-: In this demonstration, we're going to explore 2 2
a basic small office/home office network firewall. 3 3
In this example, I'm going to use a typical 4 4
router/switch access point combination device 5 5
manufactured by Netgear and marketed 6 6
as a wireless network N300 model. 7 7
Now, this is probably very similar 8 8
to what most of you are using in your small office 9 9
or home office environments. 10 10
Your interface and settings on your firewall 11 11
are going to look a little different than mine, 12 12
but it's still going to give you the same general idea 13 13
of what kind of options there are 14 14
and how you can configure one of these firewalls 15 15
at your network boundary. 16 16
On the screen, you can see the basic web-based access 17 17
for this wireless router/wireless access point 18 18
combination device. 19 19
On mine, I'm going to go to Security, 20 20
which is where the firewall is located 21 21
and it's under Blocked Services on this particular router. 22 22
Usually, most of these small office/home office routers 23 23
are going to have a very weak type firewall 24 24
and they hide it by calling it something else 25 25
instead of calling it a firewall, 26 26
so, it'll be called blocked sites, blocked services, 27 27
blocked ports, something of that nature. 28 28
In this case, it's blocked services 29 29
and I can do it based on a schedule, 30 30
so, I only want it to be certain times of the day or always. 31 31
Let's say I want to block something like Telnet. 32 32
I'm going to always block it, I'm going to add a block, 33 33
and the block I want to use is going to be a Service, 34 34
and go down to Telnet. 35 35
It automatically knows that Telnet is port 23, 36 36
so, it's going to block port 23 for me. 37 37
It's called Telnet because this is a predefined one 38 38
and then, I can block it for all IP addresses in this network 39 39
or only certain IP addresses or a certain range. 40 40
Maybe I want to block it for everything for Telnet. 41 41
That's fine, we can go ahead and add that to our list. 42 42
If we want to add something else, 43 43
let's say I have another rule. 44 44
In this case, I want to block port 666 45 45
because maybe there's a game 46 46
I don't want my kids playing on that, 47 47
so, I'll block it as port 666. 48 48
I'm going to make it TCP, UDP, or both, 49 49
I'm going to say both in this case, 50 50
and I'm just going to call it Game. 51 51
And then, I can block it for an IP range. 52 52
Maybe I don't want it be accessed by my kids 53 53
which all have their devices 54 54
in the 10.0.0.2 and the 10.0.0.10 range. 55 55
If I do that, I can go ahead and hit Add. 56 56
And, again, that adds another rule to the firewall 57 57
where we are blocking port 666 over that range of IPs. 58 58
You can see how this works as you 59 59
add or delete different rules. 60 60
Then, I can go through and I can do another one. 61 61
Let's say I want to block the 62 62
FTP server, 63 63
so, I will just go through here and say user defined 64 64
port 20 through port 21 65 65
because that is the connection port 66 66
and the data ports for FTP. 67 67
And then, we'll give it a name of FTP 68 68
and we can do it for all IP addresses in this range, 69 69
so nobody can access FTP servers. 70 70
That's the idea of how this firewall works. 71 71
In this case, it's blocking the outbound connections 72 72
because it's preventing us from sending things 73 73
out to the Internet. 74 74
If we want to block things from coming in from the Internet, 75 75
we're going to have to do that in a different firewall 76 76
on this particular device 77 77
because this one only has the outbound defined here. 78 78
It's going to have what things 79 79
as it's going out to the Internet. 80 80
Now, if I want to do this on inbound stuff, 81 81
I would have to go and find that 82 82
in this particular router. 83 83
That's usually going to be something like port forwarding 84 84
or port triggering or something like a static route. 85 85
In this case, I can port forward or port trigger 86 86
and say hey, if something's trying to come in 87 87
on port 21, FTP, it can go and be routed to my server, 88 88
which is at the .50, for instance. 89 89
So now, anything that comes in that's trying to get to 90 90
this router on port 21 is going to be forwarded 91 91
over to that IP address of .50. 92 92
That's how you allow things in to your network 93 93
based on this particular firewall. 94 94
How do you block things with the firewall? 95 95
Well, in this particular router, 96 96
everything is blocked by default 97 97
because it's doing an implicit deny, 98 98
so, anytime I add a rule, like FTP here, 99 99
that's doing an explicit allow. 100 100
Anything you don't allow is going to be blocked by default 101 101
on the inbound, based on this particular router.