Firewalls - Full Notes

Firewalls

A firewall filters network traffic by deciding what traffic is:

✅ Allowed
❌ Blocked

It acts as a security checkpoint between networks.

Examples:

  • Internal network ↔ Internet

  • VLAN 20 ↔ VLAN 30

🧠 Think:

Firewall = Security Guard

It checks traffic before allowing it through.

How Firewall Rules Work

Firewall rules are processed:

  1. Top to bottom

  2. First match wins

  3. Implicit deny at the end

Example:

Allow VLAN 20 → VLAN 30
Allow Web Traffic
Block Everything Else

If traffic does not match an allow rule:

❌ It gets blocked.

🧠 Think:

Firewall reads rules like a checklist.

Firewall Rules Match On

Firewall rules check:

  • Source IP address

  • Destination IP address

  • Source port

  • Destination port

  • Protocol

Example:

Allow:
Source: VLAN 20
Destination: VLAN 30
Protocol: TCP
Port: 9997

Types of Firewalls

Stateless Firewall

A stateless firewall checks each packet individually.

It does not remember previous traffic.

Example:

"Does this packet match a rule?"

Benefits:

  • Fast

  • Simple

Downside:

  • Less secure

🧠 Think:

Stateless = No Memory

Stateful Firewall

A stateful firewall remembers active connections.

It tracks:

  • Who started the connection

  • Whether traffic belongs to an existing session

Example:

Computer sends a request → Server replies

The firewall knows the return traffic is allowed.

Benefits:

  • Smarter

  • More secure

🧠 Think:

Stateful = Remembers

Stateless vs Stateful

Stateless

Stateful

No memory

Tracks connections

Checks every packet

Remembers sessions

Basic

More secure

🧠 Memory Trick:

Stateless = Stranger
Stateful = Remembers you

Next-Generation Firewall (NGFW)

A modern firewall with advanced security features.

Adds:

  • Application awareness

  • Intrusion Prevention System (IPS)

  • Deep Packet Inspection

It understands more than just:

  • IP addresses

  • Ports

  • Protocols

🧠 Think:

NGFW = Smart Firewall

Proxy Firewall

A proxy firewall acts as a middleman between users and the internet.

Traffic goes:

User
 ↓
Proxy Firewall
 ↓
Internet

It makes requests on behalf of the user and inspects traffic.

🧠 Think:

Proxy = Middleman

Firewall Locations

Network-Based Firewall

Protects an entire network.

Example:

  • pfSense at the network edge

🧠 Think:

Network Firewall = Protects Everyone

Host-Based Firewall

Runs on an individual device.

Example:

  • Windows Defender Firewall

🧠 Think:

Host Firewall = Protects One Device

Key Firewall Concepts

ACL (Access Control List)

A list of rules that defines what traffic is:

✅ Allowed

❌ Denied

Firewall rules are basically ACLs.

🧠 Think:

ACL = Traffic Rule List

Implicit Deny

Anything that is not specifically allowed is automatically blocked.

Example:

Rules:

Allow HTTPS
Allow DNS

Everything else:

❌ Denied

🧠 Think:

Default = Block

DMZ (Demilitarized Zone)

A separate network area for public-facing servers.

Examples:

  • Web servers

  • Email servers

The DMZ keeps public servers separated from the internal network.

Example:

Internet
   |
 DMZ
   |
Internal Network

If a public server gets hacked, attackers still have difficulty reaching internal systems.

🧠 Think:

DMZ = Buffer Zone

Screened Subnet

Another name for a DMZ.

🧠 Think:

Screened Subnet = DMZ

⭐ Network+ Must Memorize

✅ Firewall = Filters traffic
✅ Rules = Top to bottom, first match wins
✅ Implicit deny = Block anything not allowed
✅ Stateless = No memory
✅ Stateful = Tracks connections
✅ NGFW = Smart firewall with advanced inspection
✅ Proxy = Middleman firewall
✅ Network-based = Protects whole network
✅ Host-based = Protects one device
✅ ACL = List of firewall rules
✅ DMZ = Isolated area for public servers