Cybersecurity & Digital Safety20 Concepts & Facts

Firewall in Computer Networks: Architecture, Types & Security Guide

Reviewed by the Master10 Editorial Board for accuracy, clarity and competitive-exam relevance.Editorial Policy

In computer networking and cybersecurity, a firewall is a specialized hardware appliance, software module, or cloud-native security service that monitors, inspects, and filters incoming and outgoing network traffic based on an organization's predetermined security policies. Deriving its name from physical construction firewalls—structural fireproof barriers built to prevent the horizontal spread of flames between adjoining rooms or buildings—a network firewall establishes a defensive barrier between a trusted internal private network (such as a corporate local area network) and an untrusted external network (most notably the public Internet). Operating at the perimeter, firewalls block unauthorized intrusions, thwart distributed denial-of-service probes, and stop data exfiltration.

The technical capabilities of firewalls have evolved across four generations corresponding to the Open Systems Interconnection (OSI) reference model. The first generation comprises Packet-Filtering Firewalls, which operate statelessly at OSI Layer 3 (Network) and Layer 4 (Transport), inspecting individual packet headers for source and destination IP addresses, port numbers, and protocol types (TCP, UDP, ICMP) without maintaining memory of previous packets. The second generation introduced Stateful Inspection Firewalls (developed by Check Point in 1993), which monitor active connection states inside a dynamic state table, verifying that incoming packets belong to an existing, legitimate, established communication session. The third generation developed Proxy Firewalls (Application-Level Gateways), operating at OSI Layer 7 (Application) to terminate and inspect traffic payloads for specific protocols like HTTP and FTP, completely masking the internal client's true IP address.

Modern enterprise networks deploy Next-Generation Firewalls (NGFW), which combine stateful inspection with Deep Packet Inspection (DPI), Intrusion Prevention Systems (IPS), real-time threat intelligence feeds, and encrypted SSL/TLS traffic decryption. Unlike legacy port-based filters, NGFWs possess granular application awareness, capable of distinguishing between legitimate web browsing and unauthorized file transfers executing over identical port numbers (such as Port 443). Additionally, specialized Web Application Firewalls (WAF) inspect HTTP/HTTPS application-layer traffic to protect online web applications from targeted exploits, including SQL injection and cross-site scripting (XSS). Rooted in the foundational security principle of "Default Deny" (wherein any traffic not explicitly permitted is automatically rejected), firewalls constitute the first line of defense in modern defense-in-depth cybersecurity architectures.

Key Concepts & Self-Assessment20 Key Facts

Review key Firewall: Network Security, Packet Filtering, Stateful & NGFW Architecture exam facts and rate your mastery to track revision.

Progress: 0/20 Rated 0 Mastered 0 Review Later

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on security rules.

The term "firewall" originates from physical construction walls built to contain fires within a single section of a building.

A firewall establishes a perimeter boundary between a secure, trusted internal network and an untrusted external network like the Internet.

Firewalls operate using access control lists (ACLs) containing rules that permit or deny packets based on specific criteria.

The "Default Deny" policy dictates that all traffic is blocked unless it explicitly matches an approved permission rule.

The "Default Allow" policy permits all traffic by default, blocking only explicitly prohibited signatures (considered less secure).

First-generation packet-filtering firewalls inspect headers at OSI Layer 3 (Network) and Layer 4 (Transport) without connection tracking.

Packet-filtering firewalls filter traffic based on source IP address, destination IP address, source port, destination port, and protocol.

Stateful inspection firewalls track the state of active TCP/UDP connections in a dynamic memory table called a state table.

#10

Stateful firewalls verify whether incoming packets correspond to an authorized outbound request initiated from inside the network.

#11

Application-level gateways (Proxy Firewalls) operate at OSI Layer 7, terminating connections and inspecting application payloads directly.

#12

Next-Generation Firewalls (NGFW) integrate stateful filtering with Deep Packet Inspection (DPI) and Intrusion Prevention Systems (IPS).

#13

NGFWs provide application awareness, identifying specific applications (e.g. YouTube vs Skype) regardless of the port number used.

#14

Deep Packet Inspection (DPI) analyzes both the header and the data payload of a packet to detect malware and protocol anomalies.

#15

SSL/TLS inspection allows modern firewalls to decrypt, scan, and re-encrypt HTTPS encrypted traffic to catch hidden payloads.

#16

A Web Application Firewall (WAF) specializes in protecting web servers from attacks like SQL injection and Cross-Site Scripting (XSS).

#17

Hardware firewalls are standalone physical appliances placed between the network gateway router and the internal switch.

#18

Software firewalls are host-based programs (such as Windows Defender Firewall or Linux iptables) installed on individual computers.

#19

Distributed Denial of Service (DDoS) mitigation is supported by modern firewalls through rate limiting and SYN-flood protection.

#20

Firewalls form the foundational perimeter layer within a broader multi-layered "Defense-in-Depth" cybersecurity architecture.

Subject Specialist Commentary

Analytical perspective & practical exam advice from the Master10 academic board

Educator's Insight

A firewall serves as a digital security guard standing between a safe private network and the wild public internet. Taking its name from physical construction walls that contain building fires, it inspects every data packet attempting to enter or exit a computer system. By enforcing strict security rules through access control lists, firewalls filter out malicious packets, block unauthorized intrusions, and keep organizational databases protected from online attackers.

In competitive exams like SSC CGL and UPSC, questions frequently test how firewalls operate across OSI model layers. Watch out for the classic trap between packet filtering and stateful inspection: basic packet filtering only examines layer 3 and layer 4 headers, whereas stateful firewalls track ongoing active connections in dynamic memory tables. To score well in computer awareness, remember that a default-deny policy blocks all traffic unless explicitly permitted, providing far tighter defense than default-allow rules.

Firewall in Computer Networks: Architecture, Types & Security Guide

Key Concepts & Self-Assessment20 Key Facts

Subject Specialist Commentary

Related Knowledge Topics to Discover

Looking for more GK practice?