A2.4.1 — Firewalls, NAT and MAC Filtering
Firewalls
A network security device or software that monitors and filters incoming and outgoing traffic at the packet level. Inspects packet headers to filter by IP address and port. Next-generation firewalls (layer 7) can also inspect packet content, not just headers.
- Whitelist: A list of approved IP addresses, domains, or applications that are allowed to communicate with the network. Anything on the whitelist is automatically permitted.
- Blacklist: A list of blocked IP addresses, domains, or applications. Traffic matching a blacklist entry is denied.
- Firewall rules specify which traffic is allowed or blocked based on source and destination IP, port numbers, and protocol (TCP/UDP). Rules are processed in sequence until a match is found.
Strengths and Limitations
| Point | Detail | |
|---|---|---|
| Strengths | Access control | Filters traffic by IP, domain, port, and protocol. Only authorised traffic enters or exits. |
| Traffic monitoring and logging | Logs all traffic. Raises real-time alerts on suspicious activity. | |
| Versatility | Modern firewalls include VPN support, intrusion prevention (IPS), and deep packet inspection (DPI). Scalable. | |
| Application-level security | Next-generation firewalls inspect packet content for application-layer attacks. | |
| Limitations | Internal threats | Firewalls primarily control ingress and egress. A malicious insider is not stopped. |
| Sophisticated attacks | APTs and malware can bypass firewalls via encrypted traffic, zero-day exploits, or by disguising as legitimate traffic. | |
| Configuration complexity | Misconfiguration can introduce vulnerabilities or block legitimate traffic. | |
| Performance impact | Deep packet inspection introduces latency, which can affect critical applications. |
NAT and Network Security
NAT modifies network address information in IP packet headers as they pass through a router. Beyond conserving IP addresses, it provides security benefits.
- IP masquerading: Multiple internal devices share one public IP. Individual private IP addresses are hidden from the outside world, making it harder for attackers to directly target internal devices.
- Rudimentary access control: NAT controls which internal addresses are translated and allowed to communicate externally. Restricts which internal devices can reach the internet.
MAC Filtering
Every NIC has a unique MAC address. MAC filtering allows a network administrator to specify which MAC addresses are permitted to connect to a Wi-Fi network.
- Whitelist: Only devices with approved MAC addresses can connect. Any unknown device is automatically blocked. More secure approach.
- Blacklist: Specific MAC addresses are denied. All others are allowed. Less secure since it requires knowing every bad device in advance.
- Limitation: MAC addresses can be spoofed. Newer devices may use randomised MAC addresses, requiring constant updates to the filter list.
- MAC filtering is most effective when combined with strong WPA2 or WPA3 encryption.
Ninja Notes:
- Firewalls do NOT protect against internal threats. Always mention this as a key limitation in exam questions.
- Whitelist = allow known good. Blacklist = block known bad. Whitelist is more secure but harder to maintain.
- NAT hides internal IPs from the internet as a side effect of IP address translation. It is not a firewall but does add a layer of obscurity.
- MAC addresses can be faked. MAC filtering alone is not strong security.