Firewall Architectures: Packet Filtering, Stateful Inspection, NGFW & WAF

A Firewall is a fundamental network security barrier that monitors, filters, and controls incoming and outgoing network traffic based on predetermined security rules. Acting as a digital border control checkpoint between trusted internal networks and untrusted external networks (such as the public internet), modern firewalls have evolved through four distinct architectural generations.

Generational Comparison of Firewall Architectures

Firewall Type	Operating OSI Layer	Inspection Mechanism	Strengths & Limitations
Stateless Packet Filtering (Gen 1)	Layer 3 (Network) & Layer 4 (Transport)	Inspects each packet in isolation against static rules: Source/Dest IP, Source/Dest Port, Protocol.	Fast and low memory footprint; but blind to session context, application payloads, and easily fooled by spoofed flags.
Stateful Inspection (Gen 2)	Layer 3 & Layer 4 (with State Table)	Maintains an internal dynamic state table tracking established TCP/UDP connections. Automatically permits return traffic.	Understands TCP handshakes and sequence numbers; prevents blind injection; standard in Linux `iptables`.
Next-Generation Firewall (NGFW / Gen 3)	Layer 3 through Layer 7	Combines stateful filtering with integrated deep packet inspection (DPI), IPS signatures, TLS decryption, and user-identity awareness.	Can block "BitTorrent traffic over port 443"; inspects application behaviors (Palo Alto, Fortinet, Check Point).
Web Application Firewall (WAF / Gen 4)	Layer 7 (Application Layer Exclusively)	Inspects HTTP/HTTPS request and response bodies, cookies, and parameters for web application attack payloads.	Stops SQL Injection, XSS, CSRF, and bots before requests reach web servers (AWS WAF, Cloudflare WAF, ModSecurity).

Configuring Linux Host Firewalls: iptables and nftables

Linux operating systems contain built-in stateful firewalling capabilities in the kernel via Netfilter. Administrators interact with Netfilter using iptables or modern nftables:

# 1. Set default policy to DROP all incoming traffic (Defense in Depth)
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

# 2. Allow established and related connections (Stateful Return Traffic)
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# 3. Allow loopback (localhost) interface
sudo iptables -A INPUT -i lo -j ACCEPT

# 4. Allow SSH (Port 22) and HTTPS (Port 443)
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# 5. Save rules on Ubuntu/Debian
sudo iptables-save | sudo tee /etc/iptables/rules.v4

BCA Viva Tip: What is the DMZ (Demilitarized Zone)?

A DMZ is a physical or logical subnet that separates an internal local area network (LAN) from untrusted external networks. Public-facing servers (web servers, mail servers, public DNS) are placed inside the DMZ. If a web server in the DMZ is compromised, firewall rules prevent the attacker from pivoting laterally into the internal corporate database network!

Frequently Asked Questions (FAQ) - Student & Interview Review

Q1. Why can't a traditional Layer 4 network firewall protect against SQL Injection?

A traditional firewall only inspects IP addresses and port numbers. Because legitimate web users must access port 443 (HTTPS), the firewall allows the packet through. It cannot inspect the encrypted HTTP payload inside where the SQL injection string is hidden; that requires a Layer 7 WAF.

Q2. What is the difference between iptables and nftables?

nftables is the modern successor to iptables in the Linux kernel. It provides a cleaner syntax, unified filtering for IPv4 and IPv6 in a single framework, improved performance, and atomic rule updates.