A Firewall is a network security system, available as hardware or software, that monitors and controls incoming and outgoing traffic based on predefined rules. It acts like a security guard, filtering data packets to either:
- Accept: Allow the traffic.
- Reject: Block with an error response.
- Drop: Block silently without response.
Importance
- Prevent Unauthorized Access: Like a locked door with a guard, only trusted users and traffic are allowed through.
- Block Malicious Traffic: Harmful data such as viruses, phishing attempts, or denial-of-service (DoS) attacks are stopped before reaching the system.
- Protect Sensitive Information: Safeguards personal and business data from theft or accidental leaks.
- Control Network Usage: Enforces policies such as parental controls, workplace restrictions, or government filtering.
- Mitigate Insider Risks: Detects suspicious applications or data exfiltration attempts from within the network.
Working of Firewall
A firewall inspects all incoming and outgoing traffic and decide whether to allow or block it.
- All data packets entering or leaving the network must first pass through the firewall.
- The firewall examines each packet against predefined security rules set by the organization.
- If the packet matches safe rules, it is allowed; if it is suspicious, blacklisted, or contains malicious content, it is blocked.
- Blocked or unusual traffic is recorded in logs, and real-time alerts may be generated for serious threats.
- Since it is not possible to define every rule, the firewall applies a default policy (accept, reject, or drop). Setting the default policy to drop or reject is considered best practice to prevent unauthorized access.
Default Policy: A firewall needs a default action (accept, reject, or drop) for traffic not covered by rules. For example, if no rule exists for SSH, the default applies. To prevent unauthorized access, it is best set to drop or reject.
Types of Firewall
Firewalls can be categorized based on their generation.
1. Network Placement
- Packet Filtering Firewall
- Stateful Inspection Firewall
- Proxy Firewall (Application Level)
- Circuit-Level Gateway
- Web Application Firewall (WAF)
- Next-Generation Firewall (NGFW)
2. Systems Protected
- Network Firewall
- Host-Based Firewall
3. Data Filtering Method
- Perimeter Firewall
- Internal Firewall
- Distributed Firewall
4. Form Factors
- Hardware Firewall
- Software Firewall