International Journal Of Computer Science And Applications Vol. 6, No.

2, Apr 2013 ISSN: 0974-1011 (Open Access)

Available at: www.researchpublications.org

Roll of Distributed Firewalls in Local Network for

Data Security
1
RAJENDRA H. RATHOD , M.E. (Pursuing), Computer Science and Engineering
Prof.RamMeghe Institute of Technology & Research, Badnera-Amravati : 444701
[email protected]
2
Prof.V.M.DESHMUKH,

Prof.RamMeghe Institute of Technology & Research, Badnera-Amravati : 444701

ABSTRACT:Network Security is needed to prevent computer located apart from each other. A number
hacking of data and to provide authenticated data of confidential transactions occur every second and
transfer. Network Security can be achieved by today computers are used mostly for transmission
Firewall. Firewall is a hardware or software rather than processing of data. We need some
device designed to permit or deny network approach to secure transmission of the data, by the
transmissions based upon a set of rules and concept of Network Security, which involves the
regulation. It is frequently used to protect networks corrective action taken to Ease of Use protect from
from unauthorized access.A firewall is typically the viruses, hacking and unauthorized access of the
placed at the edge of a system and acts as a filter data [2].It is a Network Security needed to prevent
for unauthorized traffic. But conventional firewalls hacking of data and to provide authenticated data
rely on the notions of restricted topology and transfer. This Network Security can be achieved by
controlled entry points to function. Restricting the Firewalls.A Firewall is a collection of components,
network topology, results in difficulty in filtering of which are situated between two networks that
certain protocols, End-to-End encryption problems filters traffic between them by means of some
etc.Sodistributed firewalls are used which allow security policies. A Firewall can be an effective
enforcement of security policies on a network means of protecting a local system or network
without restricting its topology on an inside or systems from network based security threats while
outside point of view. Distributed firewalls secure at the same time affording access to the outside
the network by protecting critical network world through wide area networks and the
endpoints, exactly where hackers want to Internet[1]. Traditional firewalls are devices often
penetrate. It filters traffic from both the Internet placed on the edge of the network that act as a
and the internal network. They provide unlimited bouncer allowing only certain types of traffic in
scalability and also they overcome the single point and out of the network. Often called perimeter
of failure problem presented by the perimeter firewalls. They divide the network into two parts-
firewall. trusted on one side and untrusted on the other, as in
This paper is a literature review paper, Figure-1. For this reason they depend heavily on
dealing with the general concepts such distributed the topology of the network.In general, firewalls
firewalls, its requirements and implications and can be categorized under one of two general types:
introduce, its suitability to common threats on the Desktop or personal firewalls
Internet, as well as give a short discussion on Network firewalls
contemporary implementations. A distributed Within the network firewall type, there are primary
firewall gives complete security to the network. classifications of devices, including the following:
Packet-filtering firewalls (stateful and
Keywords: Network Security,Pull technique, Push nonstateful)
technique, Policy, Distributed Firewall. Circuit-level gateways
Application-level gateways[2], [19]
1. INTRODUCTION
In today's world, most businesses, regardless of 2. LITERATURE REVIEW
size, believe that access to the Internet is
imperative if they are going to compete effectively. The various papers over the distributed firewall
Even though the benefits of connecting to the was searched as follows and literature review is
Internet are considerable, so are the risks. Lots of given as:
data are getting transferred through it; one can
connect any computer in the world to any other

NCAICN-2013, PRMITR,Badnera
360
International Journal Of Computer Science And Applications Vol. 6, No.2, Apr 2013 ISSN: 0974-1011 (Open Access)

Available at: www.researchpublications.org

1994: Bellovin, S.M. and W.R. Cheswick, 3) Unable to handle protocols like FTP and
"Firewalls and Internet Security: Repelling the RealAudio.
Wily Hacker", Addison-Wesley. In this paper he 4) Has single entry point and the failure of this leads
suggested that the distributed firewall design is to problems.
based on the idea ofenforcing the policy rules at the 5) Unable to stop "spoofed" transmissions (i.e., using
endpoints rather than a single entry point to false sourceaddresses).
network. 6) Unable to log all of the network's activity and
unable to dynamically open and close their
networking ports.[3]
1994: William R. Cheswick and Steven M.
Bellovin. Firewalls and Internet Security:
Repelling the Wily Hacker. Addison-Wesley,
Reading, MA, first edition.

1999: Steven M. Bellovin, Distributed Firewalls,

November 1999 issue of; login: pp. 37-39.
Suggested advantages of distributed firewalls over
standard firewall

1999: William Stalling, Cryptography and

Network Security Principles and Practices, ISBN-
978-81-775-8774-6, PEARSON

2000: Ioannidis, S. and Keromytis, A.D., and Figure-1: A conventional firewall

Bellovin, S.M. and J.M. Smith, "Implementing a
Distributed Firewall", Proceedings of Computer To solve these problems of the traditional firewall,
and Communications Security (CCS), pp. 190-199, the evolution of the distributed firewall comes into
November 2000, Athens, Greece. picture.They provide virtually unlimited scalability.
In addition, theyovercome the single point-of-
failure problempresented by the perimeter firewall.
2001: Robert Stepanek, Distributed Firewalls In Distributed firewalls are host-resident security
Article In T-110.501Seminar on Network security software applications that protect the enterprise
2001 network's servers and end-user machines against
unwanted intrusion. They offer the advantage of
2003: Cheswick, W.R., Bellovin, S.M., Rubin, filtering traffic from both the Internet and the
A.D.: Firewalls and Internet Security, Repelling internal network. This enables them to prevent
the Wily Hacker, 2nd edn. AddisonWesley. hacking attacks that originate from both the
Internet and the internal network. This is important
2011: HiralB.Patel, Ravi S.Patel, JayeshA.Patel, because the most costly and destructive attacks still
Approach of Data Security in Local Network originate from within the organization called inside
using Distributed Firewalls, International Journal attack.[2], [13]
of P2P Network Trends and Technology-
Volume1Issue3-2011
4. A DISTRIBUTED FIREWALL DESIGN
2012: SnehaSahare, Mamta Joshi, ManishGehlot Distributed firewallsare host-resident security
A Survey paper: Data Security in Local software applications that protect the enterprise
Networks Using Distributed Firewall ISSN : network's servers and end-user machines against
0975-3397 Vol. 4 No. 09 Sep 2012, 1617 unwanted intrusion. They offer the advantage of
filtering traffic from both the Internet and the
3. STANDARD FIREWALL internal network. This enables them to prevent
hacking attacks that originate from both the
This paper is a literature survey of standard firewall Internet and the internal network as given in the
and distributed firewall. A standard firewall has figure-2 and figure-3.Usually deployed behind the
certain policies to protect the data from outsiders. traditional firewall, they provide a second layer of
But not all the data or information can be protected protection. Distributed firewalls secure thenetwork
internally from insiders of the network. Some by protecting critical network endpoints, exactly
problems with standard firewall as follows. where hackers want to penetrate. It filters traffic
1) Depends on the topology of the network. from both the Internet and the internal network
2) Do not protect networks from the internal attacks. because the most destructive and costly hacking

NCAICN-2013, PRMITR,Badnera
361
International Journal Of Computer Science And Applications Vol. 6, No.2, Apr 2013 ISSN: 0974-1011 (Open Access)

Available at: www.researchpublications.org

attacks still originate from within the topology. Certificate enables making decisions
organization.[8] without knowledge of the physical location of the
host.
Policy distribution scheme is used to enable policy
control from central point from central point.
5. ADVANTAGES OF
DISTRIBUTEDFIREWALLS
Topological independence is one of the main
advantages of distributed firewalls. Since
network security no longer depends on network
topology, it provides more flexibility in defining
the security perimeter.[1]
Network security is no more dependent on the
Distributed firewall
single firewall so that problems like performance
bottleneck and traffic congestion are
resolved.[8], [12]
Figure-2 : distributed firewall Filtering of certain protocols such as FTP is much
easier on distributed firewalls since all of the
required information is available at the decision
point, whichis the end host in general.[2], [9], [12]
With the distributed firewall architectures, the
insiders are no longer treated as unconditionally
trusted. Dividing network into parts having
different security levels is much easier with
distributed firewalls.[9]
Security policy rules are distributed and established
on an as-needed basis. Only the host that needs to
communicate with the external network should
determine the relevant policy. [9], [12]
End-to-end encryption is possible without affecting
the network security, significantly improves the
security of the distributed firewall.[5]
Figure-3 : Distributed firewall Architecture 6. DISADVANTAGESOF
DISTRIBUTEDFIREWALLS
The distributed firewall design is based on the idea
ofenforcing the policy rules at the endpoints rather If firewall command center is compromised, due
than a single entry point to network. The security to attack or mistake by the administrator, this
policies are still defined centrally. The aim with situation is high risky for security of the entire
this approach is to retain theadvantages of firewalls network
while resolving the disadvantages.[14] Intrusion detection systems are less effective
They guard the individual machine in the same way with distributed firewalls because complete
that the perimeter firewall guards the overall network traffic is not on the single point.
network. Compliance of security policy for insiders is one
of the major issues of distributed firewalls. This
4. COMPONENTS OF A DISTRIBUTED problem especially occurs when each ending host
FIREWALL have the right of changing security policy. [10],
[11],[12], [14]
There are three components of distributed firewall.
i. Policy language
ii. Policy distribution scheme 7. DISTRIBUTED FIREWALL:
iii. Certificate ADMINISTRATION ARCHITECTURE
Policy language defines which inbound and Distributed Firewall Administration Architecture
outbound connections are allowed or rejected. It is based on hierarchically organized distributed
equivalent to packet filtering rules. Policy language firewall system. The domain statement has a
should also support credential for authentication
domain firewall which is standing on the domain
purpose [8].
Distributed firewall use cryptographic certificates entrance and protects the entire domain according
as identifier since these are independent of tothe organizational policy.According to the

NCAICN-2013, PRMITR,Badnera
362
 International Journal Of Computer Science And Applications Vol. 6, No.2, Apr 2013 ISSN: 0974-1011 (Open Access)

Available at: www.researchpublications.org

network model there are subnets available and enterprise and other organizations
connected to the domain firewall. Each subnet has networkorganization more accurately but demand
a subnet firewall which is located on the subnet fundamental changes in the network end-
pointsoperating systems.
entrance. Purpose of the subnet firewall is same as
In this paper we have tried to explain or provethe
the domain firewall.Every subnet may have internet problems and solution of that problem with
different numberof personal firewall; this personal thehelp of distributed firewalls. It is also called
firewall can control their network traffic. In filtering process.Network security policy
addition subnet firewall may have child firewall specification remains under the control of the
which type can be subnet firewall. network administrator in distributed firewall
network system.Since enforcement occurs at the
endpoints, various shortcomings of traditional
firewalls are overcome:
Internet
Security is no longer dependent on restricting the
network topology. This allows considerable
flexibility in defining the security perimeter,
which can easily be extended to safely include
remote hosts and networks.
Domain
Since we no longer solely depend on a single
Firewall
firewall for protection, we eliminate a
performance bottleneck. Alternately, the burden
Subnet Subnet placed on the traditional firewall is lessened
Firewall Firewall significantly, since it delegates a lot of the
filtering to the end hosts.
Filtering of certain protocols (e.g., FTP) which
Personal Personal Personal Personal was difficult when done on a traditional firewall,
Firewall Firewall Firewall Firewall becomes significantly easier, since all the
relevant information is present at the decision
Communication scheme between these firewall point, i.e., the end host.
nodes in the system as follows :personal firewall
The number of outside connections the protected
nodes has to maintain local rule base to store rules.
network is no longer a cause for administration
They are responsible to enforce the local policy.
nightmares. Adding or removing links has no
When personal firewall performs any operations
impact on the security of the network.
such as insert, delete policy rule they haveto
Backdoor connections set up by users, either
propagate to their Subnet firewall. Subnet firewalls
intentionally or inadvertently, also do not create
can communicate to all of the nodes inside that
windows of vulnerability.
subnet but they cannot communicate to another
End-to-end encryption is made possible without
subnet firewall at the same level. Similarly, a
sacrificing security, as was the case with
domain firewall can communicate to any other
traditional firewalls. In fact, end-to-end
nodes in that domain. The communication between
encryption greatly improves the security of the
a domain firewall and leaf firewall is possible with
distributed firewall.
the help of the subnet firewalls. Communication
request of the domain firewall is received by the Application-specific policies may be made
leaf level firewall viathe subnet firewall. [22] available to end applications over the same
distribution channel.
7. CONCLUSION Filtering (and other policy) rules are distributed
This paper try toprovide the solution over computer and established on an as-needed basis; that is,
crime whenever user can transfer sensitive and only the hosts that actually need to communicate
important data orinformation using firewalls and need to determine what the relevant policy with
distributed firewalls which provides the security regard to each other is. This significantly eases
during the data transmission. Theyprovide the legal the task of policy updating, and does not require
infrastructure for internet access. Firewallsprovide each host/firewall to maintain the complete set of
the facility like only authentic user can access policies, which may be very large for large
thecomputer or internet for his personal use[20]. networks. Furthermore, policies and their
Distributed firewall can solve some known and distribution scales much better with respect to the
thoroughly discussed problems which arisewith the network size and user base than a more tightly-
use of conventional firewalls residing at the coupled and synchronized approach would.
networks perimeter. Its independenceon On the other hand, distributed firewall architecture
topological constraints reflect the change in requires high quality administration tools. The

NCAICN-2013, PRMITR,Badnera
363
International Journal Of Computer Science And Applications Vol. 6, No.2, Apr 2013 ISSN: 0974-1011 (Open Access)

Available at: www.researchpublications.org

introduction of a distributed firewall infrastructure [9]Behrouz A. Forouzan, DebdeepMukhopadhyay,

in a network does not completely eliminate the Cryptography and Network Security, ISBN-13:
need for a traditional firewall. 978-0- 07-070208-0, ISBN-10: 0-07-070208-X,
McGrawHill Higher Education.
It is easier to counter infrastructure attacks that [10] Steven M. Bellovin, Distributed Firewalls,
operate at a level lower than the distributed November 1999 issue of; login: pp. 37-39.
firewall. [11] Daniel Wan, Distributed Firewall, GSEC
Denial-of-service attack mitigation is more Practical Assignment Version 1.2c.
effective at the network ingress points [12] William Stalling, Cryptography and Network
Intrusion detection systems are more effective Security Principles and Practices, ISBN-978-81-
when located at a traditional firewall, where 775-8774-6, PEARSON
complete traffic information is available. [13] Anand Kumar Data security in local
The traditional firewall may protect end hosts networks using distributed firewalls, Cochin
that do not (or cannot) support the distributed University of science and technology, August-2008
firewall mechanisms. Integration with the policy [14] Bellovin, S.M. and W.R. Cheswick,
specification and distribution mechanisms is "Firewalls and Internet Security: Repelling the
especially important here, to avoid duplicated Wily Hacker", Addison-Wesley, 1994.
filters and windows of vulnerability. [15] SnehaSahare, Mamta Joshi, ManishGehlot A
Finally, a traditional firewall may simply act as a Survey paper: Data Security in Local
fail-safe security mechanism. Networks Using Distributed Firewall ISSN :
Fully distributed firewall architecture is very 0975-3397 Vol. 4 No. 09 Sep 2012, 1617
similar to a network with a large number of internal [16] Scuba, C.L., Spafford, E.H.: Reference model
firewalls. for firewall technology, Source. In: Annual
Computer Security Applications Conference, pp.
ACKNOWLEDGMENT 133145 (1997)
First and foremost I want to
thank my [17] William R. Cheswick and Steven M.
GuideSmt.V.M.Deshmukhmadom. With great Bellovin.Firewalls and Internet Security: Repelling
pleasure and gratefulness, I extend my deep sense the Wily Hacker. Addison-Wesley, Reading, MA,
of gratitude to Prof.Dr.G.R.BamnoteSir, HOD, first edition, 1994
ComputerEngg. Deptt.for giving me an opportunity [18] Cheswick, W.R., Bellovin, S.M., Rubin, A.D.:
to accomplish my paper and to increasemy Firewalls and Internet Security, Repelling the Wily
knowledge.AlsoI want to thank to Dr.Gupta sir to Hacker, 2nd edn. AddisonWesley (2003)
help me time to time. Lastly I wish to thank each [19] Behrouz A. Forouzan,
and every person involved in making my DebdeepMukhopadhyay, Cryptography and
dissertation successful. Thank You. Network Security, ISBN-13: 978-0- 07-070208-0,
ISBN-10: 0-07-070208-X, McGraw Hill Higher
Education.
REFERENCES [20] Mark, Stuart.Distributin g firewall tasks 23
[1] http://www.seminarprojects.com/Thread-data- April 2001
security-in-localnetwork-using-distributed- [21]Fogei, Avi. Distributed firewalls provide
Firewalls options for security topology July 2000
[2] http://en.wikipedia.org [22]Yunus ERDOAN Development of a
[3] HiralB.Patel, Ravi S.Patel, JayeshA.Patel, Distributed Firewall Administration tool November
Approach of Data Security in Local Network 2008
using Distributed Firewalls, International Journal
of P2P Network Trends and Technology-
Volume1Issue3-2011.
[5] AtulKahate, Cryptography and Network
Security, ISBN-13: 978-0-07-064823-4, ISBN-10:
0-07-064823-9, McGraw Hill Higher Education.
[7] Robert Stepanek, Distributed Firewalls In
Article In T-110.501Seminar on Network security
2001
[8] Ioannidis, S. and Keromytis, A.D., and
Bellovin, S.M. and J.M. Smith, "Implementing a
Distributed Firewall", Proceedings of Computer
and Communications Security (CCS), pp. 190-199,
November 2000, Athens, Greece.

NCAICN-2013, PRMITR,Badnera
364