A Firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Its primary purpose is to establish a barrier between a trusted internal network and an untrusted external network (like the Internet).
Stateful vs Stateless Filtering
To understand modern firewalls, you must understand the concept of state.
| Feature | Stateless Filtering (Legacy) | Stateful Filtering (Modern) |
|---|---|---|
| How it works | Examines every single packet individually in isolation. | Understands the full context of a connection over time (a session). |
| Return Traffic | Requires two manual rules: one to allow traffic out, one to allow the reply back in. | Automatically allows return traffic for established connections. |
| Primary use | Basic ACLs on routers. | Enterprise Firewalls (Palo Alto, Fortinet, Cisco). |
How a Stateful Firewall Tracks Sessions
Imagine a User PC (192.0.2.50) trying to securely browse the Internet (HTTPS on Port 443).
- Outbound Packet: The PC sends a TCP SYN packet destined for a web server at
198.51.100.80on Port 443. - Policy Check: The firewall receives the packet. It checks its security policies top-to-bottom. It finds a rule allowing the Internal Zone to reach the External Zone on Port 443.
- Connection Tracking: Because it is a stateful firewall, it creates an entry in its internal State Table. It records the Source IP, Destination IP, Source Port, Destination Port, and Protocol (TCP).
- Return Traffic: When the web server replies, the packet hits the outside interface of the firewall. The firewall does not check its security policies again. Instead, it checks its State Table. It sees this reply is part of an already established, approved session, and immediately allows it through to the PC.
Common Firewall Rule Components
Every firewall vendor has a different graphical interface, but almost all policies require the following elements:
- Source: The IP address, subnet, or Zone where the traffic originates.
- Destination: The target IP address, subnet, or Zone.
- Service / Port: The application protocol being used (e.g., TCP 443). (See Common Network Ports).
- Action: Permit or Deny.
- Logging: Whether the firewall should record the event to memory or a Syslog server.
Implicit Deny: The invisible rule at the absolute bottom of every firewall policy list is "Deny Everything." If traffic does not explicitly match a permit rule above it, it is silently dropped.
Common Firewall Troubleshooting
1. Routing or DNS Mistaken for Firewall
If a user cannot reach a website, engineers often blame the firewall first. Ensure the PC actually has a valid Default Gateway and can resolve the hostname via DNS before assuming the firewall is blocking it.
2. Asymmetric Routing
If a packet leaves the network through Firewall A, but the reply packet comes back through Firewall B, Firewall B will drop it. Why? Because Firewall B never saw the start of the connection. It has no entry in its State Table, so it considers the unexpected reply packet to be an attack.
3. Rule Order Issues
Firewalls read rules from top to bottom. If Rule 1 says "Deny all traffic to 198.51.100.0/24" and Rule 2 says "Permit traffic to Web Server 198.51.100.80", the traffic will be blocked. Rule 1 caught it first, and the firewall stopped reading.
4. Missing NAT
A firewall rule might permit 192.168.1.50 to reach the internet, but if you forgot to configure NAT, the ISP will drop the private IP traffic immediately after it leaves the firewall.
Best Practices
- Principle of Least Privilege: Only open the exact ports necessary for a business application to function. Never use "ANY/ANY" rules.
- Clear Naming: Name your rules descriptively (e.g., "Allow_HR_to_Payroll_App").
- Review Unused Rules: Periodically audit firewall logs. If a rule hasn't seen a hit in 6 months, it should likely be disabled and removed.
- Log Denies: Always log dropped traffic at the bottom of your policy to assist with rapid troubleshooting.