3.2 Firewall Types

Firewalls

A core part of modern network security, controlling the flow of traffic between networks. They’re used in homes, businesses, and even within operating systems.

• Can manage both inbound and outbound traffic (which is especially vital in large organizations with many users accessing the internet).

• Can also restrict website access—whether for corporate policy enforcement or parental controls at home.

• Since all traffic passes through this, it’s an ideal spot to add antivirus or anti-malware protections, helping block malicious content before it reaches users.

Network-based Firewalls

Control traffic at the network level.

• Traditional versions operate at OSI layer 4, filtering traffic by TCP or UDP port numbers

• Next-generation firewalls (NGFWs) inspect traffic at layer 7, allowing filtering based on specific applications.

• Often include integrated features like VPN support for secure site-to-site connections

• Many also function as layer 3 devices (routers) enabling them to perform routing duties and provide services like Network Address Translation (NAT)

UTM / All-In-One Security Appliance

Also called a web security gateway or all-in-one security appliance—bundles multiple security features into a single device.

• These can include: URL filtering, content inspection, malware detection, spam filtering, CSU/DSU functions, routing, switching, firewall capabilities, IDS/IPS, bandwidth shaping, and VPN support.

• While convenient, often operate only at layer 4, filtering by port number.

Next-Generation Firewall (NGFW)

A modern firewall that operates at OSI layer 7, enabling it to make decisions based on the specific applications being used.

• Often referred to as application layer gateways, stateful multilayer inspection devices, or deep packet inspection systems,

• Can recognize who’s sending the traffic, where the traffic going to, what is contained within the application layer of the traffic, and then make forwarding decisions on whether that traffic is allowed or disallowed through the firewall.

Next-Generation Firewall (NGFW) In Use

• Can permit Microsoft SQL Server traffic even on non-standard ports, allow users to view but not post on Twitter, or block access to YouTube entirely.

• Very common to have a list of known vulnerabilities that it can allow or block in the firewall itself, effectively turning that into an intrusion prevention system.

• Will include a categorization of URLs so you can allow or block traffic to a specific type of website or a specific URL itself (prohibit anyone inside of your network from visiting a site categorized as a gambling site)