The Network Gatekeeper
A firewall is a security device (hardware, software, or both) that monitors and filters incoming and outgoing network traffic based on predefined rules. It acts as a barrier between your trusted internal network and untrusted external networks (like the internet).
Think of a firewall as a bouncer at a club. It checks every person (packet) trying to enter or leave and decides whether to let them through based on a list of rules.
Types of Firewalls
Type │ How It Works
────────────────────────┼─────────────────────────────────────────
Packet Filtering │ Examines header of each packet
│ (source/dest IP, port, protocol)
│ Fast but doesn't inspect content
Stateful Inspection │ Tracks connection state
│ Knows if a packet is part of an
│ established connection or a new request
Proxy Firewall │ Acts as intermediary between client
│ and server. Client never directly
│ contacts the server.
Next-Generation (NGFW) │ Combines traditional firewall with
│ deep packet inspection, IPS, and
│ application awareness
Application Firewall │ Filters traffic at the application
│ level (e.g., blocking SQL injection)
How Packet Filtering Works
Firewall Rule Table:
┌────┬──────────────┬─────────────┬──────────┬──────────┐
│ # │ Source IP │ Dest IP │ Port │ Action │
├────┼──────────────┼─────────────┼──────────┼──────────┤
│ 1 │ Any │ 10.0.0.5 │ 80 │ Allow │
│ 2 │ Any │ 10.0.0.5 │ 443 │ Allow │
│ 3 │ Any │ 10.0.0.5 │ 23 │ Deny │
│ 4 │ 192.168.1.0 │ Any │ Any │ Allow │
│ 5 │ Any │ Any │ Any │ Deny │
└────┴──────────────┴─────────────┴──────────┴──────────┘
Packet arrives:
Source: 203.0.113.50 Dest: 10.0.0.5 Port: 80
→ Match rule 1: ALLOW ✓
Packet arrives:
Source: 203.0.113.50 Dest: 10.0.0.5 Port: 23
→ Match rule 3: DENY ✗
Rules are processed in order — the first matching rule determines the action. The final "Deny Any" rule blocks everything not explicitly allowed.
Firewall Placement
INTERNET
│
┌───────┴───────┐
│ Firewall │ ← External firewall (first line of defense)
└───────┬───────┘
│
┌───────┴───────┐
│ DMZ │ ← Public servers (web, email)
└───────┬───────┘
│
┌───────┴───────┐
│ Firewall │ ← Internal firewall (protects private network)
└───────┬───────┘
│
┌───────┴───────┐
│ Private Network│ ← Internal devices
└───────────────┘
The DMZ (Demilitarized Zone) is a network segment between the external and internal firewalls. Public-facing servers (web, email) are placed in the DMZ — exposed to the internet but isolated from the internal network.