Çfarë është një Firewall?

A firewall is a network device (or software) that filters traffic between two or more networks based on a configured policy.

Firewalls inspect each packet against a ruleset that references source/destination IP, port and protocol. Stateful firewalls additionally track the state of each connection (new, established, related) so they can allow reply packets only if they belong to a known session. Next-generation firewalls (NGFW) go further: they inspect Layer 7 application data, perform TLS inspection, and enforce identity-based policies tied to a directory service. A minimum secure deployment has at least three zones: untrusted (internet), DMZ (public-facing servers) and trusted (internal users). Traffic is never allowed directly from untrusted to trusted; it must first pass through the DMZ. This architecture limits the blast radius of a compromise on any one server, because an attacker who gains a shell on a DMZ host still faces another firewall between them and the internal network. Common open-source firewalls include pfSense, OPNsense and plain Linux iptables/nftables. Commercial options include Palo Alto, Fortinet FortiGate, Cisco ASA and Check Point. For a student lab, pfSense on a small x86 box is the best value for hands-on learning.

Mjetet kryesore për firewalls:

• iptables / nftables — firewalls klasikë në Linux kernel.
• ufw — Uncomplicated Firewall për Ubuntu/Debian.
• firewalld — daemon për Red Hat/Fedora/CentOS.
• pfSense / OPNsense — firewalls të plotë me GUI për lab/produksion.
• Palo Alto, FortiGate, Cisco ASA — NGFW komercialë.

Shembull rregulli iptables që lejon vetëm SSH nga një subnet i brendshëm dhe bllokon pjesën tjetër:

iptables -P INPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -s 10.0.0.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

Ekuivalenti me ufw:

ufw default deny incoming
ufw default allow outgoing
ufw allow from 10.0.0.0/24 to any port 22 proto tcp
ufw allow 443/tcp
ufw enable

1. Në një VM laboratorike, konfiguro ufw që të lejojë vetëm HTTPS dhe SSH nga rrjeti yt lokal. Verifiko me nmap nga një host tjetër.
2. Krijo tre zona: internet (untrusted), DMZ, LAN (trusted). Vizato diagramin e flukseve të lejuara.
3. Krahaso output-in e iptables -L -v -n para dhe pas shtimit të një rregulli.

• netfilter.org — dokumentimi zyrtar i iptables/nftables
• pfSense Docs
• NIST SP 800-41 Rev.1 — Guidelines on Firewalls and Firewall Policy.