Firewalls are essential tools for protecting your network from malicious traffic and unauthorized access. They act as filters that allow or block traffic based on predefined rules. In this article, you will learn about the most common firewall rules and how you can use them to secure your network.
The default deny rule is the most basic and secure firewall rule. It blocks all incoming and outgoing traffic unless it is explicitly allowed by another rule. This way, you can minimize the exposure of your network to potential threats and only permit the traffic that you need. To use the default deny rule, you need to define the specific ports, protocols, and sources or destinations that you want to allow, and then apply the rule as the last one in your firewall configuration.
Most common firewall rules and how can you use them to secure your network: - Deny all traffic by default: This means that all traffic is blocked unless it is explicitly allowed. - Only allow traffic that is necessary for your business operations. - Limit traffic to specific ports to reduce the risk of unauthorized access. -Use a VPN to encrypt traffic between your network and the internet. -Regularly review and update firewall rules to ensure that they are up-to-date and effective.
Default-deny means that network traffic, which is not specifically allowed, will be denied. At the firewall level, it involves defining permissible ports and protocols and turning everything else off. This change impacts the internet (border, edge, or perimeter) firewall, which stands between the University of Regina's internal network and the public internet. Firewalls protecting the campus network control incoming network traffic. Firewalls use security rules to determine which traffic is allowed.
Implement the default deny rule as the baseline of your firewall policy. Then, carefully define and allow only the necessary traffic based on business requirements. This rule essentially blocks all traffic by default and only allows traffic that is explicitly permitted. It's a fundamental principle in network security often phrased as "deny all, permit some."
Firewall rules are implemented to ensure your network is protected and others are protected from your network (which means your network should not be a source of an exploit). During the days of On-Prem SMTP servers, SMTP rule was a key; The rule MUST have a defined SMTP source server IP/name and deny any other SMTP relays. Default deny rule, Stateful inspection rule, Geo-blocking, RDP deny rule, are some key rules to have. Myntra for an effective rule, is to have "as specific as possible" (Source, Destination, Ports, users, timing, geolocation, duration/expiration etc).
Pour des structures débutantes ou de petite taille, le plus adapté est de mettre en place une règle par défaut qui bloque tous les flux entrants, et autorise les flux sortants.
The stateful inspection rule is a more advanced and dynamic firewall rule. It tracks the state of each connection and allows or blocks traffic based on the context and history of the connection. For example, if you initiate an outbound connection to a web server, the stateful inspection rule will allow the inbound response from the web server, but block any unsolicited inbound traffic from other sources. This way, you can improve the performance and security of your firewall by reducing the number of rules and preventing spoofing and hijacking attacks.
Use stateful inspection rules to ensure that only legitimate and expected traffic is allowed through the firewall. It can protect against certain types of attacks, like TCP/IP hijacking.
Stateful inspection monitors communications packets over a period of time and examines both incoming and outgoing packets. The firewall tracks outgoing packets that request specific types of incoming packets and allows incoming packets to pass through only if they constitute a proper response.
L'inspection dynamique permet de vérifier que les requêtes exécutées sont légitimes et ne contiennent pas d'éléments malveillants. Ce dispositif est fort pratique sur des services web et peut par exemple neutraliser des tentatives d'attaques de type injections SQL ou XSS.
The application layer rule is a more granular and specific firewall rule. It inspects the content and behavior of the traffic at the application layer, which is the highest level of the network model. For example, you can use the application layer rule to block traffic based on the URL, domain name, file type, or user agent of the request or response. This way, you can prevent malware, phishing, and data leakage by filtering out unwanted or malicious traffic at the application layer.
The application layer sits at Layer 7, the top of the Open Systems Interconnection (OSI) communications model. It ensures an application can effectively communicate with other applications on different computer systems and networks.
In addition to its role in preventing external threats, the application layer rule also plays an important role in optimizing network performance. By selectively allowing or blocking specific application-level attributes, organizations can prioritize critical applications, allocate bandwidth efficiently, and enhance overall network responsiveness. This dual functionality of the application layer rule not only safeguards against security risks but also contributes to the streamlined and efficient operation of the network infrastructure.
Implement application layer rules to control access to applications like HTTP, FTP, DNS, and SMTP. This is particularly useful for blocking harmful applications or ensuring compliance with organizational policies.
The time-based rule is a more flexible and convenient firewall rule. It allows or blocks traffic based on the date and time of the traffic. For example, you can use the time-based rule to restrict access to certain resources or services during specific hours or days. This way, you can enforce policies and schedules for your network by controlling when the traffic is allowed or blocked.
Use these rules to restrict access to network services during off-hours or to implement temporary access for a certain period. For example, allowing a contractor to access the network only during working hours for a set duration.
The geo-blocking rule is a more selective and targeted firewall rule. It allows or blocks traffic based on the geographic location of the source or destination of the traffic. For example, you can use the geo-blocking rule to block traffic from countries or regions that are known to be sources of cyberattacks or spam, or to comply with legal or regulatory requirements. This way, you can reduce the risk and liability of your network by filtering out traffic from unwanted or prohibited locations.
Unlike my peers, I'm afraid I have to disagree with geo-blocking rules but advocate for GEO tagging. Depending on the system you operate, such as in the case of a Public web application, GEO-blocking could be detrimental to your company's SEO efforts and Serch ranking. Today, with widespread availability and low-cost VPN solutions in combination with the rapid movement of IP addresses, Geo blocking is not an effective control. However Tagging packets\flow with current geo data as part of your logging enrichment program can be beneficial, especially if your GEO provider updates your SIM Daly and provides additional enrichment such as knowing TOR or VPN networks\IPs Single Dimension rules on friend vs foe are a thing of the past.
Attention aux règles de géoblocage qui reposent sur une géolocalisation par IP : il arrive que les IPs soient mal localisées, ce qui entra?ne des faux positifs. Une IP fran?aise peut par exemple être placée par erreur dans des pays d'Europe de l'Est, et entra?ner un blocage erroné d'utilisateurs légitimes.
+ 2??1??0??0??0??[CYBER-SECURITY-Architect / Researcher] ??????- Speaker ????????
?This is option is today mandatory for all compagny. ??Because of the international wars on the cyber space . ? But also a simple good practice of security, because : 1) 90% of DDOS attacks for exemple , do come from outside your country 2) if your customers are outside your country, you don’t need to open your ip to hackers of other countries 2) you VPN will be more secure if you identity who can get connected to you network compagny ?The geo-iP rule / block is just one of the best security method to reduce attacks .
Implement geo-blocking to restrict access from countries known for originating cyber attacks or where your business has no legitimate users. This can significantly reduce exposure to attacks.
The custom rule is a more tailored and specific firewall rule. It allows or blocks traffic based on any criteria that you define yourself. For example, you can use the custom rule to block traffic from certain IP addresses or ranges, or to allow traffic from certain devices or users. This way, you can create your own firewall rules that suit your network's needs and preferences.
Develop custom rules to address unique aspects of your network, such as securing a particular server, restricting access to sensitive resources, or implementing rules for specific types of devices.
Conhe?a as regras e características do negócio, tenha cuidado ao criar e utilizar as NATs e sempre defina (Origem e Destino). Tenha as redes segregadas.
An important consideration for firewall rules is to implement bot detection that differentiates between good and bad bots. Good bots, such as search engine crawlers, play a beneficial role in internet functionalities, whereas bad bots can be involved in malicious activities like DDoS attacks or data breaches. By incorporating sophisticated bot detection mechanisms in firewall rules, the system can accurately identify and selectively block harmful bot traffic while allowing legitimate bots to function. This selective approach ensures that essential services provided by good bots are maintained, while security against malicious automated traffic is strengthened.
Mais importante que ter um FW, é mantê-lo atualizado, revisado e identificado. é muito comum regras Any - Any e sem nomenclatura correta, talvez para algum teste e n?o existe nada mais duradouro do que uma altera??o "temporária".