In this lesson, we're going to learn
how to configure firewalls.
While routers can use access control lists to provide
some protections and filtering for our networks,
it's really that dedicated device known as a firewall
that excels at using access control lists.
Now, access control lists are very important for us
to be able to secure our networks from unwanted traffic.
A large portion of the permit
and deny statements that we're going to utilize inside
of our ACLs are going to be based on port numbers
because those directly correlate with an application
or service that we want to allow or block.
An access control list, or ACL, is the rule set
that's going to be placed on the firewall, router,
or other network infrastructure devices that will permit
or allow traffic through a particular interface.
These rule sets are going to be used to control the flow
of traffic into or out of our networks.
Now, while access control lists can also be used
to help define proper quality of service levels
inside of our networks,
in this lesson, we're really going to be focused
on their crucial role in security of our networks
and their use inside of firewalls.
To configure the access control lists on our firewalls,
we're either going to be using a web-based interface
or a text-based command-line interface.
When configuring these ACLs, it's always important
to remember that the order in which they're listed
will specify the order of the actions that are taken
on a particular piece of traffic.
Actions will always be performed in a top-down manner
inside of an access control list.
The traffic will first be compared against the first rule,
and then if it matches the condition,
the action will be applied
and it will no longer perform the rest of the ACL.
For this reason, we always use the specific rules
at the top of the list and then the more generic rules
towards the bottom of the list to give us
the best levels of protection.
Now, many devices will support the use
of an implied deny function for their rule set too.
Other devices though, will not support this function,
and so it's considered a best practice
to always include a deny all rule at the end of your ACL
to ensure that only authorized traffic
will be able to enter your network.
Finally, it's important to log your actions taken
by our network infrastructure devices like our firewalls.
Anytime a rule condition is met
from the access control list, the action should be taken
and then that action should be logged.
This includes any deny actions that are taken,
including the deny all at the bottom of the ACL.
Access control list rules are going to be made up
of some key pieces of information,
including the type of traffic, the source of traffic,
the destination of the traffic,
and the action that should be taken against that traffic.
For example, this access control list
has a first entry line here,
stating that it's going to allow TCP traffic
from 192.168.0.0 to any destination IP over port 22.
Now, routers can provide basic security
using these access control lists and filtering rules,
but it is really our network firewalls
that are most commonly going to be used for network security
and bulk blocking and allowing using an access control list.
So, now that we've covered the basics
of what an access control list is,
let's take a look at how we can configure
a basic small office, home office hardware firewall,
and then we'll configure a software firewall inside
of the Windows or Mac OS systems.
First, let's take a look at our hardware-based firewall.
In this example, I'm going to use a typical router
switch access point combination device
manufactured by NETGEAR
and marketed as a wireless router N300 model.
Now, this is probably very similar
to what most of you're using in your small office
or home office environments.
Your interface and settings on your firewall
are going to look a little different than mine,
but it's still going to give you the same general idea
of what kind of options there are
and how you can configure one
of these firewalls at your network boundary.
So, on the screen you can see the basic web-based access
for this wireless router,
wireless access point combination device.
Now, on mine, I'm going to go to security,
which is where the firewall is located,
and it's under block services on this particular router.
Now, usually most of these small office,
home office routers are going to have a very weak type firewall
and they hide it by calling it something else
instead of calling it a firewall.
So, it'll be called block sites, block services,
block ports, something of that nature.
So, in this case, it's block services
and I can do it based on a schedule, so I only want it
to be done at certain times of the day or always.
Let's say I want to block something like Telnet,
I'm going to always block it.
I'm going to add a block,
and the block I want to use is going to be a service
and go down to Telnet.
Now, it automatically knows that Telnet is port 23,
so it's going to block port 23 for me.
It's called Telnet because this is a predefined one,
and then I can block it for all IP addresses in this network
or only certain IP addresses or a certain range.
So, maybe I want to block it for everything for Telnet.
That's fine, we can go ahead and add that to our list.
Now, if we want to add something else,
let's say I have another rule.
In this case, I want to block port 666
because maybe there's a game
I don't want my kids playing on that.
So, I'll block it as port 666.
I'm going to make it TCP/UDP, or both.
I'm going to say both in this case
and I'm just going to call it game,
and then I can block it for an IP range.
Maybe I don't want it to be accessed by my kids,
which all have their devices in the 10.0.0.2
and 10.0.0.10 range.
If I do that, I can go ahead and add,
and again, that adds another rule to the firewall
where we are blocking port 666 over that range of IPs,
and you can see how this works as you can add
or delete different rules.
And then I can go through and I can do another one.
Let's say I want to block the FTP server.
So, I will just go through here
and say user defined port 20 through port 21
because that is the connection port
and the data ports for FTP,
and then we'll give it a name of FTP,
and we can do it for all IP addresses in this range
so nobody can access FTP servers.
That's the idea of how this firewall works.
And you can do it, in this case,
it's blocking the outbound connections
because it's preventing us from sending
things out to the internet.
Now, if we want to block things from coming in
from the internet, we're going to have to do
that in a different firewall on this particular device
because this one only has the outbound defined here,
it's going to have what things
as it's going out to the internet.
Now, if I want to do this on inbound stuff,
I would have to go and find that in this particular router.
That's usually going to be something like port forwarding
or port triggering, or something like a static route.
And so in this case, I can port forward or port trigger
and say, hey, if something's trying to come in
on port 21, FTP, it can go and be routed to my server,
which is at the .50 for instance.
And so now, anything that comes in that's trying to get
to this router on port 21 is going to be forwarded over
to that IP address of .50.
So, that's how you allow things in to your network
based on this particular firewall.
Now, how do you block things at the firewall?
Well, in this particular router, everything is blocked
by default because it's doing an implicit deny.
So, anytime I add a rule like FTP here,
that's doing an explicit allow,
and so, anything you don't allow is going to be blocked
by default on the inbound based on this particular router.
Now, let's take a look at how we can configure
the software firewall included inside the Windows
operating system, known as Windows Defender Firewall
with Advanced Security.
To load this up, simply go down to your Windows key
or your start menu, scroll all the way down
to where you see Windows administrative tools
and then scroll down again,
once you click on that and you will find
the Windows Defender Firewall with Advanced Security.
Once you click on that, it will open.
From here, you can create all of the policies you want,
setting up inbound rules, outbound rules,
monitoring it, et cetera.
Once you have it set just the way you like,
you can actually export that policy, so you'll have it
as a backup anytime you need to go back to it.
Right now, you can see my domain profile
shows Windows Defender Firewall is off.
My private profile shows that it's on,
and my public profile shows that it's on.
What this means is that in my private network
and my public network,
I do have the Windows Firewall turned on.
In the private network, I don't allow
any inbound connections that don't match my rules,
but I will allow outbound connections
that don't match my rules.
In my public network, I have it set the exact same way.
Now, if I want to change that,
I can go into my inbound rules or my outbound rules
and decide how I want that to be done.
Let's take a look at some of these rules.
For example, we have this one here, which is SSH,
which is Secure Shell.
All of my profiles allow it.
It's enabled for all of them.
It will do an allow action,
and it's going to allow any program
to be run from any address locally
to any address remotely over port 22.
That may be what you want to do,
or it may be something you want to block.
Let's go ahead and look at some other ones.
Down here we have app installer.
For app installer, it's allowing it to go any local address
to any remote address, any protocol, and any port.
This type of an any, any rule allows it to have a lot
of ability, and so this is going to allow
a lot of things through that we might not want.
Now, let's say you have a program
that you want to add to this.
Maybe you have a new web server on this,
and you're going to run it on port 80.
You can hit new.
You can then select a program, a port,
a predefined, or a custom.
In this case, if it's a web server,
we would want to do it based on port 80.
Then we'll click on next.
Do we want it for TCP traffic or UDP traffic?
If it's a web server, again, it's TCP.
It's something else that might use UDP,
you could set that up, and then what ports
is that going to work for?
For all of your local ports or specific ports?
Well, if it's a web server, it again should be port 80
and for secure, port 443.
Then we can go next.
We can allow that connection.
We can allow the connection if it's secure,
meaning that it has to use something
like a VPN tunnel with IPSec,
or we can block the connection
and not allow any web traffic in.
In our case, we want to allow the connection.
Then we click on next, and you can see
which of those three networks it's going to apply to.
I'm going to allow all three of them to have it applied to it,
and then I'll give it a rule.
Jason's web server,
and that's it.
Now, you can see that Jason's web server is now going to allow
traffic from any program from any local address
and any remote address over protocol TCP
and on port 80 and 443.
Now, conversely, if I want to block things from getting in,
we would do the exact same thing, except we would set it up
as a block or a deny.
For example, I don't want to allow anybody to do Telnet
into my network because Telnet is unsecure.
So, I would set up a new rule,
and from there I can block anything on port 23,
which is TCP traffic on port 23, and then I'll hit next.
I'll block that connection,
and I'll block it for all three of those networks,
and I'm going to say blocking Telnet.
And that's it.
You could see how easy it's to set up these rules.
For the Security Plus exam,
you should feel very comfortable
with setting up these type of rules.
If somebody says, I want to block TCP on port 23,
or I want to block Telnet, then you should be able to say,
I want to block it from this area and let it go to that area.
Now, one more area of the Windows firewall
that I want to show you is down here in monitoring.
Down in monitoring, you can see which profile is active,
as I showed you before, but you also have access
to the log file, and if you click on that,
you'll be able to see what's currently there.
What is being logged right now?
Is it logging drop packets and successful connections?
Right now it's not, but we can change that if we wanted to.
Now, we can also view our active rules.
This again, brings us back to what those inbound rules are
and seeing which ones are actually active on this profile.
So, you'll notice anything that's all
or public is being shown here.
Anything that was just private or domain is not
because they're not active for this particular connection.
Next, we're going to configure a firewall on a Mac machine.
To do that, simply go to the Apple in the upper left corner
and go to system preferences.
From here, you're going to click security and privacy,
and then you're going to click on the firewall tab.
You can notice that my firewall is on,
but I can't click any of the firewall options right now.
That's because you have to unlock it by clicking the lock
and adding your username and password for the admin account.
Once you do that, you can turn off your firewall
or you can turn on your firewall,
and you can configure the options.
In here, you can block all incoming connections.
You can see what applications
have been allowed through the firewall.
In my case, Skype and Google Drive are allowed
to have connections into my computer,
and then you can automatically allow built-in software,
meaning Apple software, to receive incoming connections,
things like iTunes and iMessage,
and you can automatically allow downloaded sign software
to receive incoming connections,
meaning this is software that you trust.
And finally, we have stealth mode.
What stealth mode does is it makes your firewall
not respond and not acknowledge any attempts
from somebody to ping your network.
So, if somebody is doing a ping sweep of your network,
my computer is simply not even going to answer,
so you won't know if it's up, down or even there.
So, how do we add an application to this list
to allow incoming connections?
Well, Mac makes it fairly easy.
You click on the plus sign, you find the application,
for example, my chess application, and then hit add.
When you do that, it by default is going to allow
incoming connections.
Now, if I don't want that anymore,
I could simply click on it and subtract it
and it won't answer up.
As you can see, you don't have the level of fidelity
that you have on a Windows machine here in a Mac machine.
To get that level of fidelity, you'd have to use
the command-line firewall tools that are provided,
such as PF or IPFW.
So remember, when it comes to firewall configuration,
you can utilize either a hardware-based firewall
that will protect all the workstations connected
to a firewall subnet, or you can use an individual
software-based firewall on the workstation itself
within Windows, Mac OS, or in Linux.
Either way, the protections that your firewall
will provide is all going to be based
on the access control list and the rules
that you configure when setting up your firewalls.