Reflections on Host Firewalls

Abstract

In today's Internet, the need for firewalls is generally accepted in the industry, and indeed firewalls are widely deployed in practice. Unlike traditional firewalls that protect network links, host firewalls run in end-user systems. Often the result is that software may be running and potentially consuming resources, but then communication is blocked by a host firewall. It's taken for granted that this end state is either desirable or the best that can be achieved in practice, rather than (for example) an end state where the relevant software is not running or is running in a way that would not result in unwanted communication. In this document, we explore the issues behind these assumptions and provide suggestions on improving the architecture going forward.

Privacy Considerations for IPv6 Adaptation-Layer Mechanisms

“…Many privacy-sensitive devices support a "stealth mode" as discussed in Section 5 of [RFC7288] or are behind a network firewall that will drop unsolicited inbound traffic (e.g., TCP SYNs, ICMP Echo Requests, etc.) and thus no TCP RST or ICMP Echo Reply will be sent.…”

Current Hostname Practice Considered Harmful

“…This amounts to attack-surface reduction and is clearly beneficial --this is an advantage of the stealth mode defined in [RFC7288]. However, there are two issues with this advice.…”

Technical Considerations for Internet Service Blocking and Filtering

“…Support for narrow granularity depends on how the application protocol client and server are designed, however. A typical endpoint-based firewall application may have less ability to make fine-grained decisions than an application that does its own blocking (see [RFC7288] for further discussion).…”