Firewall Configuration: What is it?

Configuring firewalls can be challenging, especially for a less experienced administrator. Understanding the fundamentals of firewall technologies and following a methodical approach, will help in completing setup in a short timeframe. In this blog post, we will take a look at various aspects of firewall configuration from the basic setup to the more advanced settings. After reading this guide, you will have a better understanding of firewall setup, allowing you to protect and strengthen your organization’s network security and protect it from unauthorized access.

What is Firewall Configuration?

Firewall configuration refers to the process of setting up and managing a firewall to control incoming and outgoing network traffic based on predetermined security rules. This involves defining policies that determine which types of traffic are permitted or blocked, ensuring that unauthorized access is prevented while allowing legitimate communications. Proper firewall configuration plays a vital role in malware detection and mitigation, safeguarding IoT data security and privacy, and adhering to best practices for IoT security.

Why is Proper Firewall Configuration important?

Effective firewall configuration is important because it protects network integrity by specifying detailed criteria based on IP addresses, domain names, protocols, and port numbers. Configuration requires regular updates and adjustments to adapt to evolving security threats and maintain a robust defense.

Proper firewall configuration is fundamental to network security. It establishes the rules and boundaries that determine which traffic can enter and leave the internal network. A correctly configured firewall can efficiently differentiate between safe and potentially harmful traffic. Proper configuration enables the passage of legitimate data while blocking unauthorized attempts to access the system.

How to configure a firewall

Proper configuration is essential to supporting internal networks and stateful packet inspection. Here is how to configure a firewall securely:

1. Secure the firewall

Securing a firewall is the vital first step to ensure that only authorized administrators have access to it. This includes actions such as:

• Update with the latest firmware
• Never put firewalls into production without appropriate configurations in place
• Deleting, disabling, or renaming default accounts and changing default passwords
• Use unique, secure passwords
• Never use shared user accounts. If a firewall will be managed by multiple administrators, additional admin accounts must have limited privileges based on individual responsibilities
• Disabling the Simple Network Management Protocol (SNMP), which collects and organizes information about devices on IP networks, or configuring it for secure usage
• Restricting outgoing and incoming network traffic for specific applications or the Transmission Control Protocol (TCP)

2. Establish firewall zones and an IP address structure

It is important to identify network assets and resources that must be protected. This includes creating a structure that groups corporate assets into zones based on similar functions and the level of risk.

A good example of this is servers—such as email servers, virtual private network (VPN) servers, and web servers—placed in a dedicated zone that limits inbound internet traffic, often referred to as a demilitarized zone (DMZ). A general rule is that the more zones are created, the more secure the network is.

However, having more zones also demands more time to manage them. With a network zone structure established, it is also important to establish a corresponding IP address structure that assigns zones to firewall interfaces and subinterfaces.

3. Configure access control lists (ACLs)

Access control lists (ACLs) enable organizations to determine which traffic is allowed to flow in and out of each zone. ACLs act as firewall rules, which organizations can apply to each firewall interface and subinterface.

ACLs must be made specific to the exact source and destination port numbers and IP addresses. Each ACL should have a “deny all” rule created at the end of it, which enables organizations to filter out unapproved traffic. Each interface and subinterface also needs an inbound and outbound ACL to ensure that only approved traffic can reach each zone. It is also advisable to disable firewall administration interfaces from public access to protect the configuration and disable unencrypted firewall management protocols.

4. Configure other firewall services and logging

Some firewalls can be configured to support other services, such as a Dynamic Host Configuration Protocol (DHCP) server, intrusion prevention system (IPS), and Network Time Protocol (NTP) server. It is important to also disable the extra services that will not be used.

Further, firewalls must be configured to report to a logging service to comply with and fulfill Payment Card Industry Data Security Standard (PCI DSS) requirements.

5. Test the firewall configuration

With the configurations made, it is critical to test them to ensure the correct traffic is being blocked and that the firewall performs as intended. The configuration can be tested through techniques like penetration testing and vulnerability scanning. Remember to back up the configuration in a secure location in case of any failures during the testing process.

6. Manage firewall continually

Firewall management and monitoring are critical to ensuring that the firewall continues to function as intended. This includes monitoring logs, performing vulnerability scans, and regularly reviewing rules. It is also important to document processes and manage the configuration continually and diligently to ensure ongoing protection of the network.

Conclusion

Understanding the basics of firewall configuration, knowing how to configure your firewall properly, and being aware of common pitfalls are essential for ensuring your network is well-protected. Adopting advanced techniques and adhering to best practices for firewall configuration and network security, while maintaining compliance, are key to achieving optimal security and performance.