Firewall Types and Placement

A computer worm called SQL Slammer began copying itself across the internet just after midnight, East Coast time, on Saturday, January 25, 2003. It was tiny: the whole program was 376 bytes, small enough to fit in a single UDP packet sent to port 1434 on Microsoft SQL Server database software. A packet is one piece of data sent across a network. A port, in this sense, is a number that tells the receiving computer which program the data is for, not a jack on a switch. UDP sends packets without setting up a connection first. Any unpatched server that received the packet was infected and began sending the same packet to random addresses as fast as it could. The number of infected machines doubled about every 8.5 seconds. Within ten minutes it had infected more than 90 percent of the vulnerable computers on the internet, and at least 75,000 were infected in all. The traffic it threw off knocked out thousands of Bank of America's ATMs, delayed Continental Airlines flights, and slowed 911 dispatch in the Seattle area. Microsoft had released a fix six months earlier.

Every Slammer packet looked the same from the outside: a UDP packet to port 1434. Say what a firewall at a company's internet connection needed in order to stop it.

A single line in its list was enough: deny any UDP from outside headed for 1434. Hardly any business needed database servers answering strangers on the internet, so blocking it cost nothing. A firewall that read only each packet's header, its addresses, its protocol, and its port number, would have dropped every copy that arrived through that connection.

A firewall sold as a box of its own, like Cisco's PIX line from the years of Slammer, is a small computer inside. It has a processor, memory, a fan, and a power supply, and it runs an operating system written for filtering traffic.

A city bus agency runs several networks that hold very different things. Its IT staff list them with the firewall setting each one gets.

Each segment sits behind its own firewall, so traffic between the garage and dispatch has to pass one, just like traffic from the internet. Explain why dispatch gets the strictest setting, though it holds no money and no one's personal records.

If dispatch goes down, the agency loses track of its buses and can't reach its drivers, while thousands of people are on board. The segment only has to talk to dispatchers, the buses, and a one-way feed of arrival times out to the trip planner, so its firewall can refuse nearly everything else. The trip planner is the opposite: it has to answer the whole internet, so its firewall admits web traffic and little more.

A rule like the one against Slammer judges each packet alone, and a packet can lie about itself. Most web traffic uses TCP, which, unlike UDP, sets up a connection before any data is sent. Say the office firewall admits any TCP packet sent from a website's port, since that is where answers from websites come from. A packet arrives from an address on the internet. It was sent from a website's port, and its header marks it as part of a conversation already under way. A stateless firewall reads the header, finds nothing against it, and passes it. A stateful firewall also keeps track of the connections the office's computers have opened. Its record holds no connection between that address and any office computer, so it drops the packet.

A next-generation firewall goes further and looks inside the traffic. Slammer's packet had a recognizable shape, so a firewall that inspects contents, as next-generation firewalls later did, can match the worm itself, even if the agency had to keep port 1434 open for its own database servers. Reading what packets carry is called deep packet inspection. Stopping an attack as it happens, instead of only reporting it, is called intrusion prevention.

Slammer also reached a place it should never have touched: the Davis-Besse nuclear power plant on Lake Erie in Ohio. The plant's network had a firewall that would have stopped the worm. But a contractor's computer network was linked to the plant's business network by a dedicated line that didn't pass through that firewall. The contractor's network was on the internet, so the line was one more way in from the internet that no firewall watched. Slammer came in on the contractor's side and crossed the line. Its traffic shut down the plant's safety parameter display system, which shows operators the reactor's most important readings, for nearly five hours. The plant had been shut down for repairs since 2002, so nothing was at risk that day, but the Nuclear Regulatory Commission warned every plant in the country about the gap.