Firewall Design Rules; Firewall Logic - Motorola 2200 Administrator's Handbook

UDP: User Datagram Protocol. Unlike TCP, UDP does not guarantee reliable, sequenced packet delivery. If
data does not reach its destination, UDP does not retransmit the data. RFC 768 is the specification for
UDP.
There are many more ports defined in the Assigned Addresses RFC. The table that follows shows some of
these port assignments.
Example TCP/UDP Ports
20/21
23
25
80
144

Firewall design rules

There are two basic rules to firewall design:
•
"What is not explicitly allowed is denied."
and
•
"What is not explicitly denied is allowed."
The first rule is far more secure, and is the best approach to firewall design. It is far easier (and more
secure) to allow in or out only certain services and deny anything else. If the other rule is used, you would
have to figure out everything that you want to disallow, now and in the future.

Firewall Logic

Firewall design is a test of logic, and filter rule ordering is critical. If a packet is forwarded through a series
of filter rules and then the packet matches a rule, the appropriate action is taken. The packet will not for-
ward through the remainder of the filter rules.
For example, if you had the following filter set...
Allow WWW access;
Allow FTP access;
Allow SMTP access;
Deny all other packets.
and a packet goes through these rules destined for FTP, the packet would forward through the first rule
(WWW), go through the second rule (FTP), and match this rule; the packet is allowed through.
If you had this filter set for example....
Allow WWW access;
TCP Port Service
FTP
Telnet
SMTP
WWW
News
UDP Port Service
161 SNMP
69 TFTP
159