[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.3.d
AP Cybersecurity · Securing Devices
Configuring a Host-Based Firewall
The one filter that still applies when the network is already compromised.
key ideaA host firewall is the one filter that still applies when the network is already compromised.
Matching controls to threats
Host-based firewalls allow or deny traffic into or out of a single device. That sounds redundant next to a network firewall until you ask what happens when the host is connected to a compromised network — at which point it is the only filter left.
| Property | Network-based firewall | Host-based firewall |
|---|
| what it protects | a network or segment | a single device |
| what it sees | traffic crossing a boundary | traffic into and out of this host |
| on a compromised network | already bypassed | still filtering |
| how it decides | an ACL, first match applied | an ACL, first match applied — identical |
| travels with a laptop | no | yes |
Row 4 is worth stating plainly: a host firewall is software that follows the same kind of rule list as a network firewall, evaluated in order with the first matching rule applied.
four properties
- It provides an extra layer in case a host is connected to a compromised network.
- Rules can allow or deny by source or destination port or IP address, service, protocol, or application.
- It can block outbound traffic too — and should block ports and services not needed for that device.
- Rules are implemented in order, applying the first that matches, exactly as on a network firewall.
Layering
Each layer above the host is blind to something. Only the host firewall sees traffic that never crossed a boundary — which is precisely the traffic lateral movement generates.a workstation's host firewall rulesinbound narrow, outbound restricted, defaults explicit
# dir source/dest service action
1 inbound 10.0.7.0/24 tcp/3389 allow # remote support subnet only
2 inbound ANY ANY deny # nothing else reaches this host
3 outbound ANY tcp/443 allow # normal web traffic
4 outbound ANY tcp/25 deny # a workstation should not send mail
5 outbound ANY ANY deny
rule 1remote support permitted from one subnet, not from anywhererule 2default deny inbound — the host is not a serverrule 4a workstation has no reason to send mail directly; blocking it stops a common malware behaviorrule 5default deny outbound — the half most people omitorderingspecific rules above the broad denies, or they never run
Inbounddeny by default, allow what is needed
Outboundblock ports and services not needed
Orderfirst match applies
Worked analysis
EX 1
Why bother, behind a network firewall?
An administrator argues host firewalls are redundant because the network firewall already filters everything. Evaluate.
1
State what the network firewall filters
Traffic crossing the boundary it sits on.
2
Name what it never sees
Traffic between devices on the same segment.
3
Apply the compromise case
Once a device on the network is compromised, the network firewall is behind the adversary.
4
State what the host firewall adds
It still filters into and out of this device — the CED's stated reason for the extra layer.
5
Add the mobility point
On a laptop it also travels to hotel and café networks, where no network firewall of yours exists at all.
EX 2
Blocking outbound traffic
Why should a workstation's host firewall block outbound tcp/25, and what does that achieve?
1
Ask what port 25 is for
Sending mail directly between mail servers.
2
Ask whether this device needs it
A workstation sends mail through the mail server, not directly.
3
Apply the CED rule
Host firewalls should block ports or services not needed for a given device.
4
State what it stops
Malware on the host sending spam or exfiltrating by mail.
5
Generalize
Enumerate what the device actually needs outbound and deny the rest. Most devices need remarkably little.
EX 3
A rule that never fires
A host firewall has a broad deny inbound ANY at position 1 and a allow tcp/3389 from 10.0.7.0/24 at position 2. Remote support cannot connect. Explain.
1
Recall the evaluation model
Rules are implemented in order, applying the first rule that matches.
2
Trace the packet
The support connection matches the broad deny at position 1.
3
State what happens to rule 2
It is never reached — correct in isolation, inert here.
4
Give the fix
Move the specific allow above the broad deny; no rule text changes.
5
Note the transfer
This is the same precedence behavior as a network firewall — one mental model covers both.
Check yourself
What does a host-based firewall do?
Show answer
It allows or denies traffic into or out of a single device, providing an extra layer of security in case that host is connected to a compromised network.
How does it decide?
Show answer
It is software running on the device that follows an ACL, like a network-based firewall. Rules are implemented in order, applying the first rule that matches.
What should a host firewall block on the outbound side?
Show answer
Ports or services not needed for that device — for instance, a workstation that has no reason to send mail directly.
What can host firewall rules filter on?
Show answer
Source or destination port or IP address, service, protocol, or application — the same criteria as a network-based firewall.