Key points
- Firewall configuration is the process of defining security rules that control incoming and outgoing network traffic.
- There are three common firewall inspection methods: packet filtering, proxy services, and stateful inspection.
- Firewall configuration best practices include applying the principle of least privilege, using a default-deny policy, and enabling logging for critical rules.
- A well-configured firewall acts as a first line of defense and is essential to a robust network security strategy.
With organizations adopting cloud services from multiple providers and the digital world’s emphasis on collaboration and connectedness, information is being transmitted across networks at an unprecedented pace. Ensuring the security of data has become a prime concern.
Firewalls play a pivotal role in network security by monitoring and controlling network traffic based on defined security rules. A firewall is the first line of defense against malicious activities, making it an indispensable component of any comprehensive network security strategy.
While having a firewall is crucial, its effectiveness is directly related to proper configuration and ongoing management. Without a well-tailored set of rules and vigilant oversight, it is all too easy for a firewall to allow malicious traffic or impede legitimate communication. This guide provides guidance on firewall configuration, outlining the process and best practices to fortify your network security.
Secure your system today! Watch what is a firewall configuration? How to set up your firewall.
What is firewall configuration?
Firewall configuration refers to the rules and settings that dictate how a firewall should handle incoming and outgoing network traffic based on criteria such as IP addresses, ports, applications, users, and other security policies. These configuration settings determine which connections are permitted and which are blocked, forming the backbone of a secure network.
There are three common firewall inspection methods
- Packet filtering: Examines packets of data and allows or blocks them based on predetermined criteria.
- Proxy service: Acts as an intermediary between users and the internet, forwarding requests on behalf of the user and filtering responses.
- Stateful inspection: Keeps track of the state of active connections and makes decisions based on the context of the traffic.
Many modern Next-Generation Firewalls (NGFWs) combine these inspection methods with additional features such as application awareness, intrusion prevention, and threat intelligence.
These rules are configured with source and destination IP addresses, ports and protocols, and labels or notes helpful to the administrator. Logging can also be enabled to capture information about network traffic and events for analysis and auditing. Additional firewall platform capabilities may include monitoring and Virtual Private Network (VPN) support for secure network connectivity.
Software vs. hardware firewalls and their configuration
Hardware firewall appliances and software firewalls perform similar functions but use different deployment models.Modern environments may also use virtual firewalls, cloud-native firewalls, or Firewall-as-a-Service (FWaaS) solutions to protect networks and workloads across on-premises and cloud environments. They are suited for different network deployments, as follows:
Software firewalls
- Typically installed on individual devices
- Configured through user-friendly interfaces
- Suitable for protecting individual endpoints and servers
Hardware firewalls
- Protect entire networks.
- Configured through a web-based interface or command line.
- Suited for protecting multiple devices across different network structures.
How to select the right firewall
The steps to take when selecting and configuring a firewall are:
- Identify network requirements: Determine the needs and characteristics of your network to tailor firewall rules accordingly.
- Choose between software and hardware firewalls: Software firewalls are installed on individual devices, while hardware firewalls are standalone devices protecting an entire network. Virtual and cloud-native firewalls provide similar protection for virtual machines, cloud workloads, and hybrid environments.
- Define rule sets: Establish rules for both inbound and outbound traffic based on security policies.
Importance of rule order and how to optimize for security and performance
A firewall processes its rulebase from top to bottom, so it is important to order rules logically to achieve the desired outcome. It is common to end a firewall rulebase with a deny-all rule, preventing any traffic not meeting any other rule from passing. Adding this rule at the start of a rulebase would block all traffic.
Place more critical rules higher in the rulebase order to ensure they are evaluated first, and make sure to regularly review and adapt rules to meet evolving security needs, as well as remove obsolete rules to streamline performance.
Firewall configuration examples
Firewall configurations differ based on the specific needs and requirements of an organization. The security posture of an organization can often change based on the current threat level. Additionally, the command-line interface, firewall software, and any firewall management software vary from vendor to vendor. To illustrate the practical implementation of firewall configurations, we will look at two common examples using a software firewall:
Securing web servers
- Open the firewall management console: Navigate to it on your system. On Windows, you can access this through the Control Panel or Windows Security settings.
- Create a new rule for HTTP traffic: Choose the option to create a new inbound rule. Select “Port” as the rule type, and specify the port used by the HTTP service, typically 80. Choose “Allow the connection” and apply any necessary restrictions.
- Create a new rule for HTTPS traffic: Repeat the process to create a new inbound rule. This time, specify the port used by the HTTPS service, typically 443. Choose “Allow the connection” and apply any necessary restrictions.
- Remove unnecessary firewall rules: Review the existing inbound and outbound rules. Identify rules for services that are not required (e.g., FTP, Telnet) and disable or remove them. Ensure that only rules required for authorized services remain active.
- Test web server access: Verify that users can access the web server by browsing to the HTTP and HTTPS URLs. Ensure that unauthorized traffic is blocked as intended.
Remote access policies
- Identify remote access ports: For VPN connections, common ports include 443 (SSL VPN), 500/4500 (IPsec), and 51820 UDP (WireGuard, by default). Avoid outdated protocols like PPTP (port 1723) due to security vulnerabilities.
- Create an inbound rule for VPN traffic: Open the firewall management console. Create a new inbound rule and select “Port” as the rule type. Specify the port number identified in Step 1. Choose “Allow the connection” and proceed.
- Configure outbound rules for VPN traffic: Repeat the process to create outbound rules for the same port. Ensure bidirectional traffic for the chosen port is allowed.
NOTE: Some modern firewall platforms handle outbound VPN traffic automatically once the VPN tunnel is established. Always refer to vendor documentation for exact behavior.
- Specify IP address or range for remote access: Modify the rules to specify the source IP address or range from which remote access is permitted. This enhances security by restricting access to approved network sources.
- Test remote access: Verify that remote access is functional by establishing a VPN connection from an authorized device. Ensure that attempts from unauthorized devices are blocked.
These step-by-step instructions provide a basic overview for implementing firewall configurations in the specified scenarios. Specific steps may vary depending on the firewall software or hardware you use. Always refer to the documentation provided by your firewall solution for detailed instructions tailored to your system.
Firewall rules configuration best practices
Keep the following best practices in mind for a robust and effective firewall configuration:
Control incoming traffic proactively
- Enhance specificity: Specify the source IP addresses or ranges from which incoming traffic is expected. Where IPv6 is deployed, apply equivalent firewall rules to IPv6 traffic as well. This adds an extra layer of security by narrowing down the allowed sources.
- Application awareness: If your firewall supports it, consider application-aware rules instead of port-based rules. This allows you to control access based on the application layer, adding granularity to your security posture.
- Dynamic rules: Utilize dynamic rule generation based on threat intelligence feeds. Implementing dynamic rules helps the firewall adapt to emerging threats in real-time.
NOTE: Dynamic threat intelligence features are typically available in advanced firewalls or through NGFW/SIEM integrations.
Specify allowed ports and protocols
- Default deny policy: Adopt a default deny policy for inbound traffic. Only explicitly allow traffic that is necessary for your organization’s operations.
- Least privilege principle: Follow the principle of least privilege when specifying allowed ports. Only open the ports that are required for specific services or applications.
Logging and monitoring
- Enable logging for critical rules: For rules that allow important traffic, enable logging. This facilitates detailed monitoring and analysis of allowed traffic, aiding in incident response and forensic investigations. Organizations may also forward firewall logs to a Security Information and Event Management (SIEM) platform for centralized monitoring and analysis.
- Regularly review logs: Establish a routine for reviewing firewall logs. Regularly analyze inbound traffic patterns to identify anomalies or potential security incidents.
Govern outgoing traffic effectively
- Outbound application control: Implement outbound application control to restrict access to certain applications. This prevents potential data exfiltration through unauthorized applications.
- Destination IP filtering: Specify destination IP addresses or ranges for outbound traffic. This adds an extra layer of control, preventing data from being sent to unauthorized destinations.
Prevent unauthorized data exfiltration
- Deep packet inspection: If your firewall supports it, enable deep packet inspection for outbound traffic to analyze traffic beyond basic header information and identify potentially unauthorized activity.
- Data Loss Prevention (DLP): Integrate DLP solutions with outbound rules to prevent sensitive data from leaving the network. DLP policies can be configured to identify and block confidential information from being transmitted.
Logging and alerting
- Log egress traffic: Enable logging for outbound rules, especially those governing sensitive or critical traffic. This facilitates visibility into data leaving the network and aids in identifying potential security incidents.
- Alert for unusual activity: Implement alerting mechanisms for unusual outbound activity. Set up alerts for patterns that might indicate a security incident, such as large data transfers or connections to known malicious IP addresses.
Additional considerations
- Scheduled audits: Conduct regular audits of firewall rules to ensure alignment with organizational policies and security requirements.
- Documentation: Keep detailed documentation of firewall rules, including the purpose of each rule and the associated security justification.
- Cross-functional collaboration: Foster collaboration between IT and security teams in the rule-setting process. IT teams have valuable insights into operational needs, and security teams contribute risk assessment perspectives.
- Test rules in a controlled environment: Before deploying new rules in a production environment, test them in a controlled environment. This helps identify any unintended consequences and ensures that critical services are not disrupted.
The importance of regular updates and maintenance
Regardless of the firewall technology you choose, the boundary of your network must be protected by an up-to-date solution. Updating firmware and software per vendor recommendations ensures that the firewall is equipped with the latest security patches and addresses vulnerabilities to prevent exploitation.
It is important to regularly review and update the firewall configuration to ensure your network remains protected against emerging threats, while balancing the need to permit outbound access with the prevention of data exfiltration.
A well-configured firewall is the guardian of your digital assets
By following best practices, understanding different configurations, and regularly managing and updating your firewall, you can create a robust perimeter defense against cyber threats.
Customize rules based on your network’s specific needs and characteristics, keep firmware, software, and rules up to date to address emerging threats, and continuously monitor firewall logs to ensure success. The baseline firewall configuration can be enhanced through additional security solution integrations. For further insights into network security, check out our short video What is a Firewall?, which includes information on antivirus integration to advance security strategy and safeguard your digital assets.
