The term firewall predates computers. In the 1600s, builders used it to refer to an incendiary barrier made from non-flammable material that prevented fire from spreading into adjoining sections of a building. That same concept was adopted by engineers in computing in the 1970s, resulting in a type of barrier between a trusted network and everything inside it. Considering the similarity in the overall aim (to contain something before it reaches everywhere), the concept translates surprisingly well.
What is a firewall and its types? It breaks down the core function, identifies what that barrier is and how many forms it can take, before getting into how the tech has branched into multiple distinct categories over time.
The Basic Job Every Firewall Does
Essentially, a firewall inspects traffic flow between networks and determines what goes through & what gets blocked according to defined rules. That simple description encompasses the built in protection within a basic home router all the way to an advanced appliance defending a data center, but how each type accomplishes that identification has some pretty significant differences mechanically and those differences are very important based on what it is an organization actually needs to protect.
The linguistic trajectory of the word parallels this functional concept closely. Examining how the word transitioned from construction to computing, the history of the term “firewall” shows wall designed to limit fire damage in one area of a structure evolved by the 20th century into generic label for anything constructed to serve as a shield, computing included.
Packet-Filtering Firewalls
Then, there are the most naive and earliest form, which inspects inbound and outbound data packets on the basis of rules defined based on source IP address / ports, destination port / protocol; A packet that matches an allowed rule is admitted; all other packets are dropped. The method is quick and low friction; however, it comes with a crucial caveat: each packet is considered independent—there is no insight as to whether the incoming packet is part of a pre-existing, valid connection.
Why does this matter because some attacks take advantage of that blind spot by creating packets that look fine in isolation even if they are not part of any real-world ongoing communication.
Stateful Inspection Firewalls
This is where stateful firewalls come in to fill the gap by keeping track of the state of active connections instead of inspecting packets individually. The firewall also remembers connections determined to be legitimate, so packets participating in that same conversation get evaluated based on the assumption it is happening within a previously established connection rather than as a separate packet from scratch. It’s a significant improvement in terms of security and efficiency, because the firewall doesn’t treat each packet as an entirely new and unknown entity.
Proxy and Application-Level Firewalls
Proxy firewalls approach the process in a completely different way by working as intermediaries between the user and the destination rather than just inspecting traffic as it passes through. Everything goes through the proxy first, and it is able to inspect the actual contents of the traffic at application layer level, as opposed to just header level. This gives you much more detailed view into what is happening in a connection but usually comes with higher processing overhead than just using packet-based methods.
Next-Generation Firewalls
Next-Generation Firewalls integrate traditional filtering with other features, such as intrusion prevention, deep packet inspection, and application awareness (a method of identifying and controlling traffic by the specific application generating it rather than simply on the port or protocol used). Given that only a small number of common ports are used to run large portions of the traffic on the internet regardless of what application created it, this is huge because older port-based rules are far less effective than they’ve ever been.
The second, more thorough understanding of these differences, along with formal recommendations on how to select and deploy the most appropriate one for a given use environment, is exactly what federal guidance on the issue intends to address. The types of leading-edge firewall technology guidelines discuss the comparative merits and demerits associated with each primary type and provide methodology to construct a true firewall policy that is unique around the actual risk profile within an enterprise’s environment rather than a generic approach.
Web Application Firewalls
The web application firewall is a type of firewall that will sit in the traffic to and from you web applications, filtering for patterns indicating attacks like SQL injection and cross-site scripting are attempting to target the application layer of an application rather then the network layer. This category of firewall exists because, even the most advanced network firewalls were not designed to be able to recognize attacks that are embedded within what otherwise appears as normal web traffic.
Cloud and Firewall-as-a-Service Models
With ever more of our infrastructure migrating away from traditional on-premises hardware, so too have firewall functions followed suit into the cloud. In contrast to physical firewalls deployed at the network edge, cloud-delivered firewalls are offered as a managed security service and typically include identity, threat intelligence, and policy enforcement features for users or locations. This change is especially important for organizations with a high percentage of remote workforce, as it offers continuous protection to users and devices that may never touch the wall on available use from the three traditional office network perimeter.
Choosing Among These Types
There is no universally correct type of firewall. Stateful inspection may suffice for smaller networks with simple requirements, but larger more diverse environments that support sensitive web applications generally require multiple types in combination: a next-generation firewall at the edge of the network combined with a dedicated web application firewall that inspects specific services. The right mix is heavily dependent on what an organization is trying to actually protect and the likelihood of a sophisticated attack.
Frequently Asked Questions
Is a next-generation firewall always better than a conventional one?
Not available for all use cases. Next-gen firewalls provide a lot of capability, but they also add complexity and expense, so for smaller networks with fewer resources or less demanding security requirements a simpler deployment could work just fine.
Can a single firewall handle both network and application-layer threats?
Next-generation firewalls include application-layer inspection, but many organizations still deploy a dedicated web application firewall with their network firewall to provide deeper, more specific coverage of Internet-based attacks.
Does this mean the death of on-premises hardware altogether and that cloud-based firewalls are taking over?
Not always. Most organizations will have a hybrid model, running on-premises firewalls to protect a significant corporate infrastructure while also using cloud delivered firewall services for remote users and apps on cloud-based platforms.
