Course Preview

Firewalls

A firewall is a network or host control that permits or blocks traffic according to a policy. It sits on a traffic path, examines available connection information, and applies rules that reduce unwanted access without replacing security on the systems behind it.

itDefensive security and security operations | OpenSkills.info

Course pathWalk it in order

Look it upDip in anytime

Go furtherLeaves this page

Firewalls

A firewall controls traffic between networks or hosts with different security postures. It compares traffic with a policy, then permits or denies that traffic. A firewall can be a dedicated appliance, a cloud service, software on a router, or a host control built into an operating system.

The useful mental model is a policy enforcement point on a traffic path. A packet reaches an interface. The firewall identifies facts it can inspect, such as direction, source, destination, protocol, port, connection state, application, or user. It evaluates ordered rules and applies an action. The action may allow, drop, reject, log, translate, or send the traffic to deeper inspection.

Architecture and traffic flow

A network firewall normally connects or observes two or more network zones. Common zones include an untrusted external network, an internal network, and a demilitarized zone for public services. Modern designs also place firewalls between internal segments, virtual networks, cloud workloads, and branch sites. A host-based firewall applies policy at one endpoint, so it can still filter traffic after a packet crosses the network perimeter.

Traffic must traverse the enforcement point for its policy to matter. Routing, switching, tunnels, alternate network interfaces, and asymmetric paths can bypass or confuse inspection. Architecture therefore starts with both the desired trust boundaries and the actual forward and return paths.

A packet-filtering firewall reads packet headers. Typical matches include source and destination addresses, transport protocol, and source and destination ports. A stateless filter evaluates each packet independently. A stateful firewall also keeps a state table. Return traffic for an allowed connection can match established state instead of requiring a separate broad inbound rule.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources