|
Article · July 003 Source: oai citation reads 789 authorsBog'liq Design and Implementation of Personal Firewalls foFigure 2.
A Sample Filtering Rule
3.1.2
Circuit-Level Firewall
A circuit-level firewall establishes a circuit between the
client and the server without interpreting the application
protocol [24]. The advantage of a circuit-level firewall is
that it supports a wide range of different protocols using
TCP and protects against packet framentation problem.
The disadvantage of a circuit-level firewall is that it re-
lays TCP connections based on their source and destina-
tion addresses but cannot provide control on whether the
information of these connections is legitimate or not.
The SOCKS package [10] is an example of the circuit-
level firewall. SOCKS is a networking proxy protocol that
can be used to create connections through a firewall. We
refer readers to [10] to get more information about SOCKS.
3.1.3
Application-Level Firewall
An application-level firewall is a proxy server that under-
stands the particular application it is providing proxy ser-
vices for, and it intercepts network traffic for a specific
kind of application [24].
Application-level firewalls are
generally implemented to work at application level. The
main difference between the packet-filtering firewall and
the application-level firewall is that the application-level
firewall must understand the application. Application-level
firewalls are more secure than packet-filtering firewalls as
they can be programmed to allow or deny network traffic
based on information contained in the payload session of the
packet, not just the header information [18]. Moreover, the
application-level firewall does not allow direct connections
between an internal host of the protected network and an
external host on the outside network. All communications
between an internal host and an external host are handled
by the proxy. Thus, the application-level firewall hides the
network information of the internal network and reduces po-
tential threats to the internal network. The disadvantage
of application-level firewalls is each proxy service requires
its own proxy. For example, FTP, HTTP and TELNET re-
quires their own proxies, namely FTP proxy, HTTP proxy
and TELNET proxy. As a result, the application-level fire-
wall must understand each proxy service it provides.
The TIS (Trusted Information Systems) Firewall Toolkit
(FWTK)[6] is an instance of the application-level firewall.
FWTK inludes a number of proxy servers of differnet types
such as FTP, Telnet, Rlogin, HTTP, Gopher, SMTP and
NNTP.
|
| |
