The firewall family: how each telecom firewall works

A telecom operator runs many different "firewalls", each tuned to one protocol or one threat. This module explains what each one inspects, where it sits, what rules it uses, and how it is operated — so that, together with Module 25 (the attacks), you can connect every attack to the control that stops it.

1. The big map

                         INTERNET / IT                      OTHER OPERATORS (interconnect)
                        ┌────────────┐                  ┌───────────────────────────────────┐
  Customers ── RAN ──▶  │ NGFW / WAF │                  │  SS7/SIGTRAN FW  Diameter FW (DEA) │
  (user plane)          │ DDoS / DNS │                  │  GTP FW    SBC/IBCF   SEPP (5G)    │
                        └────────────┘                  │  SMS FW (P2P+A2P)  Voice FW        │
                                                         └───────────────────────────────────┘
        inside:  SecGW (IPsec) on backhaul · segmentation of OAM / control / user plane
                 · SIEM/SOC · FMS (fraud) · PKI/HSM

2. The SS7 / SIGTRAN firewall in detail

2.1 Where it sits (deployment models)

2.2 Screening layers (from low to high)

1. MTP3 — OPC/DPC allow-lists; drop unknown point codes.
2. SCCP — Called/Calling party GT analysis (country code, number range ↔ operator), SSN, GT translation consistency.
3. TCAP — Dialogue/application context, transaction IDs, malformed packets.
4. MAP/CAP/ISUP — Operation code, parameters (IMSI, MSISDN, VLR/MSC GT, SM-RP-OA), error handling.

2.3 The GSMA categories (FS.11)

2.4 Example logic (pseudo-rules — conceptual)

RULE ATI_from_external
  IF opcode == AnyTimeInterrogation AND source_network != HOME
  THEN BLOCK, ALERT(severity=high)

RULE UL_consistency   (Category 2/3)
  IF opcode == UpdateLocation AND imsi.home == OURS
     AND source_GT NOT IN roaming_partners(imsi_country_of_last_attach)
  THEN BLOCK
  IF opcode == UpdateLocation AND travel_time(last_vlr, claimed_vlr) < physical_minimum
  THEN BLOCK, ALERT("impossible travel")

RULE SRI_SM_reconnaissance (Category 3)
  IF opcode == SRI_SM AND count(source_GT, 60s) > T1
     AND ratio(forwardSM_after_sri) < 0.2
  THEN THROTTLE or RETURN home-routing answer, ALERT

RULE MT_SMS_correlation (Category 2)
  IF opcode == MT_ForwardSM AND NOT exists(SRI_SM from same GT for same IMSI in last N sec)
  THEN BLOCK   # MT SMS without prior routing request = spoofing

Note the logic is stateful: the firewall remembers recent traffic per subscriber (location history, outstanding SRI-SM, etc.).

2.5 SMS home routing (the key defensive trick)

1. External SMSC sends SRI-SM for the subscriber.
2. The firewall/home-routing node answers with its own SMSC GT as "serving MSC" and a temporary/fake IMSI (a correlation ID).
3. The external SMSC delivers the message to the home network's SMS router.
4. The home network checks it (spoof, spam, content) and then delivers it through the real MSC/IMSI internally. Result: the outside world never learns the real IMSI or serving MSC, so subscriber discovery and location tracking via SMS routing fail.

2.6 Operating the firewall (lifecycle)

3. The Diameter firewall (DEA / DRA with security)

• Topology hiding: the outside sees only the DEA's identity, not your MME/HSS hostnames and realms.
• Message filtering: allowed commands per direction and per partner (e.g. an inbound partner may send AIR/ULR for its roamers but never CLR/IDR/PLR to your home subscribers unless they originate from your HSS).
• Identity checks: Origin-Host/Realm vs. source IP and the TLS certificate; IMSI MCC/MNC vs. realm.
• Stateful correlation: requests answered once, answers matching an earlier request, S6a session lifetime.
• Rate and volume controls: per IMSI, per realm, per command; AIR vector limits.
• Interworking filter: if Diameter is converted to MAP (IWF), apply SS7 rules after conversion.
• Transport security: TLS/DTLS or IPsec between peers when partners support it.
• Overload: DOIC (Diameter Overload Indication Conveyance) and throttling.

4. The GTP firewall

5. SMS firewalls (P2P and A2P) in depth

6. Voice and SIP security

7. 5G: SEPP, SCP, NRF, NEF

8. Perimeter and IT-side controls (what telecom shares with every company)

9. Defence in depth for a telecom operator

10. Choosing the firewall — a decision table

11. Common mistakes and limits

• Only one protocol protected — attackers switch from SS7 to Diameter or to IWF routes. FS.21 insists on a consistent policy across all.
• Firewall in monitor mode forever — alerts nobody reads.
• Fail-open without alarms — silent bypass.
• Whitelisting too wide (every partner trusted for everything).
• Ignoring the radio side — SMS blasters / IMSI catchers never touch the firewall.
• No correlation with subscriber state — rules that look only at syntax.
• Not testing after changes — new GT for HLR breaks home routing.
• Forgetting 2G/3G — legacy fallback paths remain.
• Treating firewalls as the whole solution — they reduce risk; authentication design (no SMS-only 2FA) and customer education complete it.

Remember this: each firewall answers the same four questions for its own protocol — Who is the sender? Is this message allowed from outside at all? Does it fit this subscriber's real state? Is the volume normal? Different protocol, same logic.