Firewall (computing) facts for kids

A firewall is like a security guard for your computer network. It watches all the information trying to come in and go out. Based on special rules, it decides what information is allowed to pass and what should be blocked. Think of it as a barrier between your safe, trusted network (like your home Wi-Fi) and the wild, untrusted internet.

History of Firewalls

The word firewall first meant a wall built to stop a fire from spreading between buildings. Later, it described things like the metal sheet that separates a car's engine from the passengers.

In the 1980s, as the Internet started to grow, people began using the term for network security. Before firewalls, routers were used to separate different parts of a network. These routers could also filter some of the data passing through them.

Interestingly, the term "firewall" appeared in the 1983 computer movie WarGames before it was widely used in real computer security. This might have even inspired its later use!

One of the first successful firewalls was called the PIX Firewall, created in 1994. It helped organizations connect their private networks to the internet safely, even with limited internet addresses. This technology was later bought by Cisco Systems, a big technology company.

Types of Firewalls

Firewalls are usually divided into two main types: network-based and host-based.

• Network-based firewalls act like a gate between two or more networks. They often sit between your local network (like your school's network) and the wider internet. Their main job is to control the flow of data between these connected networks. They can be special hardware devices, software running on a computer, or even virtual ones in a cloud.
• Host-based firewalls are installed directly on a single computer or server. They control the network traffic specifically for that one device. This can be a part of the computer's operating system or a special security program.

This picture shows a network-based firewall protecting a network.

Packet Filtering

The very first type of network firewall was called a packet filter. It checks small pieces of data, called "packets," as they travel between computers.

A packet filter uses a list of rules to decide what to do with each packet. It can silently throw away a packet, tell the sender that the packet was blocked, or let it pass. Packets can be filtered based on where they came from (source IP address), where they are going (destination IP address), the type of data (protocol), or the specific "door" (port) they are trying to use.

In 1987, engineers from Digital Equipment Corporation (DEC) developed these first packet filter firewalls. Later, researchers at AT&T Bell Labs also worked on improving them.

Connection Tracking

This shows how data packets flow through Netfilter, a firewall system in Linux.

The second generation of firewalls, developed around 1989-1990, were called circuit-level gateways.

These firewalls did everything the first generation did, but they were smarter. They could remember ongoing conversations between computers. For example, if your computer was talking to a website, the firewall would remember that specific connection and allow all related data to pass through. This helped them understand the bigger picture of what was happening.

Application Layer Firewalls

In 1993, a new type of firewall appeared, called an application layer firewall.

The big advantage of these firewalls is that they can understand specific applications and how they communicate. For example, they know how File Transfer Protocol (FTP) works for transferring files, or Hypertext Transfer Protocol (HTTP) for web browsing. This means they can spot if a program is trying to use a service in a strange way, or if an allowed program is being misused.

Modern firewalls, sometimes called "next-generation firewalls," can do even more. They can:

• Filter websites you visit (web filtering).
• Stop attacks before they happen (intrusion prevention systems).
• Manage who is using the network (user identity management).
• Protect web applications.
• Check the content of data for threats.

Common Firewall Logs

Firewalls keep detailed records, called "logs," of everything they do. These logs are super important for understanding what's happening on a network and finding problems or security threats.

• Traffic Logs: These logs record all the data that moves through the network. They show where data came from, where it went, what kind of data it was, and if the firewall allowed or blocked it. They help experts see how devices are communicating.
• Threat Prevention Logs: These logs focus on security threats. They show alerts from systems that stop intrusions, antivirus events, and other threat detections. They are key for finding and reacting to possible security breaches.
• Audit Logs: These logs record changes made to the firewall's settings by administrators. They are important for tracking who changed what and when, which helps with security checks.
• Event Logs: These are general logs that capture many different events happening on the firewall. They help administrators monitor and fix issues.
• URL Filtering Logs: These logs record information about web traffic and which websites users visit. They show which websites were blocked or allowed. This helps organizations control internet access and keep the network safe.
• User Activity Logs: These logs track what specific users are doing. They show when users log in or out and their traffic patterns. This helps understand user behavior and find security problems related to users.
• System Logs: These logs provide information about the firewall's health and status. They can show if the system is working well or if there are any issues. They are vital for keeping the firewall running smoothly.

Setting Up a Firewall

Setting up a firewall can be tricky. If it's not configured correctly, a network might still have security problems.

Firewall rules are set up based on the type of network, like if it's a public network (like a coffee shop Wi-Fi) or a private one (like your home network). These rules either block or allow access to prevent attacks from hackers or harmful software.

See also

In Spanish: Cortafuegos (informática) para niños