Network Firewalls
1. Concept and Role of a Firewall
A Firewall is a network security system—implemented as dedicated hardware, software, or a combination—that monitors, filters, and controls incoming and outgoing network traffic based on predetermined security policies.
It serves as a protective barrier (electronic perimeter) separating a Trusted Internal Network (corporate LAN or private home network) from an Untrusted External Network (the public Internet).
2. Classification of Firewalls
Firewalls are categorized by the OSI layer at which they inspect traffic:
3. Detailed Firewall Types
A. Packet-Filtering Firewall (Stateless)
- Operates at Layers 3 and 4 (Network & Transport).
- Treats every single packet in isolation, comparing header values against an Access Control List (ACL):
- Source IP Address & Destination IP Address.
- Transport Protocol (TCP, UDP, ICMP).
- Source Port & Destination Port.
- Inbound or Outbound Interface.
- Rules Actions:
ALLOW(forward) orDENY(drop silently or return ICMP unreachable). - Advantages: Wire-speed performance, low resource utilization, transparent to users.
- Disadvantages: Stateless—cannot determine if an inbound packet is a legitimate response to an internal request; vulnerable to IP address spoofing.
B. Stateful Inspection Firewall (Dynamic Packet Filtering)
- Operates at Layers 3 and 4, but maintains a dynamic State Connection Table:
- Monitors full TCP connection lifecycles (tracking SYN, SYN-ACK, ACK, and sequence numbers).
- When an internal host sends an outbound request to a web server, the firewall records the active session:
(Src IP: 192.168.1.5, Src Port: 54102 <-> Dst IP: 93.184.216.34, Dst Port: 443). - Inbound Rule: The firewall automatically allows inbound return packets ONLY if they match an existing active entry in the state table! Unsolicited incoming packets from the outside Internet are blocked instantly.
- Advantages: Superior security over stateless filters; prevents port scans and forged sessions.
C. Application-Level Gateway (Proxy Firewall)
- Operates at Layer 7 (Application Layer).
- Functions as an intermediary Proxy: the external client connects directly to the proxy, and the proxy initiates a separate, independent connection to the destination server.
- Performs Deep Packet Inspection (DPI): examines the actual application payload (HTTP headers, URL strings, SQL syntax, attachment filetypes).
- Advantages: Can detect and block SQL Injections, Cross-Site Scripting (XSS), and data leakage.
- Disadvantages: Computationally intensive; introduces noticeable latency; requires separate proxy software for every supported protocol.
D. Next-Generation Firewall (NGFW)
- Modern enterprise standard integrating:
- Stateful Packet Filtering.
- Integrated Intrusion Prevention System (IPS).
- TLS/SSL Decryption & Inspection (inspecting encrypted HTTPS payloads).
- Application awareness (identifying Skype, BitTorrent, or Zoom regardless of port used).
- Threat intelligence sandboxing against zero-day malware.
4. Firewall Architecture: The Demilitarized Zone (DMZ)
To host public-facing servers (Web, DNS, Mail) without exposing internal corporate databases to the Internet, networks deploy a DMZ Architecture:
- Internet users are granted access strictly to the DMZ servers.
- If a hacker compromises the public web server in the DMZ, the Internal Firewall blocks the attacker from pivoting into the protected internal corporate intranet!
5. Comprehensive Firewall Comparison
| Parameter | Packet-Filtering | Stateful Inspection | Application Proxy |
|---|---|---|---|
| Operating Layer | Layer 3 & 4 (Network/Trans) | Layer 3 & 4 + State | Layer 7 (Application) |
| Connection Tracking | None (Stateless) | Yes (Dynamic state table) | Full connection termination |
| Payload Inspection | No (Headers only) | No (Headers & flags only) | Yes (Deep payload inspection) |
| Processing Speed | Extremely Fast (Wire speed) | Very Fast | Slower (High CPU overhead) |
| Defense Against Spoofing | Poor | Strong | Complete |
| Resource Cost | Minimal memory | Moderate (State memory) | High (Per-connection proxy) |
Frequently Asked Questions
QHow does a Stateful firewall improve upon a Stateless packet filter?
A stateless filter evaluates packets individually based on static header rules. A stateful firewall tracks the entire session lifecycle in a state table, automatically allowing return traffic for legitimate internally initiated connections while rejecting unsolicited external connection attempts.
QWhat is a Demilitarized Zone (DMZ) and why is it used?
A DMZ is an isolated subnetwork positioned between the public Internet and the private intranet that hosts public-facing servers (HTTP, SMTP). It ensures that if a public server is compromised, the attacker cannot directly access the private internal corporate network.
QWhat layer does an Application Proxy firewall operate at?
Layer 7 (Application Layer), allowing it to inspect application commands, URLs, and payloads for malicious patterns like SQL injections.
QWhat extra capabilities does a Next-Generation Firewall (NGFW) provide?
An NGFW combines stateful filtering with an integrated IPS, TLS/SSL decryption and inspection, application awareness regardless of port, and threat-intelligence sandboxing.