A firewall is the first line of defense in network security. In the modern era, firewalls are not just connection-blocking devices, but also intelligent systems capable of detecting threats, analyzing traffic behavior, and blocking complex attacks such as malware, ransomware, and application exploits.
This article will explain how firewalls, from traditional to the latest generation, work, complete with filtering mechanisms, packet inspection, and the technologies used by companies today.
---
## What Is a Firewall?
A firewall is a network security system that controls incoming and outgoing traffic based on predetermined rules. Its purpose is to prevent unauthorized access and protect the system from attacks.
Firewalls can be:
- Software (e.g., UFW on Linux)
- Hardware appliances (FortiGate, Palo Alto, Cisco ASA)
- Cloud firewalls (AWS WAF, Cloudflare WAF)
- Virtual appliances (on a hypervisor/cloud)
---
## Types of Firewalls
### 1. Packet Filtering Firewall
Early-generation firewalls that only inspect:
- Source IP
- Destination IP
- Port
- Protocol (TCP/UDP/ICMP)
Very fast but don't understand the packet content.
### 2. Stateful Inspection Firewall
Maintains connection state (connection table).
Example:
- SYN → SYN/ACK → ACK
The firewall ensures a valid connection handshake before allowing traffic.
### 3. Application Layer Firewall (Layer 7)
The firewall can read payloads from HTTP/HTTPS, FTP, DNS, etc.
It can be used to block:
- SQL injection
- Cross-site scripting (XSS)
- Malicious user-agent attacks
- HTTP flood attacks
### 4. Next-Generation Firewall (NGFW)
A modern firewall combines:
- Deep Packet Inspection (DPI)
- Intrusion Prevention System (IPS)
- Malware detection
- SSL inspection
- Application identification (App-ID)
- User identification (User-ID)
NGFWs can recognize applications even when using non-standard ports.
---
## How a Firewall Processes Packets
### 1. Packet Enters the Interface
The firewall reads the packet header:
- Source/Destination IP
- MAC address
- Destination port
- Protocol
### 2. Routing & NAT Check
The firewall determines whether the packet should be forwarded, redirected, or NATted.
### 3. Check Firewall Rules
The firewall reads rules sequentially (top to bottom).
Example rule:
