Firewalls, IPS and VPNs

Why firewalls?

Routers move packets as fast as they can. A firewall is a device (or software) whose main job is to decide which traffic is allowed between parts of the network, based on a security policy. It usually sits at the internet edge, and often between internal zones too, such as between the staff network and the data centre.

Zones

Firewalls think in zones: groups of interfaces with the same trust level. A typical design has an inside zone (staff, trusted), an outside zone (the internet, untrusted) and a DMZ (demilitarised zone) for public servers like the company website. The usual policy: inside may start connections to outside and DMZ; outside may reach only specific services in the DMZ; nothing from outside may start a connection to inside.

Packet filter vs stateful firewall

A packet filter, such as a router ACL, looks at each packet on its own: addresses, protocol and ports. It does not remember anything. To let replies come back to inside users, you would have to permit wide ranges of inbound traffic, which is risky.

A stateful firewall keeps a state table (also called a connection table) of every session that started from the inside: source and destination address, ports and protocol. When a reply arrives from outside, the firewall checks the table. If it matches a known session, it is allowed; if not, it is dropped. So inbound traffic is allowed only when an inside user asked for it.

Next-generation firewalls (NGFW)

A next-generation firewall adds deeper checks on top of stateful filtering: application awareness (recognising WhatsApp, YouTube or a database protocol even on unusual ports), user identity (rules by user or group, not just IP), URL filtering, an integrated IPS, malware and file checks, and often TLS decryption for inspection. Cisco Secure Firewall, Palo Alto Networks and Fortinet FortiGate are common examples.

IDS and IPS

Both detect attacks with signatures (patterns of known attacks, updated like antivirus) and with anomaly detection (traffic very different from normal). A false positive is normal traffic wrongly flagged; tuning the rules reduces them.

VPNs: private traffic over a public network

Leased private lines between offices are expensive. A VPN (Virtual Private Network) builds an encrypted tunnel across the internet instead. Each packet is wrapped inside another packet: outsiders see only the outer header between the two VPN endpoints, and the content is encrypted.

• Site-to-site VPN: a permanent tunnel between two offices' routers or firewalls. Users do nothing special; the devices handle it. Example: bank branches connecting to the head office data centre.
• Remote-access VPN: one user's laptop or phone connects to the office using a VPN client, with TLS/SSL (for example Cisco Secure Client, formerly AnyConnect) or IPsec. Used by staff working from home or travelling.

What IPsec provides

IPsec is a set of standards for protecting IP packets, used for most site-to-site VPNs. It provides four things:

• Confidentiality: the data is encrypted (for example with AES), so it cannot be read.
• Integrity: a hash (for example SHA-256) shows if a packet was changed on the way.
• Authentication: each end proves who it is, with a pre-shared key or certificates.
• Anti-replay: sequence numbers stop an attacker re-sending old captured packets.

IKE (Internet Key Exchange, UDP 500, or UDP 4500 when NAT is in the path) sets up the keys. ESP (Encapsulating Security Payload) then carries the protected traffic and gives all four protections. AH (Authentication Header) gives integrity and authentication but no encryption, so ESP is what you normally use.

GRE: a tunnel without a lock

GRE (Generic Routing Encapsulation) also wraps packets in a tunnel, and it can carry multicast and routing protocol traffic such as OSPF, which plain IPsec tunnels cannot. But GRE has no encryption by itself. So designs often run GRE inside IPsec (GRE over IPsec): GRE for flexibility, IPsec for security.

Where zero trust fits

Older designs trusted anything inside the network. Zero trust means "never trust, always verify": every user and device must prove who it is, and is checked for health, before it gets access to each application, wherever it is. VPNs, firewalls, 802.1X and MFA are still the building blocks; zero trust changes the mindset from "inside is safe" to "check every request".