Firewall
A policy box: filter, NAT, or proxy traffic by rule. Host or network, stateful or not.
Level: intermediate
What is it?
A firewall enforces traffic policy between hosts or networks. It may filter packets, track connection state, proxy application requests, or combine several mechanisms; it can run on an endpoint, router, cloud boundary, or dedicated appliance.
Why does it matter?
Network reachability should be limited to the flows needed for a system to work. Firewalls reduce the exposed attack surface, but rules must match the actual architecture and are only one part of security.
Mental model
A firewall evaluates traffic against an explicit policy. Stateful firewalls remember flow state so replies to permitted connections can be recognized; application proxies can inspect higher-level requests at a more expensive boundary.
How it works
- Stateless rules evaluate each packet using fields such as addresses, protocol, and ports.
- Stateful firewalls track connection/flow state and commonly permit related return traffic for an allowed flow.
- Default-deny policies reduce exposure but require explicit rules for needed services and operational access.
- Network and host firewalls protect different boundaries and may be used together.
- Logging, rule review, segmentation, and least privilege are needed to prevent overly broad exceptions.
Steps
- Define which source, destination, protocol, port, and direction the business operation needs.
- Write the narrowest rule that permits the required flow.
- Test both permitted and denied cases from relevant network locations.
- Review logs and rule hits, then remove temporary or unused broad rules.
Real-world usage
- Restricting database ports to application subnets.
- Securing administration paths and cloud network boundaries.
- Troubleshooting a connection reset or timeout due to policy.
Common mistakes
- Assuming a successful NAT translation means firewall policy permits the connection.
- Opening all ports to solve a single reachability failure.
- Believing a network firewall can replace application authorization and secure coding.
Interview questions
What is the difference between stateless and stateful filtering?
Stateless filtering checks each packet independently; stateful filtering tracks flow state to apply rules based on a connection's progress.
Why use default deny?
It blocks traffic unless a specific rule permits it, reducing accidental exposure from forgotten or newly introduced services.