Middleboxes: Firewalls

Introduction

When the TCP/IP architecture and the IP protocol were defined, two types of devices were considered in the network layer:

1. End hosts which are the sources and destinations of IP packets
2. Routers that forward packets. When a router forwards an IP packet, it consults its forwarding table, updates the packet’s TTL, recomputes its checksum and forwards it to the next hop. A router does not need to read or change the contents of the packet’s payload.

However, in today’s Internet, there exist devices called middleboxes that are not strictly routers but which process, sometimes modify, and forward IP packets (RFC 3234). Some middleboxes only operate in the network layer, but most middleboxes are able to analyze the payload of the received packets and extract the transport header, and in some cases the application layer headers.

Over the next couple of lessons, we’ll briefly describe two types of middleboxes: firewalls and network address translation (NAT) devices.