The First Line of Perimeter Defense

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It establishes a barrier between a trusted internal network and an untrusted external network (like the Internet).

Modern architecture uses a defense-in-depth strategy, layering multiple types of firewalls to protect different aspects of the infrastructure.

1. Packet Filtering Firewalls (Stateless)

The oldest and simplest type. They operate at the Network Layer (Layer 3) and Transport Layer (Layer 4) of the OSI model. They look at every individual packet in isolation and make a block/allow decision based on the Source IP, Destination IP, Port, and Protocol. - Example Rule: Block all incoming TCP traffic to Port 22 (SSH) from IP Range 192.168.1.0/24. - Flaw: Because they are stateless, they don't know if a packet is part of an established connection or a rogue packet attempting a spoofing attack.

2. Stateful Inspection Firewalls

The modern standard for network boundaries. They track the operating state and characteristics of network connections. If a user inside the network initiates an HTTP request to an external web server, the firewall records this "state." When the web server replies, the firewall automatically allows the inbound traffic because it remembers the outgoing request. If an unsolicited inbound packet arrives, it is dropped.

3. Web Application Firewalls (WAF)

While network firewalls protect ports and IPs, a WAF operates at the Application Layer (Layer 7). It specifically analyzes HTTP/HTTPS traffic. If a hacker sends an HTTP request to Port 443, a traditional firewall will allow it because Port 443 is meant to be open for web traffic. However, if that HTTP request contains a SQL Injection payload (?id=1' OR '1'='1), the WAF will inspect the HTTP body, recognize the attack signature, and block the request before it ever reaches your backend server. - Leaders: Cloudflare, AWS WAF, F5, ModSecurity.

4. Next-Generation Firewalls (NGFW)

NGFWs combine stateful inspection with deep packet inspection (DPI), intrusion prevention systems (IPS), and malware filtering. They can recognize specific applications (e.g., blocking BitTorrent traffic while allowing Skype) regardless of which port they try to use.

Network Segmentation

Firewalls are not just for the edge of the internet. Good security architecture relies on Segmentation. You place firewalls between your internal zones. Your web servers should be in a DMZ (Demilitarized Zone), and your database servers in a highly restricted internal subnet. If a hacker breaches the web server, an internal firewall prevents them from pivoting directly to the database.

Rule Hygiene: Order, Defaults, and Audit

A firewall is only as good as its rulesets, and rulesets decay. Three habits keep them strong. Default deny: rules should whitelist what is allowed and drop everything else; a rulebase that only lists what to block accidentally permits every new attack that arrives. Rule order and logging: most firewalls evaluate in order and stop at the first match, so put the specific, frequent allow-rules first and the catch-all deny last; log both denies and the access that matters, because logs are your forensics feed. Quarterly review: prune stale rules left over from decommissioned services, consolidate overlapping ranges, and own each remaining rule. The question a reviewer asks is "which service, which hosts, why?" — a rule nobody can justify is usually a hole.

The WAF Blind Spot

WAFs have a famous weakness: they filter at the perimeter, but they only see the request, not your application's state and business logic. A scanner can stage a login attempt thousands of times and trip a rate-limit, while an attacker crafting perfectly valid-looking requests to abuse a coupon code or an authorization gap sails through — because those are not "attack signatures". Treat the WAF as the tripwire (it stops known-bad patterns and buys you visibility), not as a substitute for fixing the underlying application. Every WAF rule that blocks SQLi should be paired with the parameterized-code fix from the injection lesson; the WAF is defense-in-depth, and the same for zero trust: firewalls gate where you go, application controls gate what you can do.

Host-Level Defenses

Beyond the perimeter, every host needs its own firewall (Windows Defender Firewall, iptables/nftables, cloud security groups). Containerized and cloud workloads especially: network security groups and IAM rules are the firewall for your services — a Flutter web tier should not be able to reach the database directly, only the one API that is allowed, regardless of how many public IPs sit in between.