0

I know this is a super newbie question.

I recently learn about firewall and you would know there is security levels.

The higher levels can send the traffic but cannot get it from the lower one.

I am confused that it means couldn't get anything from the endpoint connecting to the network devices.

When you do filtering with ACL on network device then it means you won't get any pings from the filtered addresses. So it means literally you wouldn't get anything from that side like you wouldn't open the server page or wouldn't get any items from ftp servers.

Do I understand correctly?

1
  • 1
    Has any answer solved your question? Then please accept it or your question will keep popping up here forever. Please also consider voting for useful answers.
    – Zac67
    Feb 5, 2023 at 9:07

1 Answer 1

0

Security levels and zones for use on a firewall are concepts that you create to structure your security requirements. Those concepts are then implemented by firewall rules.

Blocking traffic means can't access that server? ... When you do filtering with ACL on network device then it means you won't get any pings from the filtered addresses.

When you filter (block) some kind of traffic then that traffic doesn't reach its destination. For instance, you may widely permit http traffic to a web server but filter management traffic from all but one security zone, the one your administrator workstations are located in.

When talking about security zones, the general idea is that a higher zone can access a service in a lower zone. If you block all traffic from a lower to a higher zone, then that access isn't possible - network is always bidirectional. So, access is all about who may initiate a connection.

In a stateful firewall, that connection initiation is all you define, the reverse direction is implicitly included. If you use stateless ACLs between security zones, you need to explicitly permit the required lower-to-higher replies, e.g. traffic from TCP ports 80 and 443 to ports >=49152 for replies from HTTP/HTTPS servers.

When you do filtering with ACL on network device then it means you won't get any pings from the filtered addresses. So it means literally you wouldn't get anything from that side like you wouldn't open the server page or wouldn't get any items from ftp servers.

Not quite. ACLs can be used on IP addresses (L3) but they may also be used on specific IP protocols or on the transport layer (L4), ie. port numbers. That way, you could e.g. permit ICMP echo (ping) for troubleshooting and filter other, potentially harmful ICMP traffic. For a public web server, you'd permit HTTP/HTTPS but filter FTP when it's only used administratively. Or permit FTP for an FTP server but filter HTTPS for the admin web interface.

The point is that you use firewall rules or ACLs to restrict the traffic to what exactly is required, nothing else. Security zones allow you easier categorization of sources and destinations, e.g. distinguish users from the open Internet, users from your LAN, admins from your LAN, public servers, and servers limited to LAN usage.

1
  • And a different policy for what the web server(s) can do. In general, higher security layers can talk to lower security layers, but not the reverse. For example, your lan can access the internet without (much) filtering, but the internet cannot access the lan.
    – Ricky
    Jan 6, 2023 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.