- [Instructor] Let's talk firewalls.
A firewall is a device or application
designed to protect a network
or individual computer from intrusion,
and there's two main types that you should know.
The personal software firewall is the first one.
This is an application that's loaded on your computer,
whether it's a mobile device,
or a PC, or laptop, or what have you.
And it protects that individual computer
from unwanted internet traffic,
and it usually does so
by way of a set of rules and policies.
One example is the Windows firewall,
this is built into Windows.
If we go to the control panel
and scroll down to Windows firewall,
we can click on that and bring that up,
and that's our windows firewall built into this.
And you can see here that it's not on right now.
Generally, if you see this on a computer
you'll probably want to turn it on.
So we'll click on the link
and turn it on for the private and for the public.
OK it, and we're good to go
and everything's green check marked.
Also in Windows you have the Windows firewall
with advanced security,
and you can bring that up by going
to the run prompt and typing wf.msc.
And I'll drag that window over,
and this is a lot more in depth.
You have all kinds of rules for what you're doing
on your computer, inbound and outbound,
so you can really configure this guy in more depth.
So Windows firewall with advanced security.
Other examples include ZoneAlarm,
and also for Linux you have IP Firewall and iptables.
So there's all kinds of options as far as
personal firewalls go.
The other type is gonna be the network based firewall,
and a network based firewall
protects an entire network of computers
from intrusion from the internet.
And generally you're talking about a device,
a standalone device.
This could be as simple as one of those 4 port SOHO routers
that has a built-in firewall,
or it could be a standalone appliance,
a black box something by Cisco, or Check Point
or Juniper, whatever.
And let's show an example, let's illustrate this.
If you look here, we have a set of computers
connected to a switch,
and then they are connected out through the firewall.
Now you'd probably have a router here also where
this would be an all in one device or what have you,
but we're depicting the firewall here as a separate device
which is behind the switch, or behind the router,
that's how it's considered.
So these computers are on the LAN,
they connect through the firewall and out to the internet,
so they can make connections to computers
and servers on the internet,
but those computers will not be able to connect to these,
the servers on the internet will not be able to connect
to these 'cause they'll bounce off the firewall
if it's configured properly.
And generally the firewall will include NAT filtering,
or network address translation endpoint filtering,
and that filters, ports, TCP and UDP ports,
and it does this by matching the incoming
and outgoing traffic,
and making sure that all the IP addresses correspond.
And the firewall will also do packet filtering,
it'll inspect each packet passing through the firewall
and accept it or reject it based on a set of rules.
And the most common type
is Stateful Packet Inspection, that's SPI.
With Stateful Packet Inspection it's looking
at the actual packets, it's breaking them down
and making sure that they are the type of packets
that are acceptable.
Stateless packet filtering does not do that,
and it doesn't retain a memory of packets
that have passed through the firewall, so not as good.
But generally you're gonna use
SPI Stateful Packet Inspection.
Let's show an example of that.
Okay, once again,
here's our AC1750 SOHO all in one device
and here's the firewall setting,
and we have SPI, Stateful Packet Inspection,
and it is enabled.
And that's what you want.
You wanna make sure that that is enabled,
so that you can have this packet inspection
and the firewall will block the packets that you don't want.
If we go to the advanced security section,
you'll see that we can enable filtering
for different types of attacks,
like ICMP FLOODs, which are basically ping packets
and UDP FLOODs, TCP synchronization FLOODs.
So, you know, you could do a lot of this.
You might set it to a particular amount of packets.
Like we could set this to 10
and this way, if you're external from the router
and you want to see if it actually works still,
you could ping it and you'll get replies.
But if you tried to do more than 10,
like if you did a dash N space 50 with your ping command
then this router would block it
'cause that would go past the threshold.
So you have some thresholds that you can set here,
so it's pretty cool.
So that's a little bit about the firewall
built into this router.
And you know, keep in mind that firewall could be built
into your SOHO router, it could be an all in one device,
it could be part of a unified threat management solution,
but in some cases it'll just be its own device,
and you'll have your computers, your switch, your router
and then your firewall, which is behind all that,
and that's your first line of defense
against intrusion from computers on the internet.
So that's it for the sub lesson.