Firewall: Optimizing Policies, Testing and Performance Evaluation

Abstract

Firewalls enforce a security policy between two networks by comparing arriving packets against the policy rules to determine whether they should be accepted or denied. As the amount of data being transferred over networks increases over a time, the firewalls used to protect private networks must process traffic both faster and with greater reliability. In order to cope with new application types like multimedia applications and as high-speed networks become more prevalent, delays will become more significant, new firewall architectures are necessary. The performance of these new architectures is a critical factor because Quality of Service (QoS) demands of such applications have to be satisfied.

This thesis covered basics of firewall, which has definitions, types of firewalls, and current firewall approaches. Also as network become complex, managing firewall rules, especially for enterprise networks, has become complex and error-prone. Firewall filtering rules have to be carefully written and organized in order to correctly implement the security policy. In addition, inserting or modifying a filtering rule requires thorough analysis of the relationship between this rule and other rules in order to determine the proper order of this rule and commit the updates for this we presents firewall policies modeling and defined set of anomaly which describes any rules conflicts.

This thesis covered single firewall and disturbed firewall architecture implemented using of-the-shelf components like iptables and iproute2. Iptables is a generic table structure that defines rules and commands as part of the netfilter framework that facilitates packet filtering, Network Address Translation, and packet mangling in the Linux 2.4 and later operating systems. Packet mangling is process of modifying packets TOS bits and marking packets before it goes to routing process.

Finally, thesis explores the firewall security and performance relationship for single firewall and distributed firewalls. We also discuss the tradeoff between security and performance in terms of delay and throughput vs number of rules in single and distributed firewall.