1

I wan going through few firewall setup tutorial and everywhere they set an external interface, facing the internet and internal interface, accepting traffic from the internal subnets.
I can't figure out why we need two interfaces, the end result can be achieved having a single external interface and setting rules on it too. What are the advantages or use cases of having two interfaces ?

1
  • 2
    A firewall controls the traffic between two nodes. How is this supposed to work with a single interface? – Zac67 Jan 11 '18 at 7:19
3

The purpose of pretty much any security device is to control what is permitted between two parties, and we need to force the interaction to go through the security device. If the bad process/people/action can go around our device, it doesn't have to be bound by its rules.

For the case of a network security device, we have one wire connected to "us" and one connected to "them". We normally have extra powers over "us" (corporate policies etc), and we know that at least some of "them" are bad people. The purpose is normally to permit all the legitimate usage from the inside people and prevent any bad actions from the outside. We need some interaction -- our people want web pages and e-mail -- otherwise we'd have a disconnected network.

If we mixed them on one interface, there would be nothing to force the bad people to interact with our device.

Perhaps you've seen the passport control at small ports? It's an officer in a hut on the dock. All the boats moor wherever. If you arrive by yacht in the middle of the night you're supposed to go visit in the morning to get your passport stamped. If you arrive by yacht at a little fishing jetty, you're supposed to go find the officer in the hut at the port.

Compare that to the situation at any large airport. When you get off the plane you can only go out one way: through the passport control.

If you were a manufacturer of security devices, which model would you follow?

4
  • I got your point but I am confused that why can't we set up iptable rules on our external interface only, like drop any packet which is coming from ip p.q.r.s. So the packet gets dropped at external interface only. I tried to implement some firewall rules on external interface only and it is working as expected. So to block any particular ip, I can go with one interface only. If you can give some examples of rules which can not be done with single interface only then it will easy for me to understand. – krrish Jan 11 '18 at 11:43
  • Do you mean why do rules specify two interfaces? Or why do firewalls have at least two interfaces? – jonathanjo Jan 11 '18 at 11:49
  • 1
    @krrish if the traffic doesn't go through your interface, the rules you set on it are totally irrelevant. – JFL Jan 11 '18 at 12:00
  • I was confused because AWS assigns uses single interface for both outside and inside traffic by NATIng external traffic to interface. So my instance was working fine with single interface too. – krrish Jan 22 '18 at 8:21
2

The term "firewall" can mean one of two things:

(1) Dedicated hardware devices like the Cisco ASA whose whole purpose is to protect hosts on an "inside" network from bad guys on the "outside" network

(2) Software like Windows Defender whose purpose is to run on a general-purpose computer and protect that computer from bad guys.

I think your confusion is because you have type (2) in mind whilst reading documentation for type (1) :-)

Both types of firewall do the same thing: examine network packets and take action to prevent "bad" packets from reaching their intended target - in the case of type (1), the "intended target" is software running on other hosts in the same network, while in the case of type (2), the "intended target" is software running on the same host where the firewall software is running.

Hope this clarifies. And, by the way, discussions on type (2) are off-topic on networkengineering stackexchange - sorry.

4
  • (3) Software that runs on a general purpose computer and can be used to protect either that computer, other computers behind it or both. For example Linux's iptables or BSD's PF – Peter Green Jan 12 '18 at 1:32
  • Yes, (3) as well, which is conceptually a combination of (1) and (2). Even a Cisco ASA has to protect itself as well as the hosts behind it. – mere3ortal Jan 12 '18 at 1:36
  • (2) Windows Defender is the anti-virus, the firewall embedded in Microsoft Windows is pompously called "Windows Firewall with Advanced Security". – JFL Jan 12 '18 at 8:33
  • I am talking about type (3) as mentioned by @PeterGreen. I want to know what are the advantages of using type (1) as compared to type (3) – krrish Jan 17 '18 at 10:46
-1

You are correct in saying you can control traffic through one interface because for each interface there's an inbound rule and an outbound rule.

Your tutorial link points to a Sophos UTM on AWS. Your question is why not use the inbound and outbound rule on the External Interface and be done with...

Its really to save processing power. When you only allow clients XYZ from outside to your inside FTP or Web server, then clients ABC should be blocked without processing any further -- could be NAT, QoS and not just going down the list of ACLs. Same with your inside clients trying to reach outside. If Clients ABC is allowed https and no one else, then clients XYZ should be dropped from going outside to use HTTPS. If you dropped clients XYZ from the inside interface, the firewall does not have to process the packet and ask itself -- Does it need NAT? QoS? VPN? before it reaches the outside interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.