TCP/IP Tutorial and Technical Overview - IBM Redbooks

Service level filtering
Because most services use well-known TCP/UDP port numbers, it is possible to
allow or deny services by using related port information in the filter. For example,
an FTP server listens for connections on TCP port 21, and for a non-passive
mode client, makes outbound data connections from port 20. Therefore, to
permit FTP connections to pass through to a secure network, the router can be
configured to permit packets that contain 20 and 21 as the TCP port in its
header. However, there are some applications, such as NFS, that use RPC and
use different ports for each connection. Allowing these kind of services might
cause security problems.
Source/destination level filtering
The packet-filtering rules allow a router to permit or deny a packet according to
the destination or the source information in the packet header. In most cases, if a
service is available, only that particular server is permitted to outside users.
Other packets that have another destination or no destination information in their
headers are discarded.
Advanced filtering
As mentioned previously (see 22.1.1, “Common attacks against security” on
page 772), there are different types of attacks that threaten the privacy and
network security. Some of them can be discarded by using advanced filtering
rules such as checking IP options, fragment offset, and so on.
Packet-filtering limitations
Packet-filtering rules are sometimes very complex. When there are exceptions to
existing rules, it becomes much more complex. Although there are a few testing
utilities available, it is still possible to leave some holes in the network security.
Packet filters do not provide an absolute protection for a network. For some
cases, it might be necessary to restrict some set of information (for example, a
command) from passing through to the internal secure network. It is not possible
to control the data with packet filters because they are not capable of
understanding the contents of a particular service. For this purpose, an
application-level control is required.
Application-level gateway (proxy)
An application-level gateway is often referred to as a proxy. An application-level
gateway provides higher-level control on the traffic between two networks in that
the contents of a particular service can be monitored and filtered according to the
798 TCP/IP Tutorial and Technical Overview