A Topological Calculus for Firewalls

Firewalls are rule based filters, composed of a sequence of rule. Each rule has a condition and an action. The condition is made up of network fields that can be seen as points in a topological space. Thus, firewall rule conditions can be seen as regions within a topological space. In this paper, we propose a topological calculus and exhaustively analyze all possible configurations to identify the topological relationships that can exist between a pair of firewall rules. Anomalies are properties of firewalls that hint at possible misconfigurations within the firewall. Anomalies including all those that are identified in literature are definable within the calculus.