🧱 Network-Based Firewalls
The gatekeepers that enforce access control between networks⏱ ~2 min
At an international border, customs agents check who is entering and what they're carrying, applying rules to allow, deny, or inspect travelers. A network firewall does the same for packets: checking source, destination, protocol, and port against a ruleset, then allowing or blocking accordingly. A network-based firewall sits inline between network segments and enforces policy for all traffic flowing between them — not just one device.
Four Types of Network-Based Firewalls
| Firewall Type | OSI Layer | What It Examines | Strength | Weakness |
|---|---|---|---|---|
| Packet Filtering | Layer 3-4 | Source/dest IP, port, protocol — nothing else | Fast; low overhead; transparent | No state awareness; can't detect fragmented or spoofed attacks; easily bypassed |
| Stateful Inspection | Layer 3-4 | Full connection state; tracks TCP handshakes; validates packets are part of established sessions | Blocks unsolicited packets; detects some attack patterns; much harder to spoof | Still no application-layer visibility |
| Application-Layer (Proxy) | Layer 7 | Full payload content; understands specific protocols (HTTP, FTP, DNS) | Deeply inspects content; can detect malicious payloads, not just headers | High latency; must proxy every connection; one proxy per application type |
| Next-Generation Firewall (NGFW) | Layers 3-7 | All of the above plus: application ID, user identity, SSL inspection, IPS, threat intel | Most comprehensive; single device for multiple functions | Most expensive; requires tuning; SSL inspection has privacy implications |
Packet Filtering vs. Stateful — The Key Difference
- •Rule: Allow TCP port 80 inbound
- •Attacker sends ACK packet with no SYN first
- •Firewall sees: TCP port 80 ✓ — ALLOWS IT
- •Problem: no legitimate connection was established
- •Attacker exploits this to bypass the firewall
- •Does not track whether connections are valid
- •Rule: Allow TCP port 80 inbound
- •Attacker sends ACK packet with no SYN first
- •Firewall checks state table: no SYN recorded
- •This ACK has no matching connection — BLOCK
- •Only packets matching established sessions pass
- •Tracks full 3-way handshake and connection lifecycle
Firewall Benefits and Limitations
- •✅ Prevents unauthorized access — enforces access control policy at network boundaries
- •✅ Sanitizes protocol flow — application-aware firewalls detect protocol abuse
- •✅ Reduces attack surface — hides internal topology; blocks unsolicited inbound connections
- •✅ Logs and audits — creates record of allowed/denied traffic for forensic analysis
- •❌ Cannot inspect encrypted traffic by default — attacker inside TLS tunnel bypasses inspection (NGFW can decrypt/re-encrypt)
- •❌ Not effective against insider threats — authorized internal users are trusted by policy
- •❌ Cannot stop application-layer attacks through allowed ports — SQL injection over port 443 bypasses packet/stateful filters
- •❌ Misconfiguration is common — 'allow any any' rules or overly permissive policies defeat the purpose
A company's stateful firewall allows outbound HTTP (port 80) and HTTPS (port 443) connections. A piece of malware on an internal computer communicates with its command-and-control server by sending commands disguised as normal HTTPS web traffic on port 443. The firewall sees valid HTTPS connections going to what appears to be a web server. Does the stateful firewall block this?