Firewalls and VPNs

What a firewall is

A firewall is software or a device that inspects network traffic and decides whether to allow or block it, based on a list of rules. It sits at the edge of a network, or on a single computer, and every packet that goes through it is compared with those rules.

A rule can say "allow web traffic to this server" or "block everything else coming in from the internet". Traffic that matches an allow rule passes. Traffic that is blocked is dropped.

How a firewall decides

Each rule usually checks four things:

• Source address: where the traffic comes from.
• Destination address: where it is going.
• Port and protocol: what kind of traffic it is, for example TCP port 443.
• Action: allow or deny.

Rules are checked from top to bottom, and the first rule that matches decides. Most good rule sets end with a rule that blocks everything that has not been explicitly allowed. This is called default deny, and it is safer than trying to list every bad thing, because you can never list all of them.

A worked rule set

Here is a small rule list for a web server. It is read from top to bottom, and the first match wins.

1. Allow  tcp  any            to this server  port 443   (HTTPS)
2. Allow  tcp  any            to this server  port 80    (HTTP, redirects to HTTPS)
3. Allow  tcp  203.0.113.7    to this server  port 22    (SSH from the admin only)
4. Deny   all  any            to this server  any        (default deny)

Order matters. If the "deny all" rule were first, no packet would ever reach the allow rules below it. And if rule 3 said "allow SSH from anywhere", every bot on the internet could try to guess your password.

The safest habit is to open only what you need, and only to the people who need it.

Stateless and stateful

• A stateless firewall judges each packet on its own and keeps no memory. You have to write rules for both the request and the reply.
• A stateful firewall keeps track of connections. If you started a connection from inside, it automatically allows the replies back in. That is easier to configure and far more common.

Stateful firewalls store each connection in a table. When a packet arrives, the firewall checks whether it belongs to a connection it already knows, and only applies the full rule list to new connections.

Network firewall and host firewall

• A network firewall is a device or cloud service placed between networks. It protects everything behind it.
• A host firewall runs on one computer, for example Windows Defender Firewall or ufw on Ubuntu.

Using both is better than using one. If something gets past the network firewall, each host firewall can still block it from reaching that machine.

Linux firewall tools

sudo ufw status              # see the current rules
sudo ufw allow 22/tcp        # allow SSH
sudo ufw allow 443/tcp       # allow HTTPS
sudo ufw deny 23/tcp         # block telnet
sudo ufw enable              # turn the firewall on

ufw (Uncomplicated Firewall) is a friendly front end for the lower-level tools iptables and nftables. By default it blocks incoming connections and allows outgoing ones.

More kinds of firewall

• Packet filter: looks only at addresses and ports. Fast and simple.
• Stateful firewall: also tracks connections, as covered earlier.
• Next-generation firewall: can also recognise applications, block known attacks and inspect traffic more deeply.
• Web application firewall (WAF): protects a website by inspecting the actual web requests for attacks.

You do not need to configure these yet. The basic idea is the same in all of them: look at the traffic, compare it with rules, then allow or deny it.

VPNs: encrypted tunnels

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and another network. Your packets are wrapped inside encrypted packets, sent to the VPN server, and unwrapped there before they continue to their destination.

• On public WiFi, it stops other people nearby from reading your traffic.
• For work, it lets you reach the office network from home and use it the way you would in the building.
• Websites see the VPN server's address instead of yours.

A VPN has limits. It moves your trust to the VPN provider, so it does not make you anonymous. It also does not protect you from malware or from entering your password into a fake site.

Two common kinds of VPN

• Remote access VPN: one person connects to a network, for example an employee working from home who reaches the office.
• Site-to-site VPN: two whole networks are joined, for example two branch offices that work as one network across the internet.

Common VPN technologies are WireGuard, OpenVPN and IPsec. They differ in details, but they all do the same job: encrypt packets, send them through the tunnel and decrypt them at the other end.