1. Introduction to Networking
Firewalls Part 4

2. Custom Services/Schedules
Creating a custom service will allow us to define a new connection with its own type (which is the protocol it will use) as well as the ports used
We can also create a schedule that will allow us to apply different rules at different times/days
For example, we may want to separate business hours and after-hours and treat them separately

3. Default Outbound Policy
Our default inbound rule (connections coming in from the internet) is to always block any connection unless there is a rule allowing it
For our default outbound rule (connections originating from our private network) we can decide whether to allow or block connections without rules
This would typically be based on the user’s needs. If they access one or two specific websites for their work, we can block everything and only allow access to those IP addresses. If the users need to access websites in order to perform research or test things, we could allow everything and only block malicious or inappropriate sites

4. Blocking a Service Here’s an example of blocking a service
We can choose what zone the connection starts from and what zone we are attempting to connect to
We can choose from a list of predefined services, or create our own
We can choose to always block, always allow, or block/allow by schedule
We can choose a specific IP or a range for either the source or destination. Alternatively, we can say that this rule applies to all hosts
We can also choose whether or not to log when this blocking happens. This can tell us if an employee is trying to access something they shouldn’t, or help us investigate an attack on our system

5. Rule Priority
Note that we could have rules that can’t always be satisfied at the same time, they may contradict each other
For example, we may allow access from our network to the IP address , and deny access from our network to port 22. What would happen then, if we tried to access through port 22? We’d have to look at their order on this list. Whatever rule is higher would take priority

6. Blocking Attacks
We have the ability to automatically defend against specific types of attacks
For example, we can disable responses to ping or any ICMP messages
We can set a detection rate for SYN floods If the firewall detects too many SYN handshake requests, we’ll register it as an attack and respond appropriately, depending on the firewall

7. MAC Addresses
We are able to control our network traffic by MAC addresses as well
We can set our firewall so that only certain MAC addresses are permitted, and the rest our blocked, or we can block a few and let the rest through. The former is usually preferred, and definitely more secure
We can also set up an IP address - MAC address binding
We would do this for when we have a MAC address that always uses the same IP address (for example, with a static IP)
This would prevent other devices from joining our network using these addresses illegitimately, trying to get through our firewall

8. Session Settings
Session Settings are another tool we have to prevent attacks on our system
We can limit the maximum number of half open sessions to prevent a SYN flood
We can also set timeouts for other sessions. This controls how long the network will consider a session open without a reply