Workshop

application—for instance, passive FTP, where only the requesting workstation makes connections. Most
browsers default to passive FTP, but not all standalone FTP clients do.
There’s usually no logging or accounting on a packet-filtering firewall, although most firewalls will
record errors. Here, troubleshooting is very similar to router troubleshooting, with ping, traceroute, and
lists of the routing tables and rule sets being your best friends. As with routing problems, symptoms of
packet-filtering firewall problems include the inability to reach a host on the other side; unlike a router,
though, the symptom of a packet-filtering firewall problem might be the inability to reach a service on
the other side.
Packet Filter Improvements
Newer firewalls that don’t care whether they’re good routers—that are more interested in being bang-up
firewalls—will do all sorts of new tricks. Some of them will perform network address translations
(NATs), which enable you to tell the outside world that you’re a different address than you really are.
This means that if you change Internet Service Providers, you don’t have to change your IP numbers,
which is nifty. (It used to be that only proxy servers were good for this, because they use two different
routing domains anyway, but the firewall vendors have caught up.)
Stateful Multi-Level Inspection is a really neat technology, too. It allows UDP sockets in on a contextual
basis—that is, it reads your note to Jenny and then accepts a note back from Jenny only if it seems as
though the contents of that note are relevant to what you sent. This requires a very specialized firewall
and is very application specific. If the firewall doesn’t “know” Jenny, it can’t determine whether the note
she sent back to you is real. These firewalls typically come preconfigured with rules for common
applications such as Telnet, email, FTP, and so on. If you’re having problems using an unusual
application through an SMLI firewall, check with the firewall vendor to see how to get support.
Proxy Moxie
Let’s dig a little deeper into the theory behind a proxy server. Think of the proxy server as a receptionist
for a spy organization that has two sets of phones: the internal organization telephone (the “red phone”)
and the outside world’s phone system. The outside phone system is not directly usable by any of the
other agents in the spy agency; they must give a message to the receptionist, who will order out for pizza,
arrange for third-party hit men, and so on. The spy organization has it this way so that its circuits are not
directly connected to the public telephone network—and a good thing, too! It doesn’t mean the
receptionist is incorruptible, but at least he’s within the organization, fairly trustable, very accountable
for his actions, and, of course, easily monitored, because he’s the only point of communication between
the organization and the outside world.
The important thing to remember is that there are two different types of phone calls, because the