Firewall Primer

filtering

Filtering incoming traffic by IP address can minimize a server's exposure to connections from untrusted IP ranges or IPs of computers known to originate or mediate hack attempts. IP filtering can be used to

1. block traffic to and from IP addresses implicated in scans or attack attempts
2. block traffic from groups of IP addresses or entire networks

Figure 6 illustrates a typical scenario in which IP filtering is useful. If a known network is found to harbour malevolent users (sipping espressos and trying to penetrate and exploit systems - maybe yours!) filtering all incoming traffic from the network will deflect the aggression to other systems. After all, a lot of internet security is about making yourself less of a target than the computer next-IP to you. This method works very well if (a) you know exactly on which network(s) these espresso junkies (no flames please - I love espresso) reside, and (b) they are stationary and do not change IP addresses or break into hosts which your firewall does not filter.

Figure 6 | A possible scenario motivating the use of IP filtering. Two remote locations house trusted users, indicated by green hats, and malevolent users, shown by red hats. If you can map the malfeasants to a set of IP addresses, blocking incoming traffic from these IPs will reduce the risk of attack. In this example, the bad guys cannot connect to port 110.