What is a firewall and its DMZ?

Question

My question is in regards to network security.

I understand that there should be a demilitarization zone at the border for your network. It is there where the perimeter firewall should live and other DMZ servers. After which there is another DMZ firewall and then your trusted network.

I guess I am having trouble understanding the core concept of the firewall. Is it an actual piece of hardware? (I have seen both hardware and software online). How do firewalls work in tandem with Active Directory? And what servers live in the DMZ zone? Is there an application where you control firewall controls over the other servers? or is the firewall regulated manually in each server?

I know its a lot of questions, but the concept is still a bit muddy for me. Any and all help would be grateful. Also if there are any articles or websites where this is explained in detail would great. I've done my fair search but since I am not quite sure what to look for I feel like I am going in circles.

Answer 1

Is it an actual piece of hardware? (I have seen both hardware and software online).

as you stated, it can be both. Windows has a built in firewall ... but there are also hardware devices that are dedicated to the task (usually for larger networks)

How do firewalls work in tandem with Active Directory?

Um, it doesn't? Unless I am missing something in your question they are unrelated. Both can be use for security, but firewall is to protect against network traffic at lower levels through rules and filtering and AD is more for protection against unauthorized access to a specific computer at the application level through use of credentials and permissions.

what servers live in the DMZ zone?

Servers that host external information and services ... like a web server or email server.

Is there an application where you control firewall controls over the other servers? or is the firewall regulated manually in each server?

Firewalls can be administered remotely via a GUI or via SSH ... it is also possible for a firewall rule to be automatically created via tools like fail2ban

Answer 2

In the drawing below you have three networks which are connected though a firewall. The role of the firewall is to limit the traffic between these networks.

Limiting the traffic means that you can decide that only traffic going to a certain port (say, 22) is allowed, how often you can connect to a given host from another one etc.

There is nothing special neither in the networks nor in the ports.

Some networks have special names, like Internet for instance. For a firewall this is a network like others. Some other networks may be called LAN, DMZ or Mike.

Historically, networks having special usages were names with their own names. DMZ is an example of such a network. The idea is that this is a network which is exposed to a "public" one (usually called Internet) and to a "private" one. Going further, it was designed as a sink: you can only get in there, and once you are in you do not leave to other networks. This way, if something in this network is compromised, the compromission is limited to it only.

There are other networks which got their own names: LAN (traditionally your private network, not exposed), WAN (traditionally a network to join your other networks, not exposed to the public one(s)), etc.

The main reason for a firewall is to ensure compartimentalization, on a device which is not part of the compartimentalized network. Only then comes the naming which is just a rough agreement to simplify the communication between network/system engineers.

To your questions now.

Conceptually a firewall is software. You can get it as a network appliance which comes with some management software, or use software firewalls (iptableson Linux for instance) -- you will obviously needs some hardware too.

The firewall understands network packets - whether they come from Active Directory, a web server or a music stream does not matter.

You can also have a firewall built into the OS of the machine you are using - this is for instance the case for Linux and Windows. In such cases you usually firewall traffic for your machine only (you do not want anyone to connect to you for instance, even if you have exposed some service)

Please note that a lot of this traditional naming is now obsolete and is really used as a high-level simplification.

Note: This is a simplified view, mostly true (= it is not complete)