Firewalls

A firewall is a fundamental component of network security. Acting as a barrier between a trusted internal network and untrusted external networks (such as the internet), a firewall monitors and controls incoming and outgoing network traffic based on predetermined security rules.

This guide provides an overview of how firewalls work, their various types, deployment strategies, and basic configuration principles.

1. What is a Firewall?

To understand a firewall, imagine a secure building with a security guard at the entrance. The guard has a guest list and a set of rules:

• Who is allowed to enter?
• Who is allowed to leave?
• What items are forbidden inside?

In a computer network, the firewall is that security guard. It inspects packets of data (the basic units of data transmitted over a network) and decides whether to allow them to pass through or block them.

Key Terminology

• Packet: A small chunk of data sent over a network. It contains both the actual content (payload) and control information (sender address, receiver address, protocol).
• Port: A virtual slot where network connections start and end (e.g., Port 80 for HTTP web traffic, Port 443 for HTTPS secure web traffic).
• Protocol: A set of rules determining how data is transmitted (e.g., TCP, UDP, ICMP).
• IP Address: A unique address that identifies a device on the internet or a local network.

2. How Firewalls Work

Firewalls analyze network traffic using a set of defined rules. When a data packet arrives at the firewall, it is examined against these rules and handled in one of three ways:

1. Allow (Accept): The packet is permitted to pass through the network.
2. Block (Deny/Drop): The packet is discarded. The sender usually receives no response, making the port appear closed or non-existent.
3. Reject: The packet is blocked, but an error message (like an ICMP "destination unreachable" packet) is sent back to the sender.

3. Types of Firewalls

Firewalls have evolved to counter increasingly sophisticated security threats. They are generally categorized by how they process data and where they are installed.

A. Categorized by Functionality

1. Packet Filtering Firewalls (Stateless)

This is the oldest and most basic type of firewall. It operates at the Network Layer (Layer 3) of the OSI model.

• How it works: It examines each packet individually in isolation. It checks basic information such as source/destination IP address, source/destination port, and protocol.
• Pros: Low resource usage, very fast.
• Cons: Cannot inspect the payload (content) of the packet and does not understand the context of a connection. It is relatively easy to bypass.

2. Stateful Inspection Firewalls

These firewalls monitor the state of active connections. They operate at the Network and Transport Layers (Layers 3 and 4).

• How it works: It records whether a packet is part of an established, ongoing conversation (session). If a user requests a website, the firewall remembers this request. When the website sends data back, the firewall automatically permits it because it matches an active session.
• Pros: Much more secure than stateless filtering; prevents unauthorized incoming traffic while allowing legitimate outgoing responses.
• Cons: Consumes more memory and processing power to maintain state tables.

3. Proxy Firewalls (Application-Level Gateways)

Operating at the Application Layer (Layer 7), proxy firewalls act as an intermediary between two systems.

• How it works: A client connects to the proxy firewall, which evaluates the request. The firewall then establishes a separate connection to the destination server. The client and server never connect directly.
• Pros: Excellent security. It can inspect the actual content of the application data (e.g., checking a webpage for malware or unauthorized file transfers).
• Cons: Can introduce noticeable network latency; difficult to configure for all types of network protocols.

4. Next-Generation Firewalls (NGFW)

Modern firewalls combine traditional firewall capabilities with additional network security features.

• Key Features:
• Stateful inspection.
• Deep Packet Inspection (DPI): Looking at the actual data payload to identify malware or specific applications (e.g., blocking Facebook but allowing Google).
• Intrusion Prevention Systems (IPS) to detect and block active attacks.
• Encrypted traffic inspection (SSL/TLS decryption).
• Pros: Comprehensive security, centralized visibility.
• Cons: Expensive; requires significant processing power and regular updates.

B. Categorized by Deployment Method

4. Understanding Firewall Rules

Firewalls rely on an ordered list of rules (often called an Access Control List or ACL) to decide what to do with traffic.

Structure of a Rule

A typical firewall rule consists of several criteria:

[Action] [Protocol] from [Source IP]:[Source Port] to [Destination IP]:[Destination Port]

• Action: ALLOW, DENY, or REJECT.
• Protocol: TCP, UDP, ICMP, or "Any".
• Source: The IP address or network range where the traffic originates.
• Destination: The IP address or network range where the traffic is headed.
• Port: The specific service port (e.g., port 443 for HTTPS).

Example Rule Table (Simplified)

Important Rule of Thumb: Firewalls process rules from the top down. Once a packet matches a rule, the firewall applies the action and stops checking further down the list.

5. Basic Steps for Configuring a Firewall

While configuration interfaces differ between vendors (such as Cisco, Palo Alto, pfSense, or Windows Firewall), the general methodology remains consistent.

Step 1: Establish a "Default Deny" Policy

The most secure starting point is to block all incoming and outgoing traffic by default. You then write specific rules to allow only authorized traffic. This ensures that any unrecognized or malicious traffic is blocked automatically.

Step 2: Identify Required Access

Determine what services must run.

• Does your company host a website? You will need to open TCP ports 80 and 443.
• Do employees need to access email? You may need to open ports for IMAP (993) or SMTP (587).
• Restrict administrative access (SSH/Port 22 or RDP/Port 3389) only to specific internal IP addresses.

Step 3: Write and Order Rules

Place your most specific rules at the top of the list, followed by more general rules. Keep the "Default Deny" rule at the very bottom.

Step 4: Test and Monitor

Before deploying changes in a production environment, test the rules to ensure they do not accidentally block critical services or leave unintended vulnerabilities open.

6. Firewall Best Practices

• Principle of Least Privilege: Only open ports that are absolutely necessary for business operations.
• Regular Auditing: Periodically review the firewall rule base. Over time, rules created for temporary projects can accumulate and create security gaps.
• Enable Logging: Configure the firewall to log dropped packets and unusual activity. This data is critical for troubleshooting connection issues and investigating potential security incidents.
• Keep Firmware Updated: Hardware and software firewalls run code that can have vulnerabilities. Regularly apply security patches provided by the vendor.
• Use Defense-in-Depth: A firewall is a critical layer of defense, but it should not be the only one. Combine firewalls with antivirus software, endpoint detection, secure passwords, and user awareness training.

The guide was created in June 2026.