Ethical Hacking Firewalls and IDS
Firewalls and intrusion detection systems guard networks from unwanted traffic. Ethical hackers must understand them for two reasons. Testers learn what defenses block their work, and clients need advice on stronger setups. Good defense knowledge makes a better tester.
What a Firewall Does
A firewall is a gatekeeper between networks. It checks each packet against a list of rules and allows or blocks it. A building security desk works the same way: the guard checks every visitor against an approved list.
[Internet] ---> [ FIREWALL ] ---> [Company Network]
| |
allowed blocked
Firewall Types
| Type | How It Works |
|---|---|
| Packet filter | Checks addresses and ports only |
| Stateful | Tracks full conversations and allows replies to approved requests |
| Application (proxy) | Reads the content of requests for specific apps |
| Next-generation | Combines filtering, app awareness, and threat detection |
| Web application firewall | Protects websites from harmful requests |
Writing Good Firewall Rules
Rules run from top to bottom, and the first match wins. A strong policy follows the "deny by default" idea: block everything and allow only what the business needs.
1. ALLOW any -> web server port 443 2. ALLOW office -> mail server port 587 3. ALLOW admin PC -> servers port 22 4. DENY everything else
What an IDS Does
An intrusion detection system watches traffic or computer activity and raises alerts when it spots suspicious behavior. A security camera records and warns, but it does not lock the door. An intrusion prevention system, or IPS, goes a step further and blocks the threat on its own.
IDS vs IPS
| Point | IDS | IPS |
|---|---|---|
| Action | Alerts only | Alerts and blocks |
| Position | Beside the traffic path | Directly in the path |
| Risk | Misses fast attacks without human response | Blocks real users if it makes a mistake |
Detection Methods
Signature-Based
The system compares traffic with a database of known attack patterns. Detection is fast and accurate for known threats, and it misses new ones.
Anomaly-Based
The system learns normal behavior and flags anything unusual. A user who logs in from two countries within one hour triggers an alert. This method catches new attacks and produces more false alarms.
Network and Host Systems
A network IDS, such as Snort or Suricata, watches traffic across a network segment. A host IDS runs on a single computer and watches files, logins, and processes. Large organizations use both.
How Testers Work with Defenses
Testers first learn which controls exist. Scans that trigger alerts show whether the security team notices them. A report that says "the IDS detected our scan within two minutes" counts as a positive finding. A report that says "nothing alerted during a full week of testing" signals a monitoring gap.
Common Defense Mistakes
- Leaving old "allow any" rules in place for years.
- Skipping log reviews, so alerts sit unread.
- Setting alert thresholds so low that staff ignore them.
- Failing to update signature databases.
- Placing every system in one flat network with no internal firewalls.
Best Practices
- Segment the network into zones, such as guests, staff, and servers.
- Review firewall rules every quarter and remove unused ones.
- Send logs to a central system for analysis.
- Tune alerts to cut false alarms.
- Test defenses regularly with approved exercises.