The role of the firewall in the network and the configuration of the steps in detail

Apr 03 , 2024 1284

In today's digital age, cybersecurity has become a major concern for businesses and individuals. With the popularization of the Internet and the development of technology, the risk of cyber-attacks is increasing. In order to protect the network from various threats and attacks, firewalls have become a crucial network security device. So what is a firewall and what is its role in network security?

A firewall is a network security device that is often used to monitor and control network traffic, allowing or denying the transmission of packets based on preset security rules. It sits at the boundary of a network and is similar to a virtual protective wall to block unauthorized access and malicious attacks. Firewalls can be deployed at the network boundary, host, or application layer to provide multiple layers of protection for an organization's network.

When it comes to the role of firewall for the network, firstly it can identify and block malicious traffic, such as network viruses, botnet attacks and so on, as a way to protect the enterprise network from attacks and intrusions. Secondly it can control network access based on preset security policies, allowing only authorized users and devices to access specific network resources. This helps to reduce the impact of internal and external threats on network security. Finally it can monitor network traffic, detect and respond to network security events in time through logging and alarm functions, and reduce the damage caused by security breaches to the system.

Firewalls are widely used in enterprise networks to protect internal networks from external attacks and intrusions. It can be configured as a network border firewall, internal gateway firewall, etc. to provide multi-layered network protection.

In public network environments, such as coffee shops and airports, firewalls can help administrators monitor and control network access, prevent unauthorized users from accessing sensitive information and resources, and protect network security and user privacy.

The following linknewnet engineers to H3C as an example, for you to organize the firewall configuration of the relevant steps, the need for friends can collect spare.

H3C firewall access to the Internet: the first is a fixed IP address to access the Internet, the second is dial-up Internet configuration

First: Fixed IP address for Internet access

============= Fixed ip =====================

1、Configure the firewall packet filtering mode

<h3c>sys Go to System View

[h3c]firewall packet-filter enable

[h3c]firewall packet-filter default permit

2、Configure web user and telnet user login

[h3c]local-user admin

[h3c-luser-admin]password simple admin

[h3c-luser-admin]service-type telnet

[h3c-luser-admin]level 3

[h3c-luser-admin]quit

[h3c]user-interface vty 0 4 Implementing telnet

[h3c-ui-vty0-4]authentication-mode scheme

[h3c-ui-vty0-4]quit

3、Configure ip address, the address please refer to the actual

[h3c]interface Ethernet0/0 ------------ Configure the external port address

[h3c-Ethernet0/0]ip address x.x.x.x x.x.x.x Please refer to the address given by the operator.

[h3c]interface Ethernet0/1 ------------ Configure the internal port address

[h3c-Ethernet0/0]ip address 192.168.1.1 255.255.255.0

4. Configure the security domain and join the ports to the domain

[h3c-zone]firewall zone trust Add trust to the intranet port trust

[h3c-zone-trust]add interface Ethernet0/1

[h3c-zone-trust]quit

[h3c-zone]firewall zone untrust Add untrust to the extranet port untrust

[h3c-zone-untrust]add interface Ethernet0/0

[h3c-zone-untrust]quit

5、Configure nat outside the network interface

[h3c]acl number 2000

[h3c-acl-basic-2000]rule permit

[h3c-acl-basic-2000]quit

[h3c]interface Ethernet0/0

[h3c-Ethernet0/0]nat outbound 2000

6、Configure the default route out of the external network

[h3c]ip route-static 0.0.0.0 0.0.0.0 x.x.x.x  This address should be based on the external gateway provided by your carrier.

7、DHCP server configuration (optional)

[h3c]dhcp enable

[h3c]dhcp server forbidden-ip 192.168.1.1 dhcp does not allocate 192.168.1.1 this address, there are other addresses that are not allocated as the same configuration

[h3c]dhcp server ip-pool 1 Create an address pool, assigning the 192.168.1.0 segment address

[h3c-dhcp-1]network 192.168.1.0 mask 255.255.255.0

[h3c-dhcp-1]gateway-list 192.168.1.1 Distribution Gateways

[h3c-dhcp-1]dns-list 8.8.8.8 Assign dns, please refer to the address provided by the operator.

==================================

1.Configure the firewall packet filtering mode

<h3c>sys Enter system view

[h3c] firewall packet-filter enable

[h3c] firewall packet-filter default permit

2.Configure acl for nat

[h3c]acl number 2000

[h3c-acl-basic-2000]rule permit

[h3c-acl-basic-2000]quit

3.Configure the dialer dialing port

[H3C]dialer-rule 1 ip permit

[H3C]interface dialer 1

[H3C-Dialer1]dialer user username 

[H3C-Dialer1]dialer-group 1

[H3C-Dialer1]dialer bundle 1

[H3C-Dialer1]ip address ppp-negotiate

[H3C-Dialer1]ppp pap local-user username password simple pwd 

[H3C-Dialer1]ppp chap user username 

[H3C-Dialer1]ppp chap password simple pwd 

[H3C-Dialer1]nat outbound 2000

[H3C-Dialer1]quit

4.Bind the dialer to a physical port on the external network.

[H3C] interface Ethernet0/0

[H3C-Ethernet0/0]pppoe-client dial-bundle-number 1

[H3C-Ethernet0/0]nat outbound 2000

[H3C-Ethernet0/0]quit

5.Configure web user and telnet user login

[H3C]local-user admin

[H3C-luser-admin]password simple admin

[H3C-luser-admin]service-type telnet

[H3C-luser-admin]level 3

[H3C-luser-admin]quit

[H3C]user-interface vty 0 4 Implementing telnet

[H3C-ui-vty0-4]authentication-mode scheme

[H3C-ui-vty0-4]quit

6.Configure the ip address of the intranet, please refer to the actual address

[H3C]interface Ethernet0/1 ------------ Configure the internal port address

[H3C-Ethernet0/0]ip address 192.168.1.1 255.255.255.0

7.Configure the security domain and join the ports to the domain

[H3C-zone]firewall zone trust Add trust to the intranet port trust

[H3C-zone-trust]add interface Ethernet0/1

[H3C-zone-trust]quit

[H3C-zone]firewall zone untrust Add untrust to the extranet port untrust

[H3C-zone-untrust]add interface Ethernet0/0

[H3C-zone-untrust]add interface Dialer 1

[H3C-zone-untrust]quit

8.Configure the default route out of the external network

[H3C]ip route-static 0.0.0.0 0.0.0.0 Dialer 1

9.DHCP server configuration (optional)

[H3C]dhcp enable

[H3C]dhcp server forbidden-ip 192.168.1.1 dhcp does not allocate 192.168.1.1 this address, there are other addresses that are not allocated as the same configuration

[H3C]dhcp server ip-pool 1 Create an address pool, assigning the 192.168.1.0 segment address

[H3C-dhcp-1]network 192.168.1.0 mask 255.255.255.0

[H3C-dhcp-1]gateway-list 192.168.1.1 Distribution Gateways

[H3C-dhcp-1]dns-list 8.8.8.8 Assign dns, please refer to the address provided by the operator.

In conclusion, firewalls, as a key network security device, play an important role in protecting network security, controlling network access rights, monitoring network traffic, etc. They are widely used in corporate and personal network environments, and have become an important barrier for maintaining network security.