Firewalls and Intrusion Prevention Systems (IPS)

Access control lists (ACLs) can be applied on router interfaces to provide a basic level of network security at the network layer. However, creating and maintaining long ACL rule sets quickly becomes tedious and often unfeasible - especially when you need to deploy consistent rules across many routers.

In the early days of networking, threats and attacks were less common. As networks evolved and attacks became more frequent, purpose-built hardware and software emerged to mitigate these risks.

Among the most important of these tools are firewalls and intrusion prevention systems (IPS). They help protect the boundary between trusted internal networks and untrusted external networks. This chapter looks at how these technologies evolved, how they work, and why they’re central to modern network security.

The foundation: What is a firewall?

A firewall is a network security device designed to monitor and control incoming and outgoing network traffic. At a basic level, a firewall uses ACL-style rules to permit or deny packets. In practice, firewalls typically add capabilities beyond router ACLs, such as:

• Enhanced traffic logging
• Alerting and monitoring features
• Centralized management, often through a graphical user interface (GUI)

For more than 25 years, firewalls have served as a first line of defense by creating a barrier between trusted internal networks and untrusted external networks (such as the Internet).

Image

Image Title - A Firewall filtering traffic

Firewalls come in several forms:

• Dedicated hardware appliances
• Software running on a computer
• Software-as-a-Service (SaaS)
• Virtual instances in public or private cloud environments

Regardless of form factor, the goal is the same: to filter (permit or deny) traffic and enforce security policies. You can think of a firewall as a gatekeeper that checks each request against a set of rules before allowing it through.

The evolution of filtering: Stateful inspection firewalls

Early firewalls primarily performed basic packet filtering, examining individual packets in isolation. As networks became more complex, this approach wasn’t enough. That led to stateful inspection firewalls, now considered a “traditional” firewall type.

A stateful inspection firewall allows or blocks traffic based on both:

• Static rules (the configured policy)
• The state of a connection

To track a connection, it uses the “5-tuple”:

• Source IP address
• Destination IP address
• Layer 4 source port
• Layer 4 destination port
• Protocol

Crucially, it monitors activity from the moment a connection is initiated until it is terminated. That way, filtering decisions can use context from earlier packets in the same conversation.

For example, if an internal user initiates a request to a web server on the Internet, the stateful firewall records the outbound connection in its connection table. When the web server’s response returns, the firewall recognizes it as part of an established, legitimate connection and permits it. If an unsolicited packet arrives from the Internet that doesn’t match any existing connection, the firewall drops it.

Image

Image Title - Stateful Inspection Firewalls

Building on stateful inspection, zone-based firewalls improve security by dividing a network into logical security zones. Common zones include:

• An Inside zone (trusted)
• An Outside zone (untrusted, such as the Internet)
• A Demilitarized zone (DMZ) for publicly accessible servers

These zones define security boundaries. Traffic moving between zones is inspected and evaluated against policies for that zone pair.

A common default behavior is:

• Traffic from a trusted zone (inside) to an untrusted zone (outside) is permitted, and return traffic is automatically allowed.
• Traffic from an untrusted zone (outside) to a trusted zone (inside) is blocked by default unless explicitly permitted by a rule.

Image

Image Title - Zone-Based Firewalls

Modern defense: Next-generation firewalls (NGFWs) and integrated IPS

Stateful inspection firewalls significantly improved network security, but threats continued to evolve. Modern attacks - such as advanced malware and application-layer exploits - can bypass traditional defenses. This drove the development of the next-generation firewall (NGFW).

NGFWs go beyond packet filtering and stateful inspection to provide more intelligent and comprehensive protection. Many organizations deploy NGFWs to address modern threats more effectively.

Key features that define next-generation firewalls include:

• Intelligence-Based Access Control with Stateful Inspection: NGFWs build on stateful inspection and integrate threat intelligence feeds to make more informed access decisions. This helps policies adapt as new threats emerge.
• Integrated Intrusion Prevention System (IPS): A core NGFW capability. The IPS monitors traffic for known malicious patterns, attack signatures, and anomalies that suggest an intrusion. Unlike an Intrusion Detection System (IDS), which merely alerts, an IPS takes proactive steps to prevent the attack by blocking malicious traffic in real time. For example, an NGFW’s IPS policy might deny traffic identified as coming from a malware server, preventing web ad redirects to harmful sites.
• Application Awareness and Control (Deep Packet Inspection - DPI): NGFWs can identify and control specific applications, even when they use unexpected ports or protocols. Traditional firewalls typically inspect only the source IP, destination IP, Layer 4 protocol, and source/destination ports. Attackers can exploit this by disguising traffic - for example, a packet may appear to be ICMP because ICMP is listed in the protocol field, while the payload contains malware. A traditional firewall rule that allows ICMP could permit that traffic. With deep packet inspection (DPI), an NGFW can analyze packet contents to determine the actual application and enforce policies such as allowing Microsoft Teams and Google Chrome while blocking risky or unauthorized applications.
• URL Filtering: NGFWs can filter web access based on URL categories, geolocation, and website reputation. This helps reduce exposure to malicious or inappropriate sites.
• Techniques to Address Evolving Security Threats: NGFWs include mechanisms designed to detect and mitigate new and emerging threats, including those without well-known signatures.
• Upgrade Paths to Include Future Information Feeds: NGFWs are typically designed to be extensible, making it easier to integrate new threat intelligence sources, security modules, and policy updates over time.

Image

Image Title - NGFW performing Deep Packet Inspection (DPI)

Other firewall types

While NGFWs dominate the enterprise space, other firewall types serve specific purposes:

• Proxy Firewall: An older type. A proxy firewall acts as an intermediary gateway for specific applications, preventing direct connections between networks. It can provide benefits such as content caching and additional security controls, but it may reduce throughput and create application compatibility issues.
• Host-Based Firewall: A software firewall built into an operating system (for example, Windows Firewall or the macOS firewall). It protects an individual host by controlling traffic to and from that specific machine.
• Virtual Firewall: A firewall deployed as a virtual appliance in private cloud environments (such as VMware ESXi or Microsoft Hyper-V) or public clouds (AWS, Azure, GCP). Virtual firewalls secure traffic across physical and virtual networks and are often used in software-defined networking (SDN).

The evolution of filtering: Stateful inspection firewalls

Early firewalls primarily performed basic packet filtering, examining individual packets in isolation. As networks became more complex, this approach wasn’t enough. That led to stateful inspection firewalls, now considered a “traditional” firewall type.

A stateful inspection firewall allows or blocks traffic based on both:

• Static rules (the configured policy)
• The state of a connection

To track a connection, it uses the “5-tuple”:

• Source IP address
• Destination IP address
• Layer 4 source port
• Layer 4 destination port
• Protocol

Crucially, it monitors activity from the moment a connection is initiated until it is terminated. That way, filtering decisions can use context from earlier packets in the same conversation.

For example, if an internal user initiates a request to a web server on the Internet, the stateful firewall records the outbound connection in its connection table. When the web server’s response returns, the firewall recognizes it as part of an established, legitimate connection and permits it. If an unsolicited packet arrives from the Internet that doesn’t match any existing connection, the firewall drops it.

Image

Image Title - Stateful Inspection Firewalls

Building on stateful inspection, zone-based firewalls improve security by dividing a network into logical security zones. Common zones include:

• An Inside zone (trusted)
• An Outside zone (untrusted, such as the Internet)
• A Demilitarized zone (DMZ) for publicly accessible servers

These zones define security boundaries. Traffic moving between zones is inspected and evaluated against policies for that zone pair.

A common default behavior is:

• Traffic from a trusted zone (inside) to an untrusted zone (outside) is permitted, and return traffic is automatically allowed.
• Traffic from an untrusted zone (outside) to a trusted zone (inside) is blocked by default unless explicitly permitted by a rule.

Image

Image Title - Zone-Based Firewalls

Modern defense: Next-generation firewalls (NGFWs) and integrated IPS

Stateful inspection firewalls significantly improved network security, but threats continued to evolve. Modern attacks - such as advanced malware and application-layer exploits - can bypass traditional defenses. This drove the development of the next-generation firewall (NGFW).

NGFWs go beyond packet filtering and stateful inspection to provide more intelligent and comprehensive protection. Many organizations deploy NGFWs to address modern threats more effectively.

Key features that define next-generation firewalls include:

• Intelligence-Based Access Control with Stateful Inspection: NGFWs build on stateful inspection and integrate threat intelligence feeds to make more informed access decisions. This helps policies adapt as new threats emerge.
• Integrated Intrusion Prevention System (IPS): A core NGFW capability. The IPS monitors traffic for known malicious patterns, attack signatures, and anomalies that suggest an intrusion. Unlike an Intrusion Detection System (IDS), which merely alerts, an IPS takes proactive steps to prevent the attack by blocking malicious traffic in real time. For example, an NGFW’s IPS policy might deny traffic identified as coming from a malware server, preventing web ad redirects to harmful sites.
• Application Awareness and Control (Deep Packet Inspection - DPI): NGFWs can identify and control specific applications, even when they use unexpected ports or protocols. Traditional firewalls typically inspect only the source IP, destination IP, Layer 4 protocol, and source/destination ports. Attackers can exploit this by disguising traffic - for example, a packet may appear to be ICMP because ICMP is listed in the protocol field, while the payload contains malware. A traditional firewall rule that allows ICMP could permit that traffic. With deep packet inspection (DPI), an NGFW can analyze packet contents to determine the actual application and enforce policies such as allowing Microsoft Teams and Google Chrome while blocking risky or unauthorized applications.
• URL Filtering: NGFWs can filter web access based on URL categories, geolocation, and website reputation. This helps reduce exposure to malicious or inappropriate sites.
• Techniques to Address Evolving Security Threats: NGFWs include mechanisms designed to detect and mitigate new and emerging threats, including those without well-known signatures.
• Upgrade Paths to Include Future Information Feeds: NGFWs are typically designed to be extensible, making it easier to integrate new threat intelligence sources, security modules, and policy updates over time.

Image

Image Title - NGFW performing Deep Packet Inspection (DPI)

Other firewall types

While NGFWs dominate the enterprise space, other firewall types serve specific purposes:

• Proxy Firewall: An older type. A proxy firewall acts as an intermediary gateway for specific applications, preventing direct connections between networks. It can provide benefits such as content caching and additional security controls, but it may reduce throughput and create application compatibility issues.
• Host-Based Firewall: A software firewall built into an operating system (for example, Windows Firewall or the macOS firewall). It protects an individual host by controlling traffic to and from that specific machine.
• Virtual Firewall: A firewall deployed as a virtual appliance in private cloud environments (such as VMware ESXi or Microsoft Hyper-V) or public clouds (AWS, Azure, GCP). Virtual firewalls secure traffic across physical and virtual networks and are often used in software-defined networking (SDN).