Firewalls Flashcards
Hardware firewall
Often built into routers
Protects LAN from outside threats by filtering the packets before they reach your internal machines
SPI
Stateful packet inspection
Used by hardware firewalls
Inspects each incoming packet individually
Blocks incoming traffic that is not in response to your outgoing traffic
Can even disable unused ports completely
Port forwarding/mapping
Enables you to open a port in the firewall and direct incoming traffic on that port to a specific IP address on your LAN
Port triggering
Enables you to open an incoming connection to one computer automatically based on a specific outgoing connection
Trigger port defines the outgoing connection
Destination port defines the incoming connection
Screened subnet
Puts systems with the specified IP address outside the protection of the firewall
Opens all ports and enables all incoming traffic
VERY DANGEROUS
DO NOT USE
Software firewalls
Windows defender firewall or windows defender firewall with advanced security (examples)
Handles heavy lifting of port blocking, security logging, and more
Fine tune port security
Set up exceptions to open individual ports
Adjust application security by adding exceptions to let specific programs/services pass through the firewall
Network types
Domain
Private
Guest/public
Domain network
Windows network controlled by windows domain controller
Runs Active Directory domain services
Domain tells machine what it can and cannot share
Private network
Enables you to share resources, discover other devices, and allow other devices to discover your computer safely
Guest/public network
Network prevents your computer from sharing and disables all discovery protocols
IDS
Intrusion detection system
Internet application that inspects packets looking for active intrusions
Functions inside the network
Watches for threats the firewall might miss (viruses, illegal logon attempts, other well known attacks)
Can discover internal threats (inspects traffic inside the network)
Attacks are logged at the very least, some offer notifications
CANNOT stop and attack, only request assistance from other devices
IPS
Intrusion prevention system
Sits directly in the flow of network traffic
CAN stop an attack while it is happening
Network bandwidth and latency take a hit
If IPS goes down, the network link might go down too
Some can block incoming packets on the fly based on IP address, port number, or application type
Some can even fix packets on the fly
Network tap
Network monitoring hardware that sits between devices on the network and copies the traffic between them for later analysis
Allows traffic to flow normally
Copied traffic can be inspected without risk of network disruptions
Can also be a part of virtual networks
