Firewalls: Types and How They Work

What a Firewall's Job Is

A firewall inspects traffic passing through it and decides whether to allow or block it, based on a set of configured rules. It acts as a controlled checkpoint between a trusted network (like an internal office network) and an untrusted one (like the public internet).

Packet-Filtering Firewalls

The simplest type inspects each packet individually - checking source/destination IP addresses and port numbers against a rule list - without any awareness of whether that packet belongs to an existing, legitimate conversation.

Rule: ALLOW traffic to port 443 (HTTPS)
Rule: BLOCK traffic to port 23   (Telnet - insecure, unencrypted)

Stateful Firewalls: Tracking Whole Conversations

A stateful firewall goes further, keeping track of active connections. It can recognize that a piece of returning traffic is a legitimate reply to a connection an internal device already initiated, and allow it automatically - without needing an explicit rule for every possible reply.

Application-Layer Firewalls: Inspecting Content Itself

The most advanced type can inspect the actual content of traffic - for example, understanding that a request is HTTP traffic specifically trying to access a particular URL path, not just "some traffic on port 80" - enabling much finer-grained and more intelligent rules.

Comparing the Three Types

Why a Firewall Alone Isn't a Complete Security Strategy

A firewall controls what traffic is allowed to pass, but it doesn't inspect for malicious content hidden inside allowed traffic - this is exactly the gap that intrusion detection systems (covered in the next note) are designed to help close.