Firewall

What is Firewall?

A firewall is a network security device that monitors and controls incoming and outgoing devices based on the defined set of security rules. The purpose of a firewall is to establish a barrier between a trusted internal network and an untrusted external network (such as the internet) in order to block malicious traffic like viruses and hackers. Therefore the firewall can be hardware, software or cloud-based which monitor and control all outgoing and incoming traffic, each type of firewall having its own defined set of security rules based on this it accepts, rejects or drops that specific traffic.

Firewall Process

Types of Firewall Category

Network Firewall - Filter traffic between two or more networks and run on network hardware

Host based Firewall - Run on host computers and control network traffic in and out of those machines.

Firewall Task

• Defend resources
• Validate access
• Manage and control network traffic
• Record and report on events
• Act as an intermediary

Types of Firewall

• Packet-Filtering Firewalls
• Next-Generation Firewalls (NGFW) 
• Proxy Firewalls 
• Network Address Translation (NAT) Firewalls 
• Stateful Multilayer Inspection (SMLI) Firewalls 

Packet-Filter or Network Layer

Packet filter firewalls is also called network layer firewalls, to control network access it operates outgoing and incoming packet. Therefore it allows them to pass or stop based on source and destination IP address, protocols, and ports. However, in the OSI model, it mainly uses the first three layers and analyzes traffic at the transport layer protocol. It generally falls into two sub-categories, stateful and stateless. 

Next-Generation Firewalls (NGFW) 

The next-generation firewalls is a traditional firewalls technology, it has additional functionality such as application inspection, deep packet inspection, traffic inspection, SSL/SSH inspection, anti-virus, intrusion prevention systems, etc, which used to stop modern days security breaches like application-layer attacks and advanced malware attacks.

Proxy Firewalls 

A proxy firewalls is the network security system, that filters network traffic at the application layer. It is also called an application firewalls or gateway firewalls. A proxy gateway receives a request from a client inside the firewalls, where it is then evaluate against a set of rules and then sends this request to the remote server outside of the firewalls. Therefore, firewall proxy provides internet access to computers on a network, that filter, cache, control, and log request coming from client to keep the network secure. However, the proxy firewalls monitor traffic for HTTP and FTP protocols.

Network Address Translation (NAT) Firewalls

Network address translation (NAT) firewalls is actually a sorting method of the incoming packet that assures users, that only the request information is receive. Therefore it is similar to a proxy firewalls that they act as an intermediate between a group of computer and outside traffic. In this, by using a single IP address, it allows multiple devices with independent network addresses to connect to the internet, where individual IP addresses are hidden because of this IP addresses can’t be captured by hackers.

Stateful Multilayer Inspection (SMLI) Firewalls 

Stateful multilayer inspection (SMLI) firewalls filter packets at the application, network, and transport layers it uses a sophisticated form of packet filter that examines all the seven layers of the OSI model. It also examines packets to determine the state of the communication to ensure all initiated communication is only taking place with trusted sources. Therefore, each packet is examine and compared against known states of friendly packets.

Generation of Firewall

• First Generation- Packet Filtering Firewall
• Second Generation- Stateful Inspection Firewall
• Third Generation- Application Layer Firewall
• Next Generation Firewalls (NGFW)
• Also learn about Network Address Translation (NAT)