Connections through Firewalls explained

Question

I'm looking for a good explanation of how connections work through firewalls. I've got the idea of packaging(encapsulating) some protocol inside another one as its payload when tunneling. But what I can't get is actually why the firewall passes msgs from remote server to the client behind firewall. My understanding is as such: let's assume we are using http as a transport

client --> sends msg to remote server --> firewall accepts it and passes --> server gets the message

server answers to client --> firewall remembers that this message is response to msg from client and passes it backwards --> client gets message

now, the server wants to pass another msg --> sends it client --> firewall blocks it, as it is not a response to any of the clients requests

I'm probably missing something. Or should we use another approach for such purpose? When, let's say a server doesn't actually close connection to client's request and keeps connection, and inside this connection we have a transparent interaction between server and client?

any good resource would be much appreciated

thanks

Answer 1

Firewalls are generally classified into three main categories these are

1. Stateless/StateFul Packet Filters
2. Application/Proxy Firewall
3. Web Application Firewall/Reverse Proxy Firewall

Each type of Firewall operates at different layers in a TCP/IP stack and has its own pros and cons. You are actually using an Application/Proxy Firewall which imposes significant overhead if connections are not managed. It will be create a bottleneck if we keeps connection opened as firewall is maintaining state for each connection. For more detailed answers review this figure and have a read on Application Proxy Firewall.

Answer 2

Most firewalls will remember that a request was opened to a particular server and allow that server to communicate back to that connection. If NAT is being used, the port the connection is made on will remain in use for that connection. This is actually not unique to tunnels, but also applies to any kind of data stream. For example, when you stream a video from Netflix or Youtube, the firewall knows to allow data from their server to you despite the fact that you don't send a packet out for every packet coming back.

Answer 3

When using a tunnel, you indeed encapsulate one protocol in another. The most common way of tunneling is setting up a SOCKS5 tunnel. SOCKS happens at the 5th layer, the session layer. When you open a SOCKS tunnel, the tunnel remains established, even when you are not sending anything over it.

Answer 4

Well I cannot say i have understood the question completely, even then i can share a few things that i know.I am talking about network firewalls which primarily looks at layer3 (Internet layer) and layer 4(transport layer) of the OSI stack.

All stateful firewalls maintain a table called session table.

So stateful firewalls are called stateful firewalls because of the presence of a session table.A basic session table will have 4 entries Source-ip of the packet,destination IP of the packet,Source port and destination port.The kind of firewall that i have worked on had 2 more entries, incoming and outgoing interface of the packet.

Ok,now we ll see how a connection is formed.

We ll take the case of a tcp connection on port 80 (http).To be more specific, a client sitting behind a firewall is trying to connect to google.com.The first packet coming out of the client will be a tcp SYN.This reaches the firewall.The firewall, being a network firewall would look at the destination IP and then will do a route lookup for google's IP.We are looking at the firewalling part so we assume that there is a routing table entry.From the routing table, the firewall gets the outgoing interface.

Now a typical network firewall will have several network interfaces and each interface would be mapped to a "zone".Firewalling involves the governance of traffic between the interfaces by using a set of rules.

So after getting the outgoing interface from the routing table,the firewall looks at the zone of the outgoing interface.Then the firewall looks for a policy (rule) from the incoming interface's zone to the outgoing interface's zone.If there is a policy which permits traffic between the 2 zones, the firewall sends the packet out of the outgoing interface and,then creates an entry in the session table.Note that this is the first packet of a connection.Now when the reply packet comes from the server back to the client, it doesnt have to go through the rule look up process because an entry is already present in the session table.Now, the source port of the reply packet would be 80 and the destination port would be the source port that was used by the client for the tcp syn.By matching the ports and IPs, the firewall decides if the incoming packet is a reply or not and then sends it out of the correct interface.

Suppose the server sends a packet which is not a reply to the client, the session lookup would fail and the firewall would look for a rule permitting traffic from the server's side to the client's side.If that rule is not present, the packet will be dropped.

Note that the this rule check is not done for a reply packet coming from the server because a session was already created by the initial request packet from the clients side..Hopefully this answers your question.. Please do feel free to ask if this answer is not clear