Topic 3.4 Notes – Protecting Networks: Firewalls

What Firewalls Are and What They Control

A firewall is a security control that allows or denies network traffic crossing a boundary. That boundary might be the edge of the whole network or just one segment inside it. The firewall itself is usually software, even if it lives on a dedicated firewall box, a router, or another security device.

Its job is to create a controlled boundary between areas with different trust levels.

• Inbound traffic is entering the protected segment.
• Outbound traffic is leaving that segment.
• Direction is always relative to the segment or interface you’re protecting.

A firewall can make decisions using:

• Source and destination IP addresses
• Source and destination logical ports
  • Port 22 = SSH
  • Port 80 = HTTP
• Protocol such as TCP, UDP, or ICMP
• Service or application
• Connection state if the firewall is stateful

A logical port is a network service endpoint, not a physical switch port. That shows up on tests a lot.

A firewall only controls traffic that passes through it. In a segmented network, that can mean one firewall at the edge and others protecting internal systems or guest access.

• Rogue access point bypasses the firewall → firewall cannot stop that path
• Allowed traffic can still be malicious → “allowed” only means it matched the rule

Types of Network-Based Firewalls

These three types mainly differ in how much context they use.

Stateless firewalls

A stateless firewall checks each packet by itself. It uses header info like IP addresses, ports, and protocol.

• It does packet-by-packet filtering
• It does not remember earlier packets
• It does not know whether a connection was already established

Stateful firewalls

A stateful firewall does header filtering too, but it also tracks whether traffic belongs to an existing connection. This is why you’ll also hear dynamic packet filtering.

Example:

• Internal device makes an allowed outbound TCP connection
• Return packets come back
• Stateful firewall recognizes them as part of that connection
• Random inbound packets that are not part of it can still be blocked

That “return traffic from an allowed connection” idea is the most important difference from stateless filtering.

Next-generation firewalls

A next-generation firewall includes stateless and stateful features, plus more advanced inspection.

Common added features:

• Intrusion prevention
• Deep packet inspection
• Application filtering

This matters because traffic does not always stay on the “expected” port, and many apps share ports like 80 and 443.

How ACLs Make Firewall Decisions

An ACL or access control list is the ordered rule set the firewall follows. The firewall enforces. The ACL tells it what to do.

A typical rule includes:

• Direction such as inbound or outbound
• Match criteria such as IP, port, protocol, service, or application
• Action such as allow/permit or deny

Rule order

ACLs are checked top to bottom. The first matching rule wins.

That means a later rule does nothing if traffic already matched an earlier one.

This allows SSH only from the admin subnet, then blocks the rest of inbound TCP. The example below shows that same first-match logic in a firewall ACL.

ACL first-match rule order

Shadowing

Shadowing happens when a broad rule appears before a specific one.

• DENY inbound TCP ALL from ALL
• ALLOW inbound TCP destination port 22 from 203.0.113.0/24

Here, the deny rule matches first, so the SSH allow rule never applies.

Writing Firewall Rules from Requirements

A requirement has to become a precise rule. You’re translating words into filters.

1. Identify the boundary
2. Decide inbound or outbound
3. Identify the source
4. Identify the destination if needed
5. Choose the protocol
6. Choose the port, service, or application
7. Choose allow or deny
8. Put the rule in the right order

Example requirement: only admin subnet 203.0.113.0/24 can use SSH to manage a server.

• ALLOW inbound TCP destination port 22 from 203.0.113.0/24
• DENY inbound TCP ALL from ALL

On FRQs, “allow SSH” is too vague. You usually need direction, protocol, port, and source at minimum.

Where Firewalls Should Be Placed

Placement decides what traffic the firewall can even see.

• Every internet ingress and egress point should have a firewall
• Each network segment should have firewall control over traffic entering and leaving it
• Different segments can have different rule sets

A common layout looks like this, with a public-facing zone separated from the internal network:

• Perimeter firewall at the internet edge
• DMZ for public-facing servers
• Another firewall boundary between DMZ and internal network
• Internal segmentation for employees, admins, sensitive servers, and guests

Firewall placement with a DMZ

This supports defense in depth and limits lateral movement after a compromise.