Firewall Architecture

Understanding Firewall Architecture

Firewalls are the first line of defence in any network security architecture. They examine incoming and outgoing network traffic and decide whether to allow or block specific traffic based on a defined set of security rules.

Types of Firewalls

There are several types of firewalls, each with different strengths and use cases:

• Packet Filtering Firewalls — Examine packets in isolation, checking source/destination IP, port numbers, and protocol
• Stateful Inspection Firewalls — Track the state of active connections and make decisions based on context
• Application-Level Gateways (Proxy) — Filter traffic at the application layer, inspecting packet content
• Next-Generation Firewalls (NGFW) — Combine traditional firewall with IPS, deep packet inspection, and application awareness

Firewall Rule Configuration

Firewall rules follow a specific order of evaluation. The most restrictive rules should be placed first:

# Example iptables rules
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -j DROP  # Default deny

Defence in Depth

Modern networks employ multiple firewall layers as part of a defence-in-depth strategy. This typically includes perimeter firewalls, internal segmentation firewalls, and host-based firewalls on individual systems.