Types of Network Firewalls

AP Cybersecurity · Securing Networks

Types of Network-Based Firewalls

They differ in how much context each one has at the moment it decides.

key ideaThe three types differ in how much context each one has when it decides.

The categories

A firewall is software that allows or denies traffic in or out of a network. It may sit on a standalone device or be integrated into another device such as a router — so ‘the firewall’ is a function, not necessarily a box.

Each type can do everything the one before it can. The question is not which is best but how much context the decision needs — and how much you are willing to pay for it.

Type	What it inspects	What it can decide	Cost of the extra context
stateless	packet headers — IP addresses, ports, protocols	each packet, independently	cheapest and fastest
stateful	headers plus the state of connections through it	whether a packet belongs to an established conversation	more memory and processing
next-generation (NGFW)	all of the above, plus packet contents	intrusion prevention, deep packet inspection, filtering by application type	most expensive; can add latency

The stateful step is the important one conceptually. A stateless firewall sees a packet; a stateful firewall sees a conversation — and most useful rules are about conversations.

FirewallSoftware that allows or denies network traffic in or out of a network. It can be hosted on a standalone device or integrated into a router.

Stateless filteringDecisions made from packet headers alone, with no memory of what came before.

Stateful filteringAlso called dynamic packet filtering — it tracks connection state and can filter on connection-related rules.

Deep packet inspectionExamining the contents of packets, not merely the headers.

Intrusion preventionAn NGFW feature that blocks recognized attack traffic rather than only permitting or denying by address and port.

Telling them apart

the deciding question

If the decision uses only IP addresses, ports and protocols, a stateless firewall suffices.
If the rule is ‘allow replies to connections we started’, that requires stateful tracking.
If the rule names an application or inspects content, that is a next-generation firewall.
A firewall may be a separate device or a function inside a router — the type is about what it inspects, not where it lives.

Worked examples

EX 1

Which type does this rule need?

“Allow inbound traffic on TCP 443 to the web server; deny everything else inbound.” What is the minimum firewall type?

List what the rule uses

A protocol, a port, and a destination address.

Ask whether history matters

No — each packet can be judged on its own.

Name the minimum type

Stateless is sufficient.

Note what you give up

It cannot tell an established conversation from a fresh probe.

State the general point

Match the firewall to the rules you actually need; buying more context than the policy uses is wasted.

EX 2

The rule that needs memory

“Allow inbound traffic only if it is a reply to a connection an internal host started.” Which type, and why?

Identify what the rule references

Whether a packet belongs to an existing connection.

Test the stateless option

A stateless firewall has no memory of previous packets, so it cannot answer this.

Name the type

Stateful — it tracks the state of connections passing through it.

State the security gain

Unsolicited inbound traffic is denied without needing a rule per source.

Name the alternative term

This is also called dynamic packet filtering.

EX 3

When only an NGFW will do

An organization wants to block a specific file-sharing application, which changes ports to evade filtering. What is required?

Test port-based filtering

The application moves between ports, so a port rule is defeated.

Test connection state

The connections are legitimate in shape — state does not distinguish them.

Identify what does

Recognizing the application from packet contents.

Name the type

Next-generation firewall — deep packet inspection and filtering by application type.

Note the trade-off

Inspecting contents costs processing and latency, and raises privacy questions worth stating explicitly.

Watch out

A firewall is software, not necessarily a box

It may be a standalone device or integrated into a router. Saying ‘we have a router, so we have a firewall’ is only true if the function is enabled and configured.

Stateless is not obsolete

It is faster and cheaper, and plenty of rules need nothing more. Choose by the policy you must enforce.

Stateful is about connections, not content

It tracks whether a packet belongs to an established conversation. It does not read what the packet says.

NGFW capability is not automatic

Intrusion prevention and application filtering are features to configure. An NGFW with default rules behaves much like a stateful firewall.

Course map. Topic 3.4.a · LO 3.4.A — identify types of network-based firewalls (EK 3.4.A.1–3.4.A.4: a firewall as software allowing or denying traffic, hosted standalone or integrated into a router; stateless filtering on packet headers; stateful or dynamic packet filtering tracking connection state; next-generation firewalls adding intrusion prevention, deep packet inspection and application-type filtering).