Short Notes on Firewall

Definition. A firewall is a combination of hardware and software placed between a trusted internal network and an untrusted network (usually the Internet) that enforces an access-control policy: it examines every entering and leaving packet against a rule set and permits, drops or rejects it accordingly. Its goals are to keep intruders out, limit which services are reachable from outside, and stop internal hosts from contacting dangerous destinations. It does not replace authentication, antivirus or user awareness.

Types (classified by the layer at which they filter)

1. Packet-filtering firewall (Layers 3/4). Filters each packet individually using a rule list (ACL) built on the 5-tuple: source IP, destination IP, protocol (TCP/UDP/ICMP), source port and destination port. It is cheap, fast, transparent to applications and needs no host configuration. But it is stateless — it cannot tell whether an inbound ACK belongs to a connection this host actually started — it cannot inspect payloads, and a large rule set quickly becomes inconsistent and error-prone.
2. Stateful-inspection firewall (Layers 3-5). Maintains a state table of live connections, e.g. 192.168.1.10:49152 -> 142.250.x.x:443 ESTABLISHED. Inbound packets are accepted only if they belong to an existing session or are genuine new connection requests. This blocks spoofed, random inbound packets that a loose stateless rule would let through.
3. Circuit-level gateway / proxy (Layer 5). Validates the session (TCP handshake, SOCKS) between internal and external hosts without examining each packet; simple but gives no content control.
4. Application-layer firewall / proxy (Layer 7). Understands specific protocols (HTTP, FTP, SMTP, DNS), so it can filter URLs and keywords, block file types, log individual user actions and reject malformed requests. It is the most thorough but adds latency and needs a proxy for every service. Next-generation firewalls (NGFW) add intrusion-prevention, application identification and user/packet deep inspection.

Other important ideas

• DMZ (demilitarised zone): a screened subnet between two firewall interfaces holding the public servers (web, mail, FTP). Even if a DMZ server is compromised, the internal network stays isolated.
• Default-deny policy: inbound traffic is denied unless explicitly allowed (only ports such as 80/443/25 open) — the safe default; default-allow is the opposite and is dangerous.
• Bastion host: the most exposed, heavily hardened system in the DMZ.
• Egress filtering restricts outbound traffic too, which limits data exfiltration and blocked-malware callbacks.

Limitations

A firewall cannot stop attacks arriving over an allowed channel (malware inside HTTPS, phishing), cannot see content of encrypted traffic unless it terminates TLS, does nothing against insider users or guests on the Wi-Fi, and cannot protect links (modem/remote access) that bypass it.