The idea of a firewall is simple enough in theory: put something between two environments that allows some traffic to pass and blocks everything else. In reality, the work of a contemporary firewall to enforce that boundary is more complicated and, because enterprise environments have evolved from well-defined internal networks into vast ecosystems of cloud infrastructure, remote access points and Internet-facing services, getting it right is becoming increasingly critical.
Any organisation which makes decisions about network security architecture must understand what exactly a firewall does to keep out unauthorized access, how traffic is evaluated and what the decision criteria are based on which it uses to make allow or deny decisions, where its boundaries for effectiveness lie. This is also the basis for understanding why such capabilities have continued to change over time and what differentiates current-day firewall platforms from those 10 years ago.
Organizations looking to understand the breadth of capabilities available in modern network security can explore firewall preventing unauthorized system access to find a detailed overview of how contemporary firewall solutions approach traffic inspection and access enforcement.
Core Function: Traffic Filtering and Access Control
The basic function of a firewall is to inspect network traffic and permit or deny connections and data packets based on rules. That evaluation is performed at one or more layers of the network stack, and the level of inspection varies widely depending on the type of firewall you use.
The basic evaluation process works with network layer data by inspecting the header of packets which includes the source IP address, destination IP address and associated port number for all packets. This is where a rule that drops all traffic to the port accepts only from a specific IP address ohh I am sorry CIDR. These rules are clear-cut, quick to evaluate, and effective against hundreds of direct-access attempts, where the source or destination of the traffic itself indicates it should be allowed.
The most evolved level of evaluation is assessment based on state or tracking the condition of network flows instead of utilizing those segments independently. It has a connection table detailing the state of each EVOP currently in progress; By knowing whether the call is originating from inside the protected network, by which it means whether a handshake is completed or not, and according to that whether this current packet matches what was previously registered on that flow or not; This enables the firewall to allow return traffic for properly initiated sessions, while also rejecting unsolicited inbound traffic that was not preceded by an allowed outbound connection. Modern firewalls that make use of stateful inspection at least remedy one serious flaw of filtering solely based on packets.
What Firewalls Block and Why
Port and Protocol Enforcement
Many attacks against unauthorized access attempts are generally on the service that is running on a system that was not intended to be exposed from outside of their network. If a server has a service running on its standard database port (TCP 1433 for SQL Server) and it can be reached from outside the system and something like firewall rules is not specifically excluding inbound traffic at such an external source to that port, then the service is open access to whatever person or hacker outside that’s doing crazy stuff. The most exposure of this kind can be eliminated through a firewall policy that mandates a default-deny approach, permitting only specific ports and protocols required for defined business functions, essentially blocking everything else to make unexposed services unreachable, not out-of-sight-out-of-mind.
The way port and protocol enforcement works at a fundamental level is that there are effective attack vectors exposed only through what the firewall permits. Even if a service is vulnerable, it cannot be exploited if it remains unreachable. This is one of the most basic access control principles in network security, and it is contributed directly to enforcement by the firewall.
Source-Based Access Restrictions
Firewalls can limit access to designated systems or services by source traffic, e.g., allow connections from specific IPs or IP address ranges. This is especially important for privileged access to sensitive systems management interfaces, database servers and infrastructure management platforms that should not be accessible from anywhere on the internet or even general-purpose network zones, but only specific internal network segments or jump hosts.
Source-based enforcement implements a second layer of access control that occurs before any application-layer authentication occurs. A firewall rule that allows access only from specific source addresses will deny connections from anywhere else, even if an attacker has valid credentials for the system, before they reach a point where those credentials could be used.
Traffic Direction and Egress Control
While it may seem like access control is all about inbound traffic, outbound traffic filtering, controlling what connections internal systems are allowed to initiate is an equally important but sometimes underweighted dimension of firewall policy as compared with inbound rules. Once the attacker has access to an internal system, they will often attempt to establish outbound connections to their external infrastructure for command-and-control data exfiltration and lateral movement.
Even with an already compromised system, egress filtering that limits where a host may connect to (destination and port) is enough to interfere with these efforts. A host internal to a network that is unable to initiate outbound connection attempts to any arbitrary external IP address on any random port does not easily interact with command-and-control servers even if malicious software installed on it initiates the conversation. Note that egress rules of the firewall are like a 2nd line of defence (the other being perimeter defences) to restrict what an attacker(s) can do if they got past perimeter defences.
The guidance developed by the National Institute of Standards and Technology for establishing sound firewall policy, including recommendations for how organizations should structure inbound and outbound rules, configure access control for different traffic categories, and deploy firewall solutions across network zones, is documented in the standards guidance available through the firewall policy guidelines publication covering firewall technologies and policy.
Incorporation of Application Layer Inspection and Newer Firewall Features
Like packet filtering and stateful inspection, they operate only on the headers and connection state of network traffic without analyzing the content of what is being transferred. Most of the threats faced by modern organizations work at the application layer, which uses content from allowed traffic as a means to execute an attack. For instance, a SQL injection attempt on a web application or a mail gateway receiving an email with a phishing attachment cannot be defended against by rules that check only source address and ports.
Application-layer inspection, also called deep packet inspection (DPI), looks at the traffic content for permissible protocols. This allows the firewall to recognize application data and find malicious patterns, disable disallowed file types regardless of their transit port, enforce protocol standards by identifying and enacting protocols in a way that diverges from their specification, and content-based controls agnostic of source or destination.
They combine application-layer inspection along with features like application identification, user identity awareness, and integrated threat intelligence. Application identification enables the firewall to identify certain applications (e.g., a social media application that runs over port 443 can be identified and managed independently of normal encrypted web traffic using port 443). Instead of applying policies to a source system’s IP address, User identity awareness lets you apply policies based on the identity of the user attempting to connect.
Using Network Segmentation to help with Access Control
Firewalls also provide access control, not only deciding what to allow in from the outside but controlling what can move about the organization running on different trust levels by separating networking segments into clear zones. Habitually separate the sensitive systems databases, financial applications, and critical infrastructure controls into clearly defined network zones and lock them down with access rules enforced by a firewall that would mitigate any lateral move from less-sensitive zones. If the access to that database segment is limited by a firewall policy to only the application servers that actually need it, then an attacker who breaks into compromised workstations of a general-purpose user network cannot pass through this limitation directly.
This is a big drawback of traditional firewall-box approaches, especially those that focus on perimeter protection, since you can never protect from the inside. With zero-trust enforced in this manner on all internal traffic, once inside the external boundary a single compromised device is now just waiting to be used as a launch pad for additional access into the entire internal network. Internal firewall rules cause segmentation that limits the blast radius of a compromise and drive attackers to challenge new access controls at each border.
The practical requirements for effective firewall deployment including how to structure zone-based access controls, what operational practices maintain effective protection over time, and how firewalls fit into a broader layered security architecture are examined in detail through the reference material on firewall deployment best practices published by the Energy.gov security editorial team.
What Firewalls Do Not Cover
To know what a firewall prevents requires knowing also what it does not. Firewalls manage access to network resources by inspecting application headers, maintaining connection state, analyzing application content (HTTP/HTTPS), and enforcing policy. They can not control what happens after access is granted. A user who has valid network access to a system, or an intruder that has compromised a legitimate account, can conduct all kinds of activities on that system beyond what the firewall may see. Firewall policy does not remediate weaknesses in authentication, non-application software vulnerabilities, and misconfigured application permissions. The firewall establishes the boundary; other controls determines what occurs on each side.
Hence, this is why firewall implementations are repeatedly referred to as one component in an overall defense-in-depth architecture instead of a standalone solution. It minimizes the attack surface presented to external actors, enforces access control between network zones and restricts the operational range of threats that have broken through the perimeter, but is only as powerful as how well its policies are defined, maintained & reinforced by the controls overseeing everything beyond its reach.
Frequently Asked Questions
How does a firewall identify if it needs to allow or pass by the connection?
A firewall inspects every connection, or packet at the application layer via rules that determine what traffic is allowed using parameters such as source and destination IP address, port, protocol (connection), and on more advanced platforms – the identity and content of an application. Access rules are matched sequentially while the first access matching rule will be used. Most organizations set a default-deny rule at the bottom of the rule set such that any traffic not explicitly allowed in is dropped.
Stateful inspection always uses protocols that monitor the state of active connections?
Packet Filtering: When packets go through, it evaluates and filters each one separately without any track of the connection. Unlike a packet filter which examines packets without regard for the context of their connection to see if they conform to its rulesets, stateful inspection keeps track of each active network session and can distinguish between unsolicited inbound traffic that should be blocked as opposed to traffic that is an expected response to an initiated connection (even though its headers would pass a packet filter rule).
Can a firewall always defend against any threat that comes in via allowed traffic?
Traditional firewalls fail to inspect traffic content in permitted connections, only checking IP/port and TCP states at the network layer such as NATs and firewalls. Next-generation firewall application-layer inspection and deep packet inspection capabilities extend protection into allowed traffic through the examination of content for malicious patterns, protocol anomalies and disallowed file types. No firewall capability, however, protects what goes on once someone has gained legitimate access to systems those controls are the domain of authentication, endpoint security and access management layers.
