Firewalls

1. Introduction to Firewalls

A firewall is a security control that monitors and controls network traffic
according to defined rules. It can be implemented as hardware, software, a cloud service,
or a combination of these technologies.

The basic purpose of a firewall is to determine whether network traffic should be
allowed, rejected, or dropped according to a security policy.

Firewalls are important because computers and networks continuously communicate with
other systems. Without appropriate traffic controls, unnecessary or unauthorized
connections may be exposed to the network.

2. How a Firewall Works

When traffic reaches a firewall, the firewall evaluates the traffic against its configured
rules or policies.

A simplified decision process can be represented as:

Incoming or outgoing traffic
        ↓
Identify traffic attributes
        ↓
Compare with firewall rules
        ↓
ALLOW / DENY / DROP
        ↓
Log the event when configured

Depending on the firewall technology, the decision may consider information such as:

• Source IP address
• Destination IP address
• Source port
• Destination port
• Transport protocol
• Network interface
• Traffic direction
• Connection state
• Application information
• User or identity information in some advanced systems

3. Packet Filtering

Packet filtering is one of the fundamental firewall techniques.
The firewall examines network packets and compares their characteristics with
configured rules.

For example, an organization might define a policy such as:

Allow TCP traffic
Destination: Web Server
Destination Port: 443
Source: Approved Network

This means HTTPS traffic to the web server can be permitted from the specified
network while other traffic may be handled by different rules.

4. Stateless Firewalls

A stateless firewall evaluates packets primarily on the information
contained in each individual packet.

It does not maintain detailed awareness of the state of a network connection.
Each packet is evaluated according to the configured filtering rules.

Example

ALLOW TCP
Source: 10.10.10.0/24
Destination Port: 443

A stateless approach can be useful for straightforward filtering policies, but it
does not have the same connection-state awareness as a stateful firewall.

5. Stateful Firewalls

A stateful firewall keeps track of active connections and uses
connection state when making filtering decisions.

For example, when an internal computer establishes an authorized outbound TCP
connection, the firewall can maintain information about that connection and
recognize related response traffic.

Stateful inspection generally provides more context than simple packet-by-packet
stateless filtering.

6. Network-Based Firewalls

A network firewall controls traffic between networks or network
segments.

Examples include traffic controls between:

• Internet and an organization’s internal network
• Guest and corporate networks
• Server and user networks
• Development and production networks
• Different security zones

Network firewalls are commonly deployed at strategic points where traffic between
security zones can be inspected and controlled.

7. Host-Based Firewalls

A host-based firewall runs directly on an individual computer or
server.

It can control traffic entering or leaving that particular system.

Examples include:

• Windows Defender Firewall
• Linux firewall frameworks and front ends
• Endpoint security platforms with firewall capabilities

Host-based firewalls provide an additional layer of protection even when a system
is already behind a network firewall.

8. Cloud Firewall and Security Groups

Cloud platforms provide network traffic controls that can operate at different
layers of cloud infrastructure.

A cloud environment may use concepts such as security groups, network access
control lists and managed firewall services.

These controls can restrict traffic based on characteristics such as source,
destination, protocol and port.

Cloud firewall configuration should follow the same core principles used in
traditional networks: least privilege, clear documentation, monitoring and
regular review.

9. Inbound and Outbound Traffic

Inbound Traffic

Inbound traffic enters a system or network from another source.

For example, a web server may intentionally allow inbound HTTPS traffic on
TCP port 443.

Outbound Traffic

Outbound traffic leaves a system or network.

Controlling outbound traffic can reduce the ability of compromised systems to
communicate with unauthorized external services.

10. Understanding a Firewall Rule

A firewall rule commonly contains several components.

11. Example Firewall Rules

Consider a server with the following simplified policy:

Rule 1:
ALLOW TCP
Destination Port: 443
Source: Internet
Destination: Web Server

Rule 2:
ALLOW TCP
Destination Port: 22
Source: Administration Network
Destination: Web Server

Rule 3:
DENY
Destination: Web Server
All Other Unapproved Traffic

The policy allows HTTPS access while restricting SSH administration to a specific
network. The final rule represents a restrictive fallback for traffic that does
not match the intended access policy.

12. Default Deny and Least Privilege

A common security principle is least privilege: allow only what is
required for legitimate business or technical operations.

A firewall policy can apply this principle by starting with restrictive access and
explicitly allowing required services.

Default policy: DENY

Explicitly allow:
- HTTPS to public web server
- DNS to approved DNS resolver
- Required administrative access
- Required application services

The exact policy depends on the organization’s requirements. A default-deny strategy
must be carefully designed so that legitimate services are not unintentionally blocked.

13. Rule Order Matters

Many firewall systems evaluate rules in a defined order. Once a matching rule is
found, later rules may not be evaluated depending on the firewall implementation.

For example:

Rule 1: ALLOW TCP 443 from 192.168.1.0/24
Rule 2: DENY ALL from 192.168.1.0/24

Traffic matching Rule 1 may be allowed before Rule 2 is considered.

Poor rule ordering can create unintended access. Administrators should therefore
understand how their specific firewall processes rules.

14. Overly Broad Firewall Rules

One of the common configuration problems is creating rules that are broader than
necessary.

For example:

ALLOW ANY
SOURCE: ANY
DESTINATION: ANY
PORT: ANY

Such a rule may effectively remove meaningful traffic restrictions.
Broad rules should only exist when there is a documented and justified requirement,
and they should be reviewed carefully.

15. Shadowed Rules

A shadowed rule is a rule that cannot effectively be reached because
an earlier rule handles the same traffic first.

Example:

Rule 1: ALLOW TCP 443 from ANY
Rule 2: DENY TCP 443 from 10.10.10.50

If the firewall evaluates Rule 1 first, traffic from 10.10.10.50 may already have
been allowed before Rule 2 is reached.

Regular policy review helps identify conflicting or ineffective rules.

16. Common Firewall Misconfigurations

• Allowing unnecessary ports
• Using overly broad source or destination ranges
• Leaving obsolete rules enabled
• Exposing management services to untrusted networks
• Incorrect rule ordering
• Failing to document firewall changes
• Disabling logging when logging is required for investigation
• Allowing unnecessary outbound connections
• Using temporary access rules permanently
• Failing to review cloud security-group rules

17. Firewall and NAT Are Not the Same

NAT (Network Address Translation) changes or maps network addresses
between networks.

A firewall controls traffic according to security policy.

NAT may exist on the same device as a firewall, but NAT by itself should not be
treated as a replacement for a firewall security policy.

18. Firewalls and DMZs

A DMZ (Demilitarized Zone) is a network segment designed to isolate
systems that need controlled communication with less-trusted networks.

Public-facing services such as web servers may be placed in a DMZ depending on
the organization’s architecture.

A simplified architecture might look like:

Internet
   |
   v
[Firewall]
   |
   +--------> DMZ
   |            |
   |         Web Server
   |
   +--------> Internal Network
                |
          Database / Users

The objective is to prevent a compromise of a public-facing service from automatically
providing unrestricted access to internal systems.

19. Network Segmentation

Segmentation divides a network into separate security zones.

Examples include:

• User network
• Server network
• Guest network
• Management network
• Development network
• Production network
• Security monitoring network

Firewalls can enforce communication policies between these zones.

20. Next-Generation Firewalls

A Next-Generation Firewall (NGFW) can provide capabilities beyond
basic network and port filtering.

Depending on the product and configuration, capabilities may include:

• Application-aware traffic controls
• Advanced inspection
• Identity-aware policies
• Intrusion prevention integration
• URL or content controls
• TLS inspection capabilities
• Centralized logging and reporting

Features vary significantly between products. Security professionals should verify
the actual capabilities and configuration of the technology being used.

21. Web Application Firewall (WAF)

A Web Application Firewall (WAF) is designed specifically to inspect
and control HTTP and HTTPS application traffic.

A WAF can help protect web applications against certain classes of malicious
requests, depending on its configuration and capabilities.

Examples of threats a WAF may help address include certain patterns associated
with SQL injection and cross-site scripting.

22. Firewall vs IDS/IPS

These technologies can complement one another rather than being interchangeable.

23. Firewall Logging

Firewall logs can provide valuable evidence during troubleshooting and security
investigations.

Depending on the platform, logs may record:

• Timestamp
• Source IP
• Destination IP
• Source port
• Destination port
• Protocol
• Action taken
• Interface
• Rule identifier
• Connection state

Security analysts can correlate firewall events with endpoint, DNS, authentication
and application logs to understand network activity.

24. Firewall Investigation Example

Imagine a web server is suddenly receiving repeated connection attempts on an
administrative port.

A security analyst could investigate:

1. Which source IP addresses are generating the connections?
2. Which destination port is being targeted?
3. Are the connections being allowed or blocked?
4. Which firewall rule is handling the traffic?
5. Is the service supposed to be publicly accessible?
6. Are the attempts associated with a known administrator or trusted network?
7. Do endpoint and authentication logs show related activity?
8. Should the firewall policy be changed according to the organization’s incident-response process?

The investigation should be performed within authorized systems and according to
the organization’s incident-response procedures.

25. Windows Firewall Commands

On supported Windows systems, administrators can inspect firewall profiles with:

Get-NetFirewallProfile

Firewall rules can be viewed with:

Get-NetFirewallRule

Specific rules can then be examined using appropriate PowerShell filtering.

26. Linux Firewall Commands

On systems using UFW, an administrator may inspect firewall status with:

sudo ufw status

On systems using nftables, an administrator may inspect the active ruleset with:

sudo nft list ruleset

The exact commands available depend on the Linux distribution and firewall
framework installed.

27. Authorized Firewall Laboratory

Create a small test environment using computers or virtual machines that you own
or are explicitly authorized to administer.

Lab Task

1. Identify the IP address of the test machine.
2. Identify its network interface.
3. Inspect the host firewall configuration.
4. Identify currently permitted services.
5. Create a documented test rule in the lab environment.
6. Test the expected traffic.
7. Review the firewall logs if available.
8. Remove temporary rules after testing.
9. Document what changed and what was observed.

28. Practical Security Scenario

A company has a public web server that only needs HTTPS access from the Internet.
Administrators should access the server through a controlled management network.
The database should not be directly accessible from the Internet.

A simplified policy could be:

Internet
   |
   | TCP 443
   v
[Firewall]
   |
   v
[Web Server]
   |
   | Database traffic only
   v
[Database Server]

Management Network
   |
   | Authorized administration
   v
[Web Server]

This architecture demonstrates segmentation and controlled access rather than
placing every service directly on the public Internet.

29. PHP Firewall Rule Validation Example

The following PHP example does not modify a real firewall. It demonstrates how
an application could validate a simplified firewall-rule data structure before
storing or displaying it.

<?php

$rule = array(
    'action'     => 'allow',
    'protocol'   => 'tcp',
    'source'     => '192.168.1.0/24',
    'destination' => '10.0.0.20',
    'port'       => 443,
);

$allowed_actions = array(
    'allow',
    'deny',
    'drop',
);

$allowed_protocols = array(
    'tcp',
    'udp',
    'icmp',
);

if (
    in_array(
        strtolower($rule['action']),
        $allowed_actions,
        true
    ) &&
    in_array(
        strtolower($rule['protocol']),
        $allowed_protocols,
        true
    ) &&
    filter_var(
        preg_replace(
            '/\/\d+$/',
            '',
            $rule['source']
        ),
        FILTER_VALIDATE_IP
    ) &&
    filter_var(
        $rule['destination'],
        FILTER_VALIDATE_IP
    ) &&
    is_numeric($rule['port']) &&
    (int) $rule['port'] >= 1 &&
    (int) $rule['port'] <= 65535
) {

    echo 'Firewall rule structure is valid.';

} else {

    echo 'Invalid firewall rule.';
}

30. Key Security Principles

• Allow only traffic that is required.
• Use least privilege when designing access policies.
• Understand rule order before changing firewall policies.
• Restrict administrative services to trusted networks where appropriate.
• Review both inbound and outbound traffic.
• Remove obsolete firewall rules.
• Document significant firewall changes.
• Enable appropriate logging and monitor important events.
• Use segmentation to limit unnecessary communication between systems.
• Remember that a firewall is only one part of a complete security architecture.

31. Review Questions

1. What is a firewall?
2. What is packet filtering?
3. What is the difference between a stateless and stateful firewall?
4. What is the purpose of a host-based firewall?
5. What is the difference between inbound and outbound traffic?
6. What information can be included in a firewall rule?
7. What does least privilege mean in firewall configuration?
8. Why does firewall rule order matter?
9. What is a DMZ?
10. Why is network segmentation useful?
11. How is NAT different from firewalling?
12. What is the purpose of a WAF?
13. How is an IDS different from a firewall?
14. Why are firewall logs useful during security investigations?
15. Identify three common firewall misconfigurations.

32. Lesson Summary

A firewall is a security control used to regulate network traffic according to
defined policies. Firewalls can operate at network, host, cloud and application
security levels depending on the technology.

Understanding source and destination addresses, ports, protocols, direction,
interfaces, rule order and actions is essential for effective firewall management.

Security professionals should combine firewall controls with segmentation,
secure configuration, monitoring, authentication, endpoint protection and other
defensive measures.

Most importantly, firewall configuration should be performed carefully,
documented properly and tested only in systems where the administrator has
appropriate authorization.