Firewall protocols

TCP

TCP is a connection-oriented, reliable transport protocol. It guarantees that the data contained in network packets are delivered reliably, and in order. It also controls the rate at which data is received and transmitted. This control requires a certain amount of overhead, and makes the timing of TCP operations unpredictable when network conditions are suboptimal.

TCP is the transport layer for most application protocols. HTTP, FTP, SMTP, RDP, SSH, POP, and IMAP all use TCP.

TCP multiplexes between application-layer protocols using the concept of “ports.” Each TCP packet contains a source and destination port number, from 0–65535. Usually, the server end of a TCP connection listens for connections on a fixed port.

Ports 0–1023 are reserved as “well-known ports.” The IANA assigns numbers in this range to protocols. Most operating systems require a process to have special permissions to listen on one of these ports.

Firewall rules are constructed to block certain ports and allow others, limiting the activities that can occur on the network.

UDP

User Datagram Protocol is a connectionless best-effort transport protocol. It makes no guarantees about reliability or packet order, and lacks flow control features. In practice, it has some desirable properties for certain classes of traffic.

UDP is often used as a transport protocol for performance-critical applications. It is also used in real-time multi-media applications. A dropped packet causes only a momentary glitch in the datastream and is more acceptable than a stream that stops to wait for retransmission. IP telephony and videoconferencing software often uses UDP, as do some multi-player video games.

The UDP multiplexing scheme is identical to that of TCP: each datagram has a source and destination port, ranging from 0–65535.

ICMP

Internet Control Message Protocol, version 4 (ICMPv4) and version 6 (ICMPv6), is used as an out-of-band communication channel between IP hosts. It is useful in troubleshooting, and needed for the proper function of an IP network, because it is the error reporting mechanism.

IPv4 and IPv6 have separate, unrelated ICMP protocol variants. ICMPv4 is often called simply ICMP.

ICMPv6 is important in an IPv6 network. It is used for several critical tasks, such as neighbor discovery (which ARP handles in an IPv4 network). Users are discouraged from blocking ICMPv6 traffic if IPv6 is supported on their network.

Instead of port numbers, both versions of ICMP define message types. Echo Request and Echo Reply are used for ping. Destination Unreachable messages indicate routing failures. ICMP also implements a Traceroute facility, though UDP and TCP can also be used for this purpose.

Other transport protocols

IP supports over a hundred other transport protocols, but most are rarely used. The complete list of IANA-recognized protocols is at least minimally supported. Rules can be created to block or allow traffic over all IP transport protocols. But, the firewall doesn't support any multiplexing mechanism that these protocols might use.

Several are used to overlay other types of networks on top of an IP network (network tunneling). Some of these protocols (notably GRE, AH, and ESP) are used for IP encryption and VPNs.

See Protocol numbers for the IP protocol numbers.