CybersecurityHow-ToBeginner · 4 min read

Types of Firewall: Key Firewall Categories Explained

Firewalls are security devices that control network traffic based on rules. Common types include Packet Filtering, Stateful Inspection, Proxy, and Next-Generation Firewalls (NGFW), each offering different levels of protection and inspection.

📐

Syntax

Firewalls operate by applying rules to network traffic. These rules typically include:

Source IP: Where the traffic comes from.
Destination IP: Where the traffic is going.
Port: The communication endpoint.
Protocol: Type of traffic (e.g., TCP, UDP).
Action: Allow or block the traffic.

Each firewall type uses these rules differently to filter or inspect traffic.

plaintext

rule {
  source_ip: "192.168.1.0/24"
  destination_ip: "10.0.0.5"
  port: 80
  protocol: TCP
  action: ALLOW
}

💻

Example

This example shows how a simple packet filtering firewall rule works by allowing HTTP traffic from a local network to a web server.

python

firewall_rules = [
  {
    "source_ip": "192.168.1.0/24",
    "destination_ip": "10.0.0.5",
    "port": 80,
    "protocol": "TCP",
    "action": "ALLOW"
  },
  {
    "source_ip": "any",
    "destination_ip": "any",
    "port": "any",
    "protocol": "any",
    "action": "DENY"
  }
]

def check_packet(packet):
  for rule in firewall_rules:
    if (rule["source_ip"] == packet["source_ip"] or rule["source_ip"] == "any") and \
       (rule["destination_ip"] == packet["destination_ip"] or rule["destination_ip"] == "any") and \
       (rule["port"] == packet["port"] or rule["port"] == "any") and \
       (rule["protocol"] == packet["protocol"] or rule["protocol"] == "any"):
      return rule["action"]
  return "DENY"

packet1 = {"source_ip": "192.168.1.10", "destination_ip": "10.0.0.5", "port": 80, "protocol": "TCP"}
packet2 = {"source_ip": "192.168.1.10", "destination_ip": "10.0.0.5", "port": 22, "protocol": "TCP"}

print(check_packet(packet1))
print(check_packet(packet2))

Output

ALLOW DENY

⚠️

Common Pitfalls

Common mistakes when using firewalls include:

Setting rules too broad, allowing unwanted traffic.
Not updating rules regularly, leaving security gaps.
Ignoring stateful inspection, which can allow malicious packets in some cases.
Over-relying on a single firewall type instead of layered security.

Properly combining firewall types and regularly reviewing rules improves security.

plaintext

## Wrong: Allowing all traffic from a subnet without restrictions
rule_wrong = {
  "source_ip": "192.168.1.0/24",
  "destination_ip": "any",
  "port": "any",
  "protocol": "any",
  "action": "ALLOW"
}

## Right: Restricting to specific ports and protocols
rule_right = {
  "source_ip": "192.168.1.0/24",
  "destination_ip": "any",
  "port": 80,
  "protocol": "TCP",
  "action": "ALLOW"
}

📊

Quick Reference

Firewall Type	Description	Use Case
Packet Filtering	Filters packets by IP, port, and protocol without tracking connection state.	Basic network perimeter filtering.
Stateful Inspection	Tracks active connections to allow only valid packets.	More secure than packet filtering, used in most firewalls.
Proxy Firewall	Acts as an intermediary, inspecting traffic at the application level.	Protects against application-layer attacks.
Next-Generation Firewall (NGFW)	Combines stateful inspection with deep packet inspection and intrusion prevention.	Advanced security for modern networks.

✅

Key Takeaways

Firewalls control network traffic using rules based on IP, port, and protocol.

Packet filtering is simple but less secure than stateful or proxy firewalls.

Next-Generation Firewalls offer advanced inspection and threat prevention.

Avoid overly broad rules to maintain strong security.

Regularly update and review firewall rules to protect your network.