Firewalls

📘 Firewalls — Exam Notes (Network Security)

---

🔐 1. Definition

A Firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predefined security rules.

👉 Simple idea: A firewall acts like a security guard between a trusted network (internal) and an untrusted network (internet).

---

🎯 2. Objectives of a Firewall

• Prevent unauthorized access
• Protect internal network from external threats
• Allow safe and legitimate communication
• Monitor and log network traffic

---

🧱 3. Types of Firewalls

🔸 1. Packet Filtering Firewall

• Examines packets based on:

  • IP address
  • Port number
  • Protocol

✔ Fast ❌ Less secure (no deep inspection)

---

🔸 2. Stateful Inspection Firewall

• Tracks the state of connections.
• Allows only valid sessions.

✔ More secure than packet filtering

---

🔸 3. Proxy Firewall (Application-Level Gateway)

• Acts as an intermediary between user and server.
• Inspects application data.

✔ High security ❌ Slower performance

---

🔸 4. Next-Generation Firewall (NGFW)

• Advanced firewall with:

  • Deep packet inspection
  • Intrusion prevention
  • Application awareness

✔ Very strong security

---

🔍 4. How a Firewall Works

1. Data packet arrives

2. Firewall checks rules (ACL)

3. Decision:

   • ✔ Allow
   • ❌ Block

4. Log the activity

---

🔑 5. Firewall Rules (ACL - Access Control List)

• Define which traffic is allowed or denied

• Based on:

  • Source IP
  • Destination IP
  • Port number
  • Protocol

---

🛡️ 6. Firewall Deployment Types

🔸 Network-Based Firewall

• Protects entire network.

🔸 Host-Based Firewall

• Installed on individual devices.

---

⚠️ 7. Advantages of Firewalls

• Blocks unauthorized access
• Reduces risk of attacks
• Controls network traffic
• Provides logging and monitoring

---

❌ 8. Limitations of Firewalls

• Cannot stop internal attacks
• Cannot prevent all malware
• Requires proper configuration
• May reduce performance

---

🚨 9. Firewall vs Other Security Tools

Tool	Function
Firewall	Blocks/filters traffic
IDS	Detects attacks
IPS	Detects & prevents attacks

---

🧠 10. Best Practices

• Use strong firewall rules
• Regularly update firewall
• Monitor logs
• Combine with other security tools

---

📊 11. Important Concept

🔸 Default Deny Rule

Block all traffic unless explicitly allowed

👉 This is the safest firewall policy.

---

🖼️ 12. Diagram Descriptions

📌 Firewall Placement

• Internet → Firewall → Internal Network

---

📌 Packet Filtering

• Packets checked against rules → Allow/Block

---

📌 Proxy Firewall

• User → Firewall (Proxy) → Server

---

🧾 13. Real-Life Examples

• 🏢 Company networks protected by firewalls
• 🏠 Home routers have built-in firewalls
• 🌐 Websites use firewalls to block attackers
• 💻 Personal computers use host-based firewalls

---

📝 Likely Exam Questions

1. Define firewall and its purpose.
2. Explain different types of firewalls.
3. How does a firewall work?
4. What is ACL in firewall?
5. Differentiate between packet filtering and stateful firewall.
6. What are advantages and limitations of firewalls?
7. Explain network-based vs host-based firewall.
8. What is default deny rule?
9. Compare firewall, IDS, and IPS.
10. Write short notes on:

• Proxy firewall
• NGFW
• Firewall rules

---

📌 Quick Summary / Conclusion

• A firewall is a key security tool that controls network traffic.
• It acts as a barrier between trusted and untrusted networks.
• Types include packet filtering, stateful, proxy, and NGFW.
• Firewalls use rules (ACLs) to allow or block traffic.
• Best security comes from combining firewalls with other tools.

👉 In short: Firewalls are essential for protecting networks by filtering and controlling traffic based on security policies.

---