Thinking about Firewalls

Generally, he who occupies the field of battle first and awaits his enemy is at ease. Sun Tzu Many companies connect to the Internet, guarded by "firewalls " designed to prevent unauthorized access to their private networks. Despite this general goal, firewalls span a continuum between ease of use and security. This paper describes some of the considerations and tradeoffs in designing firewalls. A vocabulary for firewalls and their components is offered, to provide a common ground for discussion. Why a Firewall? Against those skilled in the attack, an enemy does not know where to defend. Against the experts in defence, the enemy does not know where to attack. Sun Tzu The rationale for installing a firewall is almost always to protect a private network against intrusion. In most cases, the purpose of the firewall is to prevent unauthorized users from accessing computing resources on a private network, and often to prevent unnoticed and unauthorized export of proprietary information. In some cases export of information is not considered important, but for many corporations that are connecting this is a major though possibly unreasoning concern. Many organization