Network Firewalls

1. Concept and Role of a Firewall

A Firewall is a network security system—implemented as dedicated hardware, software, or a combination—that monitors, filters, and controls incoming and outgoing network traffic based on predetermined security policies.

It serves as a protective barrier (electronic perimeter) separating a Trusted Internal Network (corporate LAN or private home network) from an Untrusted External Network (the public Internet).

  UNTRUSTED INTERNET                                           TRUSTED PRIVATE LAN
 [ Threat Actors ] ────\                                   /──── [ Host Workstations ]
 [ Web Traffic   ] ─────+====> [ FIREWALL DEVICE ] =======+───── [ File Servers      ]
 [ Port Scans    ] ────/       Security Rule Inspection    \──── [ Active Directory   ]
                               (Pass / Drop / Reject)

2. Classification of Firewalls

Firewalls are categorized by the OSI layer at which they inspect traffic:

                            TYPES OF FIREWALLS
                                    |
         +--------------------------+--------------------------+
         |                          |                          |
  PACKET FILTERING          STATEFUL INSPECTION         APPLICATION PROXY
  (Stateless: L3 & L4)      (Dynamic State: L3 & L4)    (Deep Payload: Layer 7)

A. Packet-Filtering Firewall (Stateless)

Operates at Layers 3 and 4 (Network & Transport).
Treats every single packet in isolation, comparing header values against an Access Control List (ACL):
- Source IP Address & Destination IP Address.
- Transport Protocol (TCP, UDP, ICMP).
- Source Port & Destination Port.
- Inbound or Outbound Interface.
Rules Actions: ALLOW (forward) or DENY (drop silently or return ICMP unreachable).
Advantages: Wire-speed performance, low resource utilization, transparent to users.
Disadvantages: Stateless—cannot determine if an inbound packet is a legitimate response to an internal request; vulnerable to IP address spoofing.

B. Stateful Inspection Firewall (Dynamic Packet Filtering)

Operates at Layers 3 and 4, but maintains a dynamic State Connection Table:
Monitors full TCP connection lifecycles (tracking SYN, SYN-ACK, ACK, and sequence numbers).
When an internal host sends an outbound request to a web server, the firewall records the active session: (Src IP: 192.168.1.5, Src Port: 54102 <-> Dst IP: 93.184.216.34, Dst Port: 443).
Inbound Rule: The firewall automatically allows inbound return packets ONLY if they match an existing active entry in the state table! Unsolicited incoming packets from the outside Internet are blocked instantly.
Advantages: Superior security over stateless filters; prevents port scans and forged sessions.

C. Application-Level Gateway (Proxy Firewall)

Operates at Layer 7 (Application Layer).
Functions as an intermediary Proxy: the external client connects directly to the proxy, and the proxy initiates a separate, independent connection to the destination server.
Performs Deep Packet Inspection (DPI): examines the actual application payload (HTTP headers, URL strings, SQL syntax, attachment filetypes).
Advantages: Can detect and block SQL Injections, Cross-Site Scripting (XSS), and data leakage.
Disadvantages: Computationally intensive; introduces noticeable latency; requires separate proxy software for every supported protocol.

D. Next-Generation Firewall (NGFW)

Modern enterprise standard integrating:
1. Stateful Packet Filtering.
2. Integrated Intrusion Prevention System (IPS).
3. TLS/SSL Decryption & Inspection (inspecting encrypted HTTPS payloads).
4. Application awareness (identifying Skype, BitTorrent, or Zoom regardless of port used).
5. Threat intelligence sandboxing against zero-day malware.

3. Firewall Architecture: The Demilitarized Zone (DMZ)

To host public-facing servers (Web, DNS, Mail) without exposing internal corporate databases to the Internet, networks deploy a DMZ Architecture:

                         [ UNTRUSTED INTERNET ]
                                   |
                          [ External Firewall ]
                               /        \
                              /          \
     +-----------------------+            +-----------------------+
     |  DEMILITARIZED ZONE   |            |  INTERNAL ENTERPRISE  |
     |  (DMZ Subnet)         |            |  (Protected Intranet) |
     |  - Web Server (HTTP)  |            |  - Database Servers   |
     |  - Mail Server (SMTP) |            |  - HR Workstations    |
     |  - DNS Server         |            |  - Financial Records  |
     +-----------------------+            +-----------------------+
                                                     |
                                            [ Internal Firewall ]

Internet users are granted access strictly to the DMZ servers.
If a hacker compromises the public web server in the DMZ, the Internal Firewall blocks the attacker from pivoting into the protected internal corporate intranet!

4. Comprehensive Firewall Comparison

Parameter	Packet-Filtering	Stateful Inspection	Application Proxy
Operating Layer	Layer 3 & 4 (Network/Trans)	Layer 3 & 4 + State	Layer 7 (Application)
Connection Tracking	None (Stateless)	Yes (Dynamic state table)	Full connection termination
Payload Inspection	No (Headers only)	No (Headers & flags only)	Yes (Deep payload inspection)
Processing Speed	Extremely Fast (Wire speed)	Very Fast	Slower (High CPU overhead)
Defense Against Spoofing	Poor	Strong	Complete
Resource Cost	Minimal memory	Moderate (State memory)	High (Per-connection proxy)

5. Key Exam Questions & Takeaways

How does a Stateful firewall improve upon a Stateless packet filter?
- A stateless filter evaluates packets individually based on static header rules. A stateful firewall tracks the entire session lifecycle in a state table, automatically allowing return traffic for legitimate internally initiated connections while rejecting unsolicited external connection attempts.
What is a Demilitarized Zone (DMZ) and why is it used?
- A DMZ is an isolated subnetwork positioned between the public Internet and the private intranet that hosts public-facing servers (HTTP, SMTP). It ensures that if a public server is compromised, the attacker cannot directly access the private internal corporate network.
What layer does an Application Proxy firewall operate at?
- Layer 7 (Application Layer), allowing it to inspect application commands, URLs, and payloads for malicious patterns like SQL injections.

Firewalls