Firewall

How Firewalls Work

Firewalls filter network traffic using rules that define what is allowed or blocked. They can operate at different layers, including:

• Network layer: Blocks traffic based on IP addresses, ports, and protocols.
• Application layer: Filters traffic for specific applications or services.

Benefits

• Protects networks from unauthorized access
• Blocks malicious traffic and potential attacks
• Monitors and logs traffic for security auditing

Different Types of Firewalls

1. WAF (Web Application Firewall)

Definition: Specialized firewall that protects web applications (websites, APIs) by filtering HTTP/HTTPS traffic.
Protects against: SQL Injection, XSS, CSRF, malicious bots.
Examples: Cloudflare WAF, AWS WAF, F5 ASM

2. UTM (Unified Threat Management)

Definition: A multi-function security device combining firewalling with other security features.
Features include: Firewall, IDS/IPS, antivirus, VPN, content filtering, spam filtering.
Use case: Simplified “all-in-one” security solution for SMBs.
Examples: Fortinet FortiGate, Sophos XG, Check Point UTM

3. NGFW (Next-Generation Firewall)

Definition: An advanced firewall that goes beyond Layer 3/4 filtering with deep inspection.
Key capabilities:

• Deep Packet Inspection (DPI)
• Application awareness (identify apps like Facebook, Dropbox, etc.)
• Integrated IDS/IPS
• SSL/TLS decryption
• Threat intelligence integration
  Examples: Palo Alto Networks NGFW, Cisco Firepower, Check Point NGFW

4. Layer 4 & Layer 7 Firewalls

Layer 4 Firewall (Transport Layer)

Definition: Filters traffic based on IP, ports, and protocols.
Use case: Basic packet filtering, access control.
Limitation: Cannot inspect the actual content of traffic.
Example: Cisco ASA (stateful firewall).

Layer 7 Firewall (Application Layer)

Definition: Inspects the actual data/content inside packets.
Use case: Blocks specific applications or malicious requests (e.g., block YouTube but allow Gmail).
Example: WAFs, NGFWs with app-awareness.

Quick Summary

• WAF → Web app protection (HTTP/S attacks).
• UTM → All-in-one security (firewall + IDS/IPS + AV, etc.).
• NGFW → Smarter, app-aware firewall with deep inspection.
• Layer 4 → Basic filtering (IP/port).
• Layer 7 → Advanced filtering (application data).