## 3 The Proposed Firewall on an FPGA  
The schematic of a firewall working principle is presented in Figure 1. Here the firewall is protecting a Local Area Network (LAN), which interconnects several PCs in a limited area from potentially dangerous data packets. The firewall features two different ports: Port A, connected to a router that manages the network traffic between the PCs in the LAN and the internet, and Port B, which transmits/receives the network traffic to/from the internet. Both ports are full duplex; that is, each port can transmit and receive data. When a network packet is received at Port A, the firewall analyzes the packet against a set of rules and, if no potential security threats are detected, it forwards the packet to Port B for transmission, or blocks it otherwise. Each firewall port features its set of rules that can be defined according to a whitelist approach, where only the packets that follow the rules are allowed to pass, or a blacklist approach, where only the packets that follow the rules are blocked. Figure 1: Schematic of the working principle of a firewall. The proposed firewall is designed using the Verilog HDL [42] and is implemented on a Xilinx KC705 development board [43] that integrates the Kintex-7 XC7K325T-2 FFG900C FPGA. The KC705 development board has been selected since it features interfaces for Ethernet communication at both 1 Gb/s and 10 Gb/s, and the on-board FPGA device has a good amount of hardware resources (326,080 logic cells, 840 DSP slices, about 2 MB of SRAM, 16 GTX transceivers and 500 pins) to implement our project. The designed firewall works at a maximum data throughput of 1 Gb/s, but preliminary simulations have shown that its performance can be extended to a higher data throughput of 10 Gb/s. Both ports of the firewall can be configured with a set of 256 rules, defined according to a whitelist or blacklist approach. The set of rules for each port can be defined using ad-hoc software developed in LabVIEW (National Instruments) [44] and uploaded to the FPGA memory using the USB-UART interface. The developed software generates a text file with a set of firewall rules: each rule is 176 characters on one line of the text file and sets a range for the IP source address, the IP destination address, the source and destination ports and the transport layer (i.e., Level 4) protocol. During the firewall initialization, the text file is read and its content is transferred to the FPGA memory using the USB-UART interface. The firewall can analyze packets that belong to the network layer (i.e., Level 3) protocols ARP and IP, and, in the case of the IP protocol, can analyze packets that belong to the transport layer (i.e., Level 4) protocols UDP, TCP and ICMP. It also calculates a set of statistics of the network traffic at both ports. These statistics include the number of packets that are transmitted to the output port, the number of packets that are blocked due to checksum errors, the number of packets that are blocked due to firewall rules violation, the number of packets dropped when the memory is full, the protocol of the received packets and the amount of used memory. Such statistics can be downloaded to a PC using the USB-UART interface for further data analysis. The schematic of the proposed hardware firewall is presented in Figure 2, where the different hardware blocks implemented in the FPGA programmable logic and their interconnections are shown. Only the logic for the analysis of packets received at Port A is shown, for simplicity. In the real system, such logic is also duplicated for the packets received at Port B. The synchronization of the digital circuits is carried out using the 200 MHz LVDS crystal oscillator present on the KC705 development board. The 200 MHz clock is used to generate two different clock signals using the Xilinx IP 'Clock Wizard': a 125 MHz clock used for the circuits devoted to the packets transmission/reception and analysis (CLK_125 MHz), and a 10 MHz clock used for the communication with a PC through the USB-UART interface (CLK_10 MHz).