TechKnowSurge
TechKnowSurge Catalog Videos Firewalls
VideoSecurityFree

Firewalls

Firewalls are a foundational network security control that filter and regulate traffic between trusted and untrusted network segments. This content covers how firewall technology has evolved from simple packet filtering to stateful inspection, application-layer analysis, unified threat management, and next-generation and machine learning-based systems.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A firewall is a network security control designed to separate trusted internal systems from untrusted external environments, restricting the flow of traffic to only what is explicitly permitted. The concept mirrors its architectural namesake — a physical barrier built to contain fire and prevent it from spreading through a structure — applied here to contain threats and prevent unauthorized access from propagating across network boundaries. In practice, firewalls sit between network segments such as a local LAN and the public internet, enforcing rules that allow legitimate outbound communication while blocking adversarial inbound traffic. Firewall technology has developed through several distinct generations. Early network protection relied on access control rules applied directly to routers, which functioned as rudimentary traffic filters. Dedicated stateless firewalls followed, operating similarly to those router-based rules by evaluating individual packets against static criteria such as IP address and port number without any awareness of connection context. Stateful firewalls represented a significant advancement by tracking the state of active sessions, enabling the firewall to assess whether incoming packets legitimately belonged to an established connection rather than evaluating each packet in isolation. This session awareness substantially improved both accuracy and security. As attackers found ways to circumvent layer 3 and layer 4 inspection, the industry shifted toward application-layer analysis — examining the actual content and behavior of traffic rather than relying on port numbers alone. This approach, incorporated into application-aware and next-generation firewalls, allows detection of traffic that misrepresents itself or exploits legitimate protocols. Unified threat management platforms expanded on this further by consolidating firewall functions with antivirus scanning, intrusion prevention, and web filtering into a single appliance. Emerging machine learning-based firewalls now add adaptive behavioral analysis to this stack. Beyond these generational categories, specialized firewall types address specific use cases. Web application firewalls are deployed in front of web servers to protect against application-specific attacks, while host-based firewalls are installed directly on endpoint devices to provide localized protection. The distinction between network-based firewalls and routers also continues to narrow, as modern firewalls frequently handle routing functions and many routers support firewall rule sets, though complex environments may still require both devices operating in dedicated roles.

What you'll learn

What's covered

Firewalls

Key terms

Firewall
A network security device that monitors and controls incoming and outgoing traffic based on predefined security rules.
Stateless Firewall
A firewall that filters packets based solely on static rules without tracking connection state.
Stateful Firewall
A firewall that tracks the state of active network connections and makes filtering decisions based on context.
Application Layer
The topmost layer of the OSI model (Layer 7) that provides network services directly to end-user applications.
Packet Filtering
A firewall technique that inspects packets and allows or blocks them based on source, destination, and protocol.
Web Application Firewall
WAF
A firewall that filters and monitors HTTP traffic to and from a web application to prevent attacks.
Next-Generation Firewall
NGFW
A Next-Generation Firewall is an advanced network security device that combines traditional stateful packet inspection with application awareness, deep packet inspection, intrusion prevention, and threat intelligence to control traffic at Layer 7.
Host-based Firewall
A software firewall installed directly on an individual computer that monitors and controls network traffic to and from that specific host. Host-based firewalls provide a layer of defense that persists even when a device leaves the corporate network.
Network-based Firewall
A firewall deployed at the network perimeter to monitor and control traffic flowing between networks or network segments.
Unified Threat Management
UTM
Unified Threat Management is a network security solution that consolidates multiple security functions including firewall, intrusion detection, antivirus, content filtering, and VPN into a single appliance or platform.

Topics

Firewalls Network Security Stateful Inspection Packet Filtering Next Generation Firewall Web Application Firewall Network Defense

Transcript

Where the Term Comes From

One of the key aspects of protecting our network is going to be our firewall. We're going to want to implement some sort of firewall on our networks.

The term firewall stems from the building industry. At one point in time with old buildings, if a fire broke out, it would quickly spread amongst the whole building. So what a firewall is designed to do is separate out a building. You'd put a firewall inside of this building, splitting half of the building, or a section of the building, from the other section of the building. So if a fire broke out, this special wall was designed so that the fire wouldn't spread as easily to the other sections. This would limit the damage if a fire broke out.

And so this is the concept of what a firewall does. It limits the damage, or separates out our network from everything else. It keeps the fires at bay. It keeps the adversaries on the outside from getting into our network, from spreading into our network.

Here's an example of that. We have a machine over here on LAN 1. We've got another machine on LAN 2. We've got servers on the outside world in the internet that we want to get to. And we have adversaries. It's designed so that way the machines will be able to get to the resources they want to get to on the outside, that adversaries can't get back into this network, and we control the communication that happens from LAN to LAN.

How Firewalls Have Evolved

These firewalls have evolved over time. Originally we didn't really have firewalls, and we used other equipment to help protect our network. Then we came out with firewalls, or what we call now stateless firewalls. We then came out with stateful firewalls, and there's some upgrades to that. Then we went into the application layer and started analyzing things from the application layer. We also got into unified threat management and next generation firewalls. And finally we also see the emerging of a new generation of machine learning firewalls.

At one point in time firewalls didn't really exist. What we had is we had a router, and we would put rules on those routers to help block certain traffic and protect our network.

Stateless Firewalls

Then firewalls were created. We call these stateless firewalls now. At the time, stateless wasn't really a thing, but we just called them firewalls. The firewalls that were initially created really behaved a lot like a router would. They were just specially designed in order to carry out firewall functions, so it was a very efficient way to protect your network. And we call this stateless firewalls. Now, at the time stateless wasn't really a thing, but when we came out with stateful, then we used this term to differentiate the two — between the old firewalls, or the stateless firewalls, and the newer ones, the stateful firewalls.

Stateful Firewalls

Stateful firewalls really were a huge improvement on the firewall design. Stateful firewalls means that it's keeping track of conversations. What does that mean? Well, when a machine establishes a connection to a machine on the outside world, what would happen is that this firewall would then start tracking that session, start tracking that communication, start tracking that connection. And so now it knows where it is at in that process of communicating between these two devices, and it can better make decisions on whether the traffic is really part of that communication or should be dropped.

Looking at the Application Layer

These first few generations of firewalls really looked at layers three and four and filtered based off of the information they found there — so IP addresses and port numbers. But often there are ways to get around that and get back into the network that would trick these devices. And so we started looking at the application layer to better understand what traffic is flowing across it and make decisions on whether it should be accepted or denied.

Essentially what this did is it started ignoring what the actual ports were saying — for instance port 80 — and started looking at the application layer and what it was doing instead. Maybe it was trying to communicate through HTTP but it was using a different port. So it allowed us to compensate for this vulnerability by looking at what's happening at the upper layer, layer 7, the application layer.

Unified Threat Management and Next Generation Firewalls

We started incorporating more and more features into these firewalls, so we called it a unified threat management system, or UTM. We were incorporating things more than just a firewall. We had some antivirus working in there, some intrusion protection. We had some web filtering. And so they were becoming much more complex; they had a lot more functionality to them rather than just a simple firewall.

Which is very similar to what we get with a next generation firewall. In this case though, we're taking a much deeper look into those packets, a much deeper look into the application layer, and looking for certain behaviors within there.

Specialized Firewalls

Now, this gives us a quick view of how firewalls have improved over time. However, there are some specialized firewalls out there as well. I'm not going to get real detailed into these specialized firewalls, but just to name a couple of examples here: one would be a web application firewall, which we put in front of a web server. Another one would be a host-based firewall, which you would install on maybe one of your client's desktop machines, or on your desktop machine. Versus what we've been really talking about, which is network-based firewalls. We don't usually specify that it's network-based, but sometimes if we want that delineation between host-based firewalls and network-based firewalls, we may use that terminology.

Firewalls and Routers

Now, do realize that a lot of routers can perform firewall functions. So there are a lot of routers out there that we could set up firewall functions on. Likewise, firewalls really divide networks, which is one of the jobs that routers do, so firewalls often can act like a router and take on a lot of their functionality. Although there are times when we need both a firewall and a router, sometimes we just need a firewall acting as a router, or a router acting as a firewall.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →