Firewalls: Packet Filtering vs Next-Gen

A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing traffic based on predefined rules. Firewalls sit between trusted internal networks and untrusted external networks, acting as a gatekeeper. They are a foundational perimeter control, but modern attacks that use encrypted channels or lateral movement within trusted zones highlight why firewalls alone are insufficient and must be combined with other layers of defense.

Packet filtering firewalls (also called stateless firewalls) inspect each packet in isolation based on header fields: source IP, destination IP, source port, destination port, and protocol. They apply simple allow/deny rules called ACLs (Access Control Lists). Because they examine each packet independently, they cannot track whether a packet is part of an established session, making them vulnerable to attacks that forge expected header values or exploit multi-packet vulnerabilities.