What Is a Firewall? Types, Architectures, and How They Work
A firewall is a network security device that monitors and controls incoming and outgoing traffic based on predetermined security rules. It's the first line of defence between a trusted internal network and untrusted external networks. But not all firewalls work the same way — the technology has evolved from simple packet checkers to intelligent, application-aware platforms.
What a Firewall Actually Does
A firewall's job is to permit or deny traffic based on policy, answering three questions: who is communicating (source IP/port), where are they going (destination IP/port), and what are they doing (protocol/application)?
The Four Generations of Firewalls
1. Packet Filter Firewall (Stateless)
Examines individual packets in isolation — source/destination IP, port, and protocol. No context between packets, so it can't detect session-based attacks and is easy to bypass via spoofing. Operates at Layer 3 and Layer 4.
2. Stateful Firewall
Maintains a state table tracking active connections. New connections are checked against the rule base; packets belonging to an already-permitted connection are allowed automatically. Far more secure because it prevents attackers injecting rogue packets into established connections. Operates at Layer 3, 4, and 5.
3. Proxy Firewall (Application Gateway)
Acts as an intermediary — the client connects to the proxy, which establishes a separate connection to the destination. Enables deep inspection of application-layer traffic and hides internal IPs, at the cost of performance overhead from terminating every connection.
4. Next-Generation Firewall (NGFW)
Combines all of the above with Deep Packet Inspection, an Intrusion Prevention System, application awareness (identifies apps regardless of port), SSL/TLS inspection, identity-based policies, and sandboxing.
Common Firewall Architectures
Screened Subnet (DMZ)
Public-facing servers (web, mail) sit in an isolated DMZ segment behind the firewall. If an attacker compromises the web server, they still can't reach the internal network directly. This is the most common enterprise architecture.
Three-Legged Firewall
A single firewall with three interfaces: untrusted (internet), DMZ (public servers), and trusted (internal network).
Tiered (Defence in Depth)
Internet → Edge Firewall → DMZ → Internal Firewall → Internal Network
Multiple firewalls in series — if one is breached, the next still provides protection. A core CompTIA Security+ concept.
Firewall Rules: How Policies Work
| Order | Action | Source | Dest | Port | Proto |
|---|---|---|---|---|---|
| 10 | PERMIT | 10.0.0.0/24 | 8.8.8.8 | 53 | UDP |
| 20 | PERMIT | 10.0.0.0/24 | ANY | 80,443 | TCP |
| 30 | DENY | ANY | ANY | ANY | ANY |
- Rules are processed top to bottom — the first match wins
- Always end with an implicit deny — anything not explicitly permitted is blocked
- Be as specific as possible — broad "permit ANY" rules create security gaps
- Place DENY rules before PERMIT rules when blocking specific traffic
Firewalls in CompTIA Security+ (SY0-701)
Domain 3.0 — Security Architecture: firewall types, DMZ/segmentation, ACLs. Domain 4.0 — Security Operations: rule management, log auditing, change management. Domain 2.0 — Threats and Vulnerabilities: how firewalls mitigate DoS, spoofing, and port scanning.
Test Your Knowledge
A packet-filtering firewall allows traffic on port 80 from an approved IP. An attacker sends a SQL injection inside that allowed traffic. Will the firewall block it?
No. A packet-filtering (stateless) firewall only checks IP headers — it does not inspect application payload. Stateful and NGFW firewalls would detect this through DPI or an IPS module.
Why does a DMZ need its own firewall rules even though traffic is coming from the internal network?
The DMZ should be treated as semi-trusted, not fully trusted. An attacker who compromises a DMZ server should not be able to pivot into the internal network — strict rules between the DMZ and internal network prevent lateral movement.