Firewall with multiple interfaces

Question

I wan going through few firewall setup tutorial and everywhere they set an external interface, facing the internet and internal interface, accepting traffic from the internal subnets.
I can't figure out why we need two interfaces, the end result can be achieved having a single external interface and setting rules on it too. What are the advantages or use cases of having two interfaces ?

Answer 1

The purpose of pretty much any security device is to control what is permitted between two parties, and we need to force the interaction to go through the security device. If the bad process/people/action can go around our device, it doesn't have to be bound by its rules.

For the case of a network security device, we have one wire connected to "us" and one connected to "them". We normally have extra powers over "us" (corporate policies etc), and we know that at least some of "them" are bad people. The purpose is normally to permit all the legitimate usage from the inside people and prevent any bad actions from the outside. We need some interaction -- our people want web pages and e-mail -- otherwise we'd have a disconnected network.

If we mixed them on one interface, there would be nothing to force the bad people to interact with our device.

Perhaps you've seen the passport control at small ports? It's an officer in a hut on the dock. All the boats moor wherever. If you arrive by yacht in the middle of the night you're supposed to go visit in the morning to get your passport stamped. If you arrive by yacht at a little fishing jetty, you're supposed to go find the officer in the hut at the port.

Compare that to the situation at any large airport. When you get off the plane you can only go out one way: through the passport control.

If you were a manufacturer of security devices, which model would you follow?

Answer 2

The term "firewall" can mean one of two things:

(1) Dedicated hardware devices like the Cisco ASA whose whole purpose is to protect hosts on an "inside" network from bad guys on the "outside" network

(2) Software like Windows Defender whose purpose is to run on a general-purpose computer and protect that computer from bad guys.

I think your confusion is because you have type (2) in mind whilst reading documentation for type (1) :-)

Both types of firewall do the same thing: examine network packets and take action to prevent "bad" packets from reaching their intended target - in the case of type (1), the "intended target" is software running on other hosts in the same network, while in the case of type (2), the "intended target" is software running on the same host where the firewall software is running.

Hope this clarifies. And, by the way, discussions on type (2) are off-topic on networkengineering stackexchange - sorry.

Answer 3

You are correct in saying you can control traffic through one interface because for each interface there's an inbound rule and an outbound rule.

Your tutorial link points to a Sophos UTM on AWS. Your question is why not use the inbound and outbound rule on the External Interface and be done with...

Its really to save processing power. When you only allow clients XYZ from outside to your inside FTP or Web server, then clients ABC should be blocked without processing any further -- could be NAT, QoS and not just going down the list of ACLs. Same with your inside clients trying to reach outside. If Clients ABC is allowed https and no one else, then clients XYZ should be dropped from going outside to use HTTPS. If you dropped clients XYZ from the inside interface, the firewall does not have to process the packet and ask itself -- Does it need NAT? QoS? VPN? before it reaches the outside interface.