IntermediateNetworking

Firewall Fundamentals: Network Security and Configuration

Learn firewall types, architectures, rule configuration, and best practices for network security and traffic filtering.

#Firewall#Network Security#iptables#nftables#Security Architecture

Configuring Firewalls for Network Defense

Firewalls are your first line of network defense, but a misconfigured firewall is worse than none at all. Whether you are setting up iptables rules on a Linux server or designing a segmented network architecture, understanding firewall types and rule logic is essential. This guide covers firewall fundamentals from a configuration and operations standpoint.

Types of Firewalls

Packet Filtering Firewalls

The most basic type, examining packets individually and filtering based on source/destination IP, port, and protocol. They operate at the network layer (Layer 3) and are fast but cannot inspect packet contents.

Stateful Inspection Firewalls

Maintain a state table tracking active connections. They understand the context of traffic, allowing return traffic for legitimate outbound connections while blocking unsolicited inbound traffic. This provides better security than simple packet filtering.

Proxy Firewalls (Application Gateway)

Act as intermediaries between clients and servers. They terminate connections and create new ones, inspecting application-layer traffic. They provide deep inspection but can introduce latency.

Next-Generation Firewalls (NGFW)

Combine traditional firewall capabilities with intrusion prevention, application awareness, SSL/TLS inspection, and threat intelligence integration. NGFWs can identify and control applications regardless of port or protocol.

Web Application Firewalls (WAF)

Specifically protect web applications by filtering HTTP/HTTPS traffic. WAFs detect and block common web attacks including SQL injection, XSS, and CSRF.

How Firewalls Work

Firewalls use Access Control Lists (ACLs) to define rules specifying allowed or denied traffic. Rules are evaluated in order, with the first matching rule determining the action. Each rule typically includes source IP, destination IP, protocol, source port, destination port, and action (allow/deny).

iptables/nftables Basics

Linux firewalls use iptables (legacy) or nftables (modern replacement):

# Allow SSH (port 22)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow HTTP and HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Drop all other inbound traffic
iptables -A INPUT -j DROP

# Save rules
iptables-save > /etc/iptables/rules.v4

nftables uses a more modern syntax:

nft add rule inet filter input tcp dport 22 accept
nft add rule inet filter input tcp dport {80, 443} accept
nft add rule inet filter input drop

Firewall Architectures

Screened Subnet (DMZ)

Creates a demilitarized zone between internal and external networks. Public-facing servers are placed in the DMZ, so if compromised, the internal network remains protected.

Multi-tier Firewall

Uses multiple firewalls to create security zones: internet → external firewall → DMZ → internal firewall → internal network.

Best Practices

Default Deny: Block all traffic by default, then allow only what is necessary. This is the most secure approach.

Least Privilege: Allow only the minimum required traffic for each system or service.

Rule Order: Place more specific rules before general ones. Rules are evaluated top to bottom.

Regular Audits: Review firewall rules regularly, removing unused or overly permissive rules. Document the purpose of each rule.

Change Management: Use formal change control processes for firewall modifications, including review and approval.

Logging and Monitoring: Enable logging for denied traffic and monitor for suspicious patterns. Correlate firewall logs with other security tools.

Firewalls are essential components of network security, but they are not sufficient alone. Combine them with intrusion detection systems, endpoint protection, and security awareness training for comprehensive defense.

References

{@ref rfc2827}

{@ref nist-csf}

Frequently Asked Questions

What is a firewall and how does it protect my network?

A firewall monitors and filters incoming and outgoing network traffic based on security rules. It creates a barrier between trusted internal networks and untrusted external networks like the internet, blocking unauthorized access while allowing legitimate communication.

What is the difference between a stateful and stateless firewall?

A stateless (packet-filtering) firewall examines each packet individually based on source/destination IP and port. A stateful firewall tracks active connections in a state table, understanding traffic context and automatically allowing return traffic for legitimate outbound connections.

What is a next-generation firewall (NGFW)?

NGFWs combine traditional firewall capabilities with intrusion prevention, application awareness, SSL/TLS inspection, and threat intelligence. They can identify and control specific applications regardless of port, providing deeper inspection than conventional firewalls.

What is a Web Application Firewall (WAF)?

A WAF specifically protects web applications by filtering HTTP/HTTPS traffic. It detects and blocks common web attacks including [SQL injection](/learn/sql-injection-basics), [XSS](/learn/xss-basics), and CSRF. Cloud WAFs like Cloudflare offer managed rule sets that are easy to deploy.

What is the default deny principle?

Default deny blocks all traffic by default and only allows explicitly permitted connections. This is the most secure approach because any new or unknown traffic is automatically blocked. Only services that are explicitly needed are allowed through the firewall.

How do I configure iptables on Linux?

Use `iptables -A INPUT -p tcp --dport 22 -j ACCEPT` to allow SSH, `iptables -A INPUT -p tcp --dport 80 -j ACCEPT` for HTTP, and `iptables -A INPUT -j DROP` to block everything else. Rules are evaluated top to bottom. Save rules with `iptables-save > /etc/iptables/rules.v4`.

What is nftables and how does it differ from iptables?

nftables is the modern replacement for iptables in Linux, offering a more unified and efficient syntax. It handles IPv4/IPv6 in a single framework, improves performance for large rule sets, and simplifies configuration. Use `nft add rule inet filter input tcp dport 22 accept` for equivalent rules.

What is a DMZ in network security?

A DMZ (demilitarized zone) is a network segment between the internal network and the internet. Public-facing servers like web and email servers are placed in the DMZ. If a DMZ server is compromised, the internal network remains protected behind an additional firewall layer.

What does a firewall rule order mean?

Firewall rules are evaluated top to bottom, and the first matching rule determines the action. Place specific rules (allow SSH from a specific IP) before general rules (block all SSH). Incorrect ordering can accidentally block intended traffic or leave unintended ports open.

Can a firewall alone protect my network?

No. Firewalls are essential but not sufficient alone. Combine them with intrusion detection/prevention systems (IDS/IPS), endpoint protection, [network segmentation](/learn/networking-basics), email filtering, and security awareness training for comprehensive defense against modern threats.

What is the difference between inbound and outbound firewall rules?

Inbound rules control traffic entering your network from external sources — typically filtering what external hosts can reach. Outbound rules control traffic leaving your network — preventing compromised systems from communicating with command-and-control servers. Both are important for security.

How do I audit my firewall rules?

Review rules regularly to remove unused or overly permissive entries, verify each rule has documented justification, check for rules that allow any/any (full access), and test rule changes in staging before production. Use logging to identify rules that are never triggered.