Firewall

Firewalls evolved in generations. The first were stateless packet filters in the late 1980s, typically access control lists on routers that judge each packet in isolation by its 5-tuple (protocol, source and destination address, source and destination port) and flags. Because they have no memory, letting replies back in requires broad rules such as "allow TCP with ACK set to high ports", which attackers can abuse. Stateful inspection, popularised by Check Point FireWall-1 in the mid-1990s, keeps a connection table: an outbound SYN creates an entry, and only packets matching a tracked flow in a valid TCP state are allowed back, while UDP and ICMP get pseudo-connections with idle timeouts. Linux implements this in netfilter's conntrack, configured through nftables or iptables. Application-level gateways (proxies) go further by terminating the connection and parsing the protocol, and next-generation firewalls (NGFW) add application identification, user identity, TLS inspection and IPS signatures.

A rule base is normally evaluated top-down with first-match semantics and an implicit deny at the end. Good practice, reflected in NIST SP 800-41 Rev. 1, is default deny with explicit, documented exceptions, and it applies to egress as much as ingress: unrestricted outbound traffic is what lets malware reach command-and-control servers and exfiltrate data. Anti-spoofing filters drop packets whose source addresses cannot legitimately arrive on an interface, such as private RFC 1918 addresses arriving from the internet (compare BCP 38). Common mistakes are shadowed rules that never match because a broader rule above them does, "temporary" any-any rules that become permanent, rules nobody can explain, and exposed management interfaces.

Network firewalls sit between zones and enforce network segmentation, whereas host-based firewalls (Windows Defender Firewall, nftables on a server) protect the individual machine and limit lateral movement even on a flat network; CIS Controls v8 Safeguards 4.4 and 4.5 require firewalls on servers and end-user devices respectively. In the cloud, the same ideas reappear as security groups (stateful, attached to instances) and network ACLs (stateless, attached to subnets) in AWS.

A firewall only decides whether a flow may exist; it does not judge what travels inside an allowed flow. Everything tunnelled over TCP 443 looks alike without TLS inspection, and a web application firewall or IPS is needed to catch SQL injection or exploit payloads on an open port. Firewalls are also targets themselves: edge devices from several major vendors have had critical, actively exploited vulnerabilities in their VPN and management components, for example CVE-2024-3400 in Palo Alto Networks PAN-OS in 2024. Auditing therefore covers the rule base (periodic recertification, rule-hit counts), the configuration against a hardening benchmark, and the patch level of the firewall's own software.