Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #225871

Re: firewalls

Show all headers | View raw

On 2020-08-05 00:51, Dan Ritter wrote:
> mick crane wrote:
>> I've never really understood firewalls. I think the idea is that they 
>> don't
>> let anything in that wasn't requested but if you go on a website there 
>> are
>> so many hundreds of scripts looking at this and that who knows what 
>> happens.
> 
> I notice you didn't ask a question, but I'll answer it anyway.
> 
> Near the bottom of the stack of networking is a link layer. For
> ethernet and related protocols, that means that there's an
> address for each interface -- ethernet calls it the MAC address.
> 
> If you build a firewall to intercept at this level, you can stop
> traffic from specific local sources. That's it. There are
> situations where we do this -- layer 2 firewalling -- but they
> aren't very common.
> 
> The next layer up, called layer 3, is IP addressing. IP
> connections involve IP addresses and IP subprotocols: UDP, TCP,
> and so forth. This is where most firewalls operate. An L3
> firewall usually starts with a generic directive to drop all
> traffic that it doesn't specifically allow, and then has a list
> of what to allow to each or all addresses being protected.
> 
> So: you can stop all DNS traffic from Cloudflare, but you can't
> drop JavaScript embedded in a web page from Google.
> 
> To do that, you need what is generically called an
> application-layer firewall, and those are usually set up on
> individual machines -- though they don't have to be -- and are
> frequently supplied with extensive, rapidly-updated block lists.
> 
> Some of them you even run *inside* your web browser: uBlock
> Origin, for example. Highly recommended.
> 
> -dsr-
> 
> P.S. you may be wondering why the numbering goes 2, 3,
> "application". This is because:
> 
> a) the OSI 7-layer model doesn't actually represent real
>    networks in this universe
> b) everything above layer 3 is kind of squishy
> c) most firewalls are actually reflecting the owner's policies
> in layers 8 and 9 of the 7-layer model: religion and politics.

thanks for that.
I dunno, have pfsense with community snort on it between me and the ISP 
router so I guess I'm OK with people having a go at the IP address but 
with the browser I imagine you can't filter every packet so somebody who 
doesn't really know what they are doing has to rely on whoever wrote the 
browser I suppose.

mick
-- 
Key ID    4BFEBB31

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

firewalls mick crane <mick.crane@gmail.com> - 2020-08-05 01:00 +0200
  Re: firewalls deloptes <deloptes@gmail.com> - 2020-08-05 01:30 +0200
  Re: firewalls Dan Ritter <dsr@randomstring.org> - 2020-08-05 02:00 +0200
    Re: firewalls riveravaldez <riveravaldezmail@gmail.com> - 2020-08-05 04:00 +0200
      Re: firewalls Andrei POPESCU <andreimpopescu@gmail.com> - 2020-08-05 10:10 +0200
      Re: firewalls Dan Ritter <dsr@randomstring.org> - 2020-08-05 13:20 +0200
        Re: firewalls Reco <recoverym4n@enotuniq.net> - 2020-08-05 13:20 +0200
        Re: firewalls deloptes <deloptes@gmail.com> - 2020-08-05 13:30 +0200
          Re: firewalls Kenneth Parker <sea7kenp@gmail.com> - 2020-08-05 13:50 +0200
    Re: firewalls mick crane <mick.crane@gmail.com> - 2020-08-05 08:50 +0200

csiph-web