{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"cs/firewall","url":{"en":"https://atlas.maintz.dev/en/terms/cs/firewall/","da":"https://atlas.maintz.dev/da/terms/cs/firewall/"},"term":{"en":"Firewall","da":"Firewall"},"aka":{"en":["network firewall"],"da":["netværksfirewall"]},"domain":["cs","security"],"cluster":"networking","layer":"network","status":"current","era":1988,"summary":{"en":"A gatekeeper that checks network traffic against rules and lets through only what is allowed.","da":"En portvagt, der tjekker netværkstrafik mod regler og kun lukker det igennem, der er tilladt."},"body":{"formal":{"en":"A device or program placed between networks that inspects each packet - its IP addresses, ports and protocol - and allows or blocks it according to a set of rules. Most firewalls also track open connections, so replies to allowed traffic are let back in.","da":"En enhed eller et program placeret mellem netværk, som undersøger hver pakke - dens IP-adresser, porte og protokol - og tillader eller blokerer den efter et regelsæt. De fleste firewalls holder også styr på åbne forbindelser, så svar på tilladt trafik lukkes ind igen."},"plain":{"en":"Like a guard at the gate of a building with a list of who may come in and which doors they may use; anyone not on the list is turned away.","da":"Som en vagt ved porten til en bygning med en liste over, hvem der må komme ind, og hvilke døre de må bruge; alle andre bliver afvist."},"inPractice":{"en":"At a local water utility, the IT operations manager sets the firewall so the system that controls the pumps can be reached only from two computers in the control room; all traffic from the office network is blocked.","da":"På et vandværk sætter den IT-driftsansvarlige firewallen op, så anlægget, der styrer pumperne, kun kan nås fra to computere i kontrolrummet; al trafik fra kontornetværket blokeres."},"whyItMatters":{"en":"It is one of the oldest and most basic network controls, shrinking what an outsider can reach - but it cannot stop threats that come through allowed doors.","da":"Den er en af de ældste og mest grundlæggende netværkskontroller og mindsker, hvad en udefrakommende kan nå - men den kan ikke stoppe trusler, der kommer gennem tilladte døre."}},"deepDive":{"en":"Firewalls evolved in generations. The first were stateless packet filters in the late 1980s, typically access control lists on routers that judge each packet in isolation by its 5-tuple (protocol, source and destination address, source and destination port) and flags. Because they have no memory, letting replies back in requires broad rules such as \"allow TCP with ACK set to high ports\", which attackers can abuse. Stateful inspection, popularised by Check Point FireWall-1 in the mid-1990s, keeps a connection table: an outbound SYN creates an entry, and only packets matching a tracked flow in a valid TCP state are allowed back, while UDP and ICMP get pseudo-connections with idle timeouts. Linux implements this in netfilter's conntrack, configured through nftables or iptables. Application-level gateways (proxies) go further by terminating the connection and parsing the protocol, and next-generation firewalls (NGFW) add application identification, user identity, TLS inspection and IPS signatures.\n\nA rule base is normally evaluated top-down with first-match semantics and an implicit deny at the end. Good practice, reflected in NIST SP 800-41 Rev. 1, is default deny with explicit, documented exceptions, and it applies to egress as much as ingress: unrestricted outbound traffic is what lets malware reach command-and-control servers and exfiltrate data. Anti-spoofing filters drop packets whose source addresses cannot legitimately arrive on an interface, such as private RFC 1918 addresses arriving from the internet (compare BCP 38). Common mistakes are shadowed rules that never match because a broader rule above them does, \"temporary\" any-any rules that become permanent, rules nobody can explain, and exposed management interfaces.\n\nNetwork firewalls sit between zones and enforce network segmentation, whereas host-based firewalls (Windows Defender Firewall, nftables on a server) protect the individual machine and limit lateral movement even on a flat network; CIS Controls v8 Safeguards 4.4 and 4.5 require firewalls on servers and end-user devices respectively. In the cloud, the same ideas reappear as security groups (stateful, attached to instances) and network ACLs (stateless, attached to subnets) in AWS.\n\nA firewall only decides whether a flow may exist; it does not judge what travels inside an allowed flow. Everything tunnelled over TCP 443 looks alike without TLS inspection, and a web application firewall or IPS is needed to catch SQL injection or exploit payloads on an open port. Firewalls are also targets themselves: edge devices from several major vendors have had critical, actively exploited vulnerabilities in their VPN and management components, for example CVE-2024-3400 in Palo Alto Networks PAN-OS in 2024. Auditing therefore covers the rule base (periodic recertification, rule-hit counts), the configuration against a hardening benchmark, and the patch level of the firewall's own software.","da":"Firewalls har udviklet sig i generationer. De første var tilstandsløse pakkefiltre i slutningen af 1980'erne, typisk adgangslister (ACL'er) på routere, der vurderer hver pakke isoleret ud fra dens 5-tuple (protokol, kilde- og destinationsadresse, kilde- og destinationsport) og flag. Fordi de ingen hukommelse har, kræver det brede regler at lukke svar ind, fx \"tillad TCP med ACK sat til høje porte\", som angribere kan misbruge. Stateful inspection, som Check Point FireWall-1 gjorde udbredt i midten af 1990'erne, fører en forbindelsestabel: En udgående SYN opretter en post, og kun pakker, der passer til et kendt flow i en gyldig TCP-tilstand, lukkes tilbage, mens UDP og ICMP får pseudoforbindelser med timeout. Linux implementerer det i netfilters conntrack, der konfigureres via nftables eller iptables. Applikationsgateways (proxyer) går videre ved at afslutte forbindelsen og fortolke protokollen, og next-generation firewalls (NGFW) tilføjer genkendelse af applikationer, brugeridentitet, TLS-inspektion og IPS-signaturer.\n\nEt regelsæt evalueres normalt oppefra og ned, hvor første match gælder, og der er en implicit afvisning til sidst. God praksis, som også NIST SP 800-41 Rev. 1 afspejler, er default deny med eksplicitte, dokumenterede undtagelser - og det gælder udgående trafik lige så meget som indgående: Ubegrænset udgående trafik er netop det, der lader malware nå command-and-control-servere og sende data ud. Anti-spoofing-filtre afviser pakker, hvis kildeadresse ikke legitimt kan komme ind på en given grænseflade, fx private RFC 1918-adresser, der ankommer fra internettet (jf. BCP 38). Typiske fejl er skyggede regler, der aldrig rammer, fordi en bredere regel ovenover gør det, \"midlertidige\" any-any-regler, der bliver permanente, regler, ingen kan forklare, og administrationsgrænseflader, der er eksponeret.\n\nNetværksfirewalls sidder mellem zoner og håndhæver netværkssegmentering, mens værtsbaserede firewalls (Windows Defender Firewall, nftables på en server) beskytter den enkelte maskine og begrænser lateral bevægelse selv på et fladt netværk; CIS Controls v8, safeguard 4.4 og 4.5, kræver firewall på henholdsvis servere og slutbrugerenheder. I skyen dukker de samme idéer op som security groups (stateful, knyttet til instanser) og network ACL'er (tilstandsløse, knyttet til subnet) i AWS.\n\nEn firewall afgør kun, om et flow må eksistere; den vurderer ikke, hvad der bevæger sig inde i et tilladt flow. Alt, der tunneleres over TCP 443, ser ens ud uden TLS-inspektion, og der skal en web application firewall eller en IPS til for at fange SQL injection eller exploit-kode på en åben port. Firewalls er også selv mål: Kant-enheder fra flere store leverandører har haft kritiske, aktivt udnyttede sårbarheder i deres VPN- og administrationskomponenter, fx CVE-2024-3400 i Palo Alto Networks PAN-OS i 2024. Revision omfatter derfor regelsættet (periodisk regelgennemgang, tællere for regeltræf), konfigurationen holdt op mod en hærdningsvejledning og patchniveauet på firewallens egen software."},"howTo":{"steps":{"en":["Draw a simple network map with the zones you have, such as internet, DMZ, office, servers, management and OT, and name an owner for the firewalls between them.","Write a firewall policy that says traffic is denied by default in both directions, and that every allowed flow needs a business reason, an owner and an approval.","Build the rule base from that policy, allowing only the specific source, destination, port and protocol each system needs, and add a clear deny-all rule at the end that logs what it blocks.","Limit outbound traffic too, so servers can reach only the update and service addresses they need, and route web traffic from users through a filtering proxy or DNS filter.","Turn on the host firewall on every laptop and server through central policy, blocking inbound traffic except the few services the device must offer.","Put the firewall's own management interface on a separate management network with MFA, never on the internet, and patch the firewall as soon as security updates are released.","Send firewall logs to central logging or a SIEM, and alert on blocked traffic from inside to known bad addresses and on changes to the rule base.","Handle every rule change through change management with a ticket, and review the whole rule base at least once a year, removing rules that are unused, too broad or have no owner."],"da":["Tegn et enkelt netværkskort med de zoner, I har, fx internet, DMZ, kontor, servere, administration og OT, og udpeg en ejer af firewallene mellem dem.","Skriv en firewallpolitik, der siger, at trafik som udgangspunkt afvises i begge retninger, og at hvert tilladt flow kræver en forretningsmæssig begrundelse, en ejer og en godkendelse.","Byg regelsættet ud fra politikken, så kun den kilde, destination, port og protokol, hvert system har brug for, er tilladt, og slut af med en tydelig afvis-alt-regel, der logger, hvad den blokerer.","Begræns også udgående trafik, så servere kun kan nå de opdaterings- og tjenesteadresser, de har brug for, og send brugernes webtrafik gennem en filtrerende proxy eller DNS-filtrering.","Slå værtsfirewallen til på alle bærbare og servere via central politik, og bloker indgående trafik bortset fra de få tjenester, enheden skal tilbyde.","Placér firewallens egen administrationsflade på et separat administrationsnet med MFA, aldrig på internettet, og patch firewallen, så snart der kommer sikkerhedsopdateringer.","Send firewallloggene til central logning eller en SIEM, og alarmér ved blokeret trafik indefra mod kendte ondsindede adresser og ved ændringer i regelsættet.","Behandl hver regelændring gennem ændringsstyring med en sag, og gennemgå hele regelsættet mindst en gang om året, hvor regler uden brug, for brede regler og regler uden ejer fjernes."]},"pitfalls":{"en":["Adding a \"temporary\" any-any rule to solve an urgent problem and never removing it again.","Filtering only inbound traffic, so malware on the inside can freely call home and send data out.","Exposing the firewall's VPN or management portal to the internet without patching it quickly, although such edge devices are a favourite target."],"da":["At tilføje en \"midlertidig\" any-any-regel for at løse et akut problem og aldrig fjerne den igen.","Kun at filtrere indgående trafik, så malware på indersiden frit kan ringe hjem og sende data ud.","At have firewallens VPN- eller administrationsportal åben mod internettet uden at patche den hurtigt, selv om den slags kantudstyr er et yndet mål."]},"guides":[{"title":"NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy","url":"https://csrc.nist.gov/pubs/sp/800/41/r1/final","publisher":"NIST","tier":"standard"},{"title":"CIS Critical Security Control 4 - Secure Configuration of Enterprise Assets and Software","url":"https://www.cisecurity.org/controls/secure-configuration-of-enterprise-assets-and-software","publisher":"Center for Internet Security","tier":"standard"},{"title":"Windows Firewall Overview","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/","publisher":"Microsoft","tier":"official-doc"},{"title":"Køb antivirus og firewall","url":"https://www.sikkerdigital.dk/virksomhed/syv-raad-om-it-sikkerhed/3-koeb-antivirus-og-firewall","publisher":"Styrelsen for Samfundssikkerhed","tier":"official-doc","lang":"da"}]},"edges":[{"type":"requires","to":"cs/packet","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/port","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/ip-address","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/intrusion-prevention-system","why":{"en":"A firewall decides by fixed rules about where traffic may go; an IPS looks inside allowed traffic for signs of an attack.","da":"En firewall afgør ud fra faste regler, hvor trafik må gå hen; en IPS kigger ind i tilladt trafik efter tegn på angreb."},"confidence":"high","strength":"primary"},{"type":"contrasts-with","to":"security/human-firewall","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/data-breach","why":{"en":"Blocking unneeded paths into the network removes many routes an attacker could use to reach data.","da":"Ved at blokere unødvendige veje ind i netværket fjernes mange ruter, en angriber kunne bruge til at nå data."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"cs/network-segmentation","confidence":"high","strength":"normal"},{"type":"used-with","to":"cs/router","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/perimeter-security","confidence":"high","strength":"normal"}],"depth":3,"sources":[{"title":"Kurose & Ross, Computer Networking: A Top-Down Approach","tier":"textbook"},{"title":"NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy","tier":"standard"}],"draft":true}