Packet inspection: a firewall reads the packet header of every packet crossing the network boundary to find the source and destination IP addresses, the port numbers, and the protocol in use, such as TCP or UDP.
Content filtering: a next-generation firewall (NGFW) also reads the packet payload, so it can block a request that looks legitimate in its header but carries an attack in its data.
Incoming and outgoing traffic: the same rules apply in both directions, so a firewall can stop an infected machine inside the network from sending data out to an attacker's server.
Note
Firewalls work at different layers of the TCP/IP model.
A traditional firewall filters at the internet and transport layers, using addresses and port numbers.
A next-generation firewall reaches the application layer, so it can tell one kind of web traffic from another.
Whitelists and Blacklists
Whitelists: only approved entities get through, such as a named list of IP addresses or domain names, and everything else is blocked by default.
Blacklists: traffic is allowed by default, and only known malicious or unwanted entities are blocked.
Tip
A whitelist is the tighter of the two, so it suits a critical system where the set of legitimate users is small and known, such as a hospital's patient records server.
A blacklist suits a general-purpose network such as a school's guest WiFi, where you cannot predict every site a user will need.
The weakness of a blacklist is that it can only block a threat that someone has already identified and added to the list.
Firewall Rules
Rule-based filtering: a firewall holds a set of rules that each state a condition and an action, either allow or block.
Attributes: a rule is written in terms of the source and destination IP addresses, the port numbers, and the protocol.
Priority and sequence: rules are processed in order, and the first rule that matches decides what happens to the packet.
Because the first match wins, putting a broad allow rule above a narrow block rule leaves the block rule unreachable.
Example
A school runs a web server that must be reachable from the internet, so the first rule allows incoming TCP traffic to that server on port 443.
A second rule blocks outgoing traffic on port 25, so a compromised classroom PC cannot be used to send spam email.
A final rule blocks everything not matched above, which is what makes the two rules above meaningful.
Strengths and Limitations of Firewalls
Strengths
Access control: traffic that does not match an allow rule never reaches the internal network.
Traffic monitoring and logging: the firewall records what it allowed and blocked, which gives administrators real-time alerts and an audit trail after an incident.
Extra services: modern firewalls can also terminate a VPN and run deep packet inspection (DPI).
Application-level security: an NGFW inspects packets at the application layer, so it can block an attack hidden inside otherwise normal web traffic.
Limitations
Internal threats: a firewall sits at the network boundary, so it does nothing about a malicious insider or an infected laptop already inside.
Sophisticated attacks: an attacker can disguise traffic as a legitimate web request, or exploit a zero-day vulnerability that no rule has been written for yet.
Configuration complexity: a misconfigured rule set either opens a gap an attacker can use or blocks traffic the organisation needs.
Performance impact: deep packet inspection means reading every payload, which adds latency and needs more processing power as traffic grows.
Encrypted traffic: a firewall cannot read the contents of an encrypted connection unless it is set up to decrypt and re-encrypt it, which many organisations avoid on privacy grounds.
Common Mistake
Treating a firewall as complete protection on its own.
A firewall is one layer of a multi-layered security strategy, alongside measures such as intrusion detection systems, patching and user training.
An answer that says only "install a firewall" earns little credit, because it names a measure without saying what it filters or what it fails to stop.
The Role of NAT in Enhancing Security
IP masquerading: NAT lets many devices on a private network share one public IP address, so an outsider cannot see or address an individual internal machine.
Access control: a connection from outside has no NAT table entry to match, so it is dropped unless the administrator has deliberately forwarded that port.
Note
NAT hides internal addresses, but it does not inspect what the traffic contains.
It is a side effect of address sharing rather than a security control, so it supplements a firewall rather than replacing one.
Active recall
Which three packet attributes does a firewall rule use to decide whether to allow or block traffic?
What is the difference between a whitelist and a blacklist in terms of the default action?
Why does the order of firewall rules change which traffic gets through?
Give one type of attack a firewall is unlikely to stop, and say why.
How does NAT make an internal device harder for an outside attacker to reach?
