Firewall

A firewall is a security system that monitors and controls network traffic entering or leaving a computer, device, or network. It checks network traffic based on predefined security rules and decides whether the traffic should be allowed or blocked.

For example, when you connect your computer to the internet, many devices and systems may try to communicate with it. A firewall acts like a security guard between your device and the network. It checks incoming and outgoing traffic and blocks traffic that does not meet the configured rules.

Real world example

Imagine you are entering an office building. At the entrance, a security guard checks everyone before allowing them inside. Employees with valid access are allowed to enter, while unknown or unauthorized people are stopped.

A firewall works in a similar way for a network. The Internet is like the outside world, the firewall is the security guard, and the computers inside the office are the employees.

For example, when an employee tries to access a website, the firewall checks the network traffic and allows it if it follows the security rules. If an attacker tries to connect to an unauthorized service or port, the firewall can block the connection.

How a firewall examines network traffic

When network traffic reaches a firewall, the firewall first examines information about the traffic, such as the source IP address, destination IP address, port number, protocol, and connection state. It then compares this information with its configured security rules.

1. Packet Inspection
   The firewall examines network packets to understand where they came from, where they are going, and what protocol they use.
2. Rule Matching
   The firewall compares the traffic against its configured rules. Rules can specify things such as IP addresses,ports,protocols,and connection states.

Work flow

1. State Tracking
   A stateful firewall keeps track of active connections. For example, after allowing a legitimate TCP connection to be established, it can recognize packets belonging to that existing connection.
2. Logging and Monitoring
   Firewalls can record allowed and blocked traffic. Administrators can use these logs to investigate suspicious activity and troubleshoot network problems.
3. A device sends or receives network traffic. For example, you open a website in your browser.
4. Before the traffic reaches its destination, the firewall examines it. Depending on the network design, this could be a network firewall, host firewall, or firewall built into a router/security appliance.
5. The firewall can inspect information such as the source IP address, destination IP address, port, protocol, and connection state.
6. The firewall compares the traffic with its configured security rules. For example, a rule might allow HTTPS traffic while blocking connections from a particular IP address.
7. If the traffic matches an allow rule, it is allows it. If it matches a deny/block rule, it is rejected or dropped.
8. If its allow, the traffic continues to the destination server or device.

Types Of Firewall

Packet-Filtering Firewall

A Packet-Filtering Firewall is a basic type of firewall that checks network packets and decides whether to allow or block them based on predefined rules.

When a packet reaches the firewall, it examines information in the packet’s header, such as the source IP address, destination IP address, source/destination port, and protocol. It then compares this information with its rules.

Features

1. Fast Processing:- Checks basic packet information, so filtering can be relatively fast.
2. Low Resource Usage:- Generally requires fewer resources than more advanced firewall types.

Stateful Firewall

A Stateful Firewall is a firewall that monitors network traffic while also keeping track of active connections. Unlike a basic packet-filtering firewall, it does not look at each packet completely independently. It remembers the state of connections and uses that information when making decisions.

For example, when you open a website, your computer establishes a connection with the web server. The stateful firewall records information about that connection, such as the source and destination IP addresses, ports, protocol, and connection state. When packets belonging to that established connection return, the firewall can recognize them and allow them according to its rules.

Features

1. Connection Tracking:- Keeps track of active network connections.
2. State Table:- Maintains information about connections, such as source IP, destination IP, ports, protocol, and connection state.
3. TCP State Tracking:- Tracks the state of TCP connections, such as connection establishment and termination.
4. Protection Against Unsolicited Connections:- Can block unexpected traffic that does not belong to an existing or permitted connection.

Application-Level Firewall

An Application-Level Firewall is a firewall that examines network traffic at the application layer. Instead of only checking basic information such as IP addresses and ports, it can inspect the actual content and behavior of application-level communication.

For example, a basic firewall may see that a connection is using HTTPS on port 443. An application-level firewall can inspect the HTTP/HTTPS communication more deeply, depending on the protocol, configuration, and whether encrypted traffic can be inspected.

Features

1. Application-specific rules:- Allows administrators to create rules for specific applications or services.
2. Protocol awareness:- Understands application protocols such as HTTP, FTP, SMTP, and DNS, depending on the firewall.
3. Threat detection:- Can identify traffic patterns that match configured malicious or suspicious behavior.

Next-Generation Firewall (NGFW)

A Next-Generation Firewall (NGFW) is an advanced firewall that provides traditional firewall functions along with additional security features. Unlike a basic firewall that mainly checks IP addresses, ports, and protocols, an NGFW can inspect traffic more deeply and identify applications, users, and potential threats.

Get Tejmit’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

For example, a traditional firewall might allow traffic through port 443 (HTTPS). An NGFW can go further and analyze the traffic to identify the application or detect suspicious activity, depending on its configuration and capabilities.

Features

1. Traditional Firewall Filtering:- It can filter traffic based on IP addresses, ports, and protocols.

2. Application Awareness:- It can identify applications and apply different rules to different types of traffic.

3. Deep Packet Inspection:- It can inspect more information within network traffic, depending on the protocol and encryption.

4. Intrusion Prevention (IPS):- Many NGFWs include or integrate with IPS capabilities to detect and block known attack patterns.

5. User-Based Policies:- Some NGFWs can associate network activity with authenticated users and apply policies accordingly.

6. Threat Detection:- NGFWs can integrate threat intelligence and other security technologies to detect suspicious traffic.

Web Application Firewall (WAF)

A Web Application Firewall (WAF) is a security system designed to protect web applications from malicious HTTP/HTTPS traffic. It sits between users and a web application and examines web requests before they reach the application.

For example, when you open a website, your request may pass through a WAF first. The WAF checks the request against security rules. If the request appears legitimate, it forwards it to the web application. If it matches a configured attack pattern or security rule, the WAF can block it.

Features

1. HTTP/HTTPS Inspection:- Inspects web requests and responses.
2. SQL Injection Protection:- Helps detect and block SQL injection patterns.
3. XSS Protection:- Helps detect and block malicious cross-site scripting payloads.
4. Request Filtering:- Allows or blocks requests based on configured security rules.
5. IP Filtering:- Can allow, block, or restrict traffic based on IP addresses.
6. Rate Limiting:- Limits how many requests a client can send within a specific period.
7. Bot Protection:- Helps identify and control unwanted automated traffic.
8. Custom Rules:- Administrators can create rules for specific application requirements.
9. Access Control:- Can restrict access to certain URLs, methods, or resources.
10. Logging and Monitoring:- Records requests, blocked traffic, and security events.
11. Virtual Patching:- Can temporarily protect vulnerable applications by blocking known attack patterns while the underlying application is being fixed.
12. Threat Detection:- Helps identify suspicious or malicious web traffic.
13. HTTPS/TLS Support:- Can inspect encrypted web traffic when TLS termination/decryption is configured appropriately.

Host-Based Firewall

A Host-Based Firewall is a firewall that is installed and runs directly on an individual device, such as a computer, laptop, or server. It monitors and controls network traffic entering and leaving that specific device based on predefined security rules.

Unlike a network-based firewall, which protects many devices on a network, a host-based firewall protects one particular host/device.

Features

1. Port Filtering:- Can allow or block traffic based on network ports such as 80 (HTTP), 443 (HTTPS), and 22 (SSH).
2. IP Address Filtering:- Can allow or block traffic from specific IP addresses.
3. Endpoint Protection:- Protects the individual computer, laptop, or server even when it is connected to an untrusted network.

Network-Based Firewall

A Network-Based Firewall is a firewall that is placed at the network boundary to monitor and control traffic moving between different networks.

For example, it can protect an organization’s internal network from traffic coming from the internet. Instead of installing one firewall to protect the entire network on every device, the company can place a network-based firewall between the internet and the internal network. If an attacker tries to connect to an unauthorized service, the firewall can block the connection before it reaches the internal systems.

Features

1. Network Segmentation:- Can help separate different parts of a network and control communication between them.
2. NAT Support:- Many network firewalls support Network Address Translation (NAT) to translate private and public IP addresses.
3. VPN Support:- Can provide or manage secure VPN connections for remote users or connected networks.
4. High Availability:- Enterprise firewalls may support redundant firewall systems so protection can continue if one firewall fails.