitein · 203.0.113.66 → 10.0.0.80:443✓ allowedRule 1 matches first, so the packet is allowed.
- Someone outside tries to log in to a staff PC by remote desktopin · 192.0.2.99 → 10.0.0.30:3389✕ blockedNo rule matches, so the default policy applies: block everything not explicitly allowed.
- A laptop looks up a domain nameout · 10.0.0.25 → 198.51.100.53:53✓ allowedRule 4 matches first, so the packet is allowed.
Change the default policy, reorder or switch at least one rule, and turn stateful inspection on, to complete this activity. Addresses are examples.
CheckHeader or content?
Can a basic packet-filtering firewall do each of these, or does it need deep packet inspection?
- Block all incoming traffic to port 23 (Telnet)
- Block every packet from one IP address
- Block a download that contains a file matching a known virus
- Block a file-sharing app that sends its traffic on port 443, like ordinary web browsing
- Allow outgoing DNS traffic only to one approved DNS server address
LearnStrengths and limitations
LearnThe role of NAT
You met network address translation in A2.3.1. Although it was introduced to save public IPv4 addresses, it also adds some security.
ExamWorked exam answer
Outline how a stateful firewall treats the reply when a student's computer requests a web page.
[3]ReviewMistakes examiners see
A firewall is not a complete security solution. It is one layer; it does not remove malware or stop someone who is already inside.
Whitelist and blacklist are opposites: a whitelist names what is allowed and blocks the rest; a blacklist names what is blocked and allows the rest.
A firewall does not only check incoming traffic. Outgoing rules can stop malware inside from contacting its controller or sending data out.
Discuss questions need both sides: give strengths and limitations, link them to the scenario, and end with a conclusion.
Exam practiceExam-style questions
5 questions · 18 marks. Answer each one first, then mark it yourself against the markscheme. Your answers are saved in this browser only.
A secondary school has about 900 computers on its network. A records server holds student data and should only be used from inside the school. The school website runs on a web server inside the network and must be reachable from the internet. A firewall sits between the school network and the internet, and the school's router uses NAT.
Identify two items in a packet's header that the school's firewall rules can use to decide whether to allow the packet.
The school's firewall blocks all incoming traffic except traffic that its rules allow. Outline one advantage and one disadvantage of this approach compared with blocking only traffic from addresses on a list of known attackers.
A teacher's laptop on the school network is infected with malware. It copies files from the records server and uploads them to a server on the internet over HTTPS (port 443). Explain why the school's firewall may not stop this.
The network manager says: “We don't need the firewall, because NAT already protects us.” Explain why NAT alone is not enough to protect the school's network.
The school is considering replacing its packet-filtering firewall with a next-generation firewall that uses deep packet inspection. Discuss whether the school should make this change.
0 of 5 questions marked. Mark every question to see your total.
Exam-style questions written for Praxis IB in the format of the 2027 specimen papers. They are not IB past-paper questions.