Firewall Policies, Proxies, and NAT
Policies
Every policy has From, To, ports/protocols, an action (Allow/Deny), an optional proxy action, logging and comments. Policies evaluate top-down, first match wins - order, not specificity, decides. Aliases (Any-External, Any-Trusted, Any-Optional, Firebox, plus custom host/network groups) keep policies readable, and Any-External automatically covers every external interface.
Packet filters vs proxies
A packet filter permits ports and tracks state. A proxy (HTTP, HTTPS, FTP, SMTP, POP3, DNS, TCP-UDP, SIP) terminates and inspects the session, which is what lets IPS, gateway AV, WebBlocker, Application Control and DLP act on the traffic. HTTPS deep inspection requires the client to trust the Firebox proxy CA certificate, otherwise encrypted content is not inspected.
NAT
- SNAT (dynamic NAT) rewrites the source of outbound traffic to an external interface address.
- 1-to-1 NAT maps a public address or range permanently and bidirectionally onto an internal host - typical for servers.
- Port forwarding / incoming static NAT maps one public port to an internal host and port.
- NAT loopback lets internal users reach a server by its public address.
Traps
A narrow Deny above a broad Allow silently blocks the traffic candidates expect to pass. Assuming NAT creates the policy - it does not; the policy must exist. Forgetting the route or ARP behaviour behind 1-to-1 NAT.
Rule of thumb: read a policy set as a list of exceptions - when blocking a subset, place the narrow Deny above the broad Allow.