0

Would an encrypted connection be able to bypass a firewall? A firewall is working on layer 1-4 of OSI model, the encryption and decryption is done in presentation layer (layer 7 of the OSI model). Can encryption may bypass a few rules?

6

Using the OSI model of layers is often a good way to spread confusion; it was not initially meant for TCP/IP, and TCP/IP always had trouble fitting in it.

When data is encrypted, it can no longer be understood by whoever does not know the decryption key. However, firewalls don't look at all the data, and encryption does not encrypt everything, because the packets must still be properly routed.

For instance, if the encryption is SSL, then it goes over a TCP connection. The source and destination addresses and ports, and the TCP management details (SYN and ACK flags, and so on), are not covered by the encryption. Firewalls usually work only on ports and addresses and TCP flags, and thus are not impacted by the SSL encryption; firewalls are not even aware that encryption occurs: for them, the TCP stream contents are "just bytes".

There are security-related systems, though, which are impacted by encryption. For instance, all Deep Packet Inspection systems. They are not "firewalls" in a strict sense, but some people refer to them as such on the basis that they may be integrated into some hardware whose primary job is firewalling. DPI has trouble with encryption. To put things bluntly: an antivirus software running on the entry router of your network will not protect you if you download malware over HTTPS.

VPN can obscure the situation, especially if you want to think in "layers".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.