Firewalls: Packet Filtering vs Next-Gen

A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing traffic based on predefined rules. Firewalls sit between trusted internal networks and untrusted external networks, acting as a gatekeeper. They are a foundational perimeter control, but modern attacks that use encrypted channels or lateral movement within trusted zones highlight why firewalls alone are insufficient and must be combined with other layers of defense.

Packet filtering firewalls (also called stateless firewalls) inspect each packet in isolation based on header fields: source IP, destination IP, source port, destination port, and protocol. They apply simple allow/deny rules called ACLs (Access Control Lists). Because they examine each packet independently, they cannot track whether a packet is part of an established session, making them vulnerable to attacks that forge expected header values or exploit multi-packet vulnerabilities.

Stateful inspection firewalls maintain a state table that tracks active connections. When a packet arrives, the firewall checks whether it belongs to an already-established session. This allows return traffic to pass automatically without explicit rules. Stateful firewalls are far more secure than packet filters because they can detect packets that do not belong to a valid session — such as unsolicited ACK packets used in stealth scans — and can enforce connection-level policies.

Next-generation firewalls (NGFW) add deep packet inspection and application awareness beyond stateful tracking. An NGFW can identify the application generating traffic — not just the port — using protocol dissection and machine learning. Key NGFW capabilities include application control (block Dropbox regardless of port), user identity integration (rules tied to AD groups), integrated IPS, and SSL/TLS inspection. Vendors include Palo Alto Networks, Fortinet, Check Point, and Cisco Firepower.

Firewall rules are evaluated in top-down order — the first matching rule wins. This means more specific rules must appear before more general ones. An implicit deny all rule at the bottom blocks any traffic not explicitly permitted. Common mistakes include placing a broad allow rule before a specific deny, shadowing (a rule that never matches because a prior rule always matches first), and forgetting to allow return traffic or ICMP error messages that applications depend on.

A WAF (Web Application Firewall) operates at Layer 7 and is specifically designed to protect web applications from attacks like SQL injection, XSS, and CSRF. Unlike NGFWs that protect network traffic broadly, a WAF understands HTTP and HTTPS semantics — inspecting URLs, headers, cookies, and request bodies. WAFs can operate in detection mode (log but don't block) or prevention mode (block malicious requests). AWS WAF, Cloudflare, and Imperva are common commercial solutions.

Because most traffic is now encrypted with HTTPS, threats can hide inside TLS sessions. SSL/TLS inspection (also called SSL interception or decryption) allows NGFWs to act as a man-in-the-middle proxy: the firewall terminates the client's TLS connection, inspects the plaintext, and re-encrypts it toward the destination. This enables malware scanning and DLP within encrypted tunnels. The firewall's certificate must be trusted by clients, usually distributed via Group Policy to corporate devices.

Firewalls are most effective when positioned at trust boundaries. A common design places a perimeter firewall between the internet and the DMZ, and an internal firewall between the DMZ and the internal network. This creates a screened subnet where public-facing servers (web, mail) are isolated so that if they are compromised, the attacker cannot directly reach internal systems. Modern designs also place firewalls between internal segments to limit lateral movement.

An IDS (Intrusion Detection System) monitors traffic and generates alerts when it identifies suspicious patterns, but it does not block traffic. An IPS (Intrusion Prevention System) sits inline and can actively drop malicious packets or reset connections in real time. Most modern NGFWs include an integrated IPS. Detection methods include signature-based (matching known attack patterns) and anomaly-based (detecting deviations from a learned baseline).

A UTM (Unified Threat Management) appliance consolidates multiple security functions into a single device: firewall, IPS, antivirus, VPN, web filtering, and sometimes email security. UTMs are popular in small-to-medium businesses because they simplify management and reduce cost. The trade-off is that a single appliance represents a single point of failure and may not offer the performance or depth of purpose-built solutions. The term UTM is largely superseded by NGFW in enterprise contexts.

The Security+ exam tests your ability to select the right firewall type for a given scenario. Packet filtering is fast but stateless and easily evaded. Stateful inspection tracks sessions and is the baseline for modern networks. NGFW adds application awareness, user identity, and integrated IPS — the right choice for enterprise perimeters. WAF specifically protects web applications at Layer 7 HTTP. Always match the control to the threat: a WAF won't stop a port scan, and a packet filter won't stop SQL injection.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: packet filtering firewalls are stateless and evaluate each packet by header fields only, stateful firewalls track connection states to allow return traffic and detect anomalous packets, and next-generation firewalls add application awareness, user identity, and integrated IPS for deeper inspection. Next up we explore network segmentation and VLANs.