Packet Filtering Firewall

Packet filtering firewalls filter data by comparing the header information of a data packet to a set of predefined rules. These rules can be based on IP addresses, packet type, destination port number or any other aspect found in a data packet header. If the information in the data packet satisfies a certain rule then it is allowed to pass through otherwise it is blocked and discarded.  

Packet-filtering firewalls can come in two forms: stateful and stateless. A stateless firewall will look at each data packet individually and won’t look at the context, making them easier for hackers to bypass. While a stateful firewall can remember information about previous data packets that passed through and will consider that when looking at new data packets. Stateful firewalls are considered much more secure.

For example say you’re on a zoom call with someone, for that connection to last data packets related to audio and video must be continuously sent between your two computers. A stateful firewall will remember that your computer has been receiving data packets as part of this zoom call when it evaluates a new data packet. While a stateless firewall will not take that into consideration that when it evaluates a new data packet.

Circuit-Level Gateway

A circuit-level gateway doesn’t examine data packet headers to filter traffic. Instead it looks for the initiation messages of network protocol sessions to determine whether the sessions are legitimate. Based on this determination it will allow traffic to pass through that is related to that session. In simple terms this type of firewall looks to see if a session has been initiated on the network and if it has, it will allow traffic in and out related to that session.

Application-level gateway/proxy firewall

This type of firewall serves as the proxy between two devices on a network. Much like a stateful packet filtering firewall it filters traffic based on data packet header information and are stateful, so they can remember previous packets when evaluating a new data packet. In addition to these features an application-level gateway can filter traffic based on layer 7 protocols like HTTP and use deep packet inspection. Deep packet inspection simply means that instead of just looking at the packet header, it looks at the contents of the data packet as well.

Stateful Inspection Firewall

Stateful inspection firewalls not only examine the contents of each data packet but they also examine whether each data packet is part of an established TCP or other network session. This combines the security features of the packet filtering firewall and the circuit level gateway. The downside of this firewall is that it significantly lowers network performance.

A more advanced version of this firewall is the stateful multilayer inspection firewall (SMLI). While a normal stateful inspection firewall only looks at the network layer, the SMLI firewall examines packets across multiple layers of the OSI model and only allow the packet to pass through if they clear each layer individually. 

Network Address Translation (NAT) Firewalls

Network address translation allows you to use one public IP address for an entire computer network, keeping the individual IP addresses hidden. This way if an attacker tries to scan the network for IP addresses, he will only find the public IP address. All traffic to the network will be sent to the firewall (public IP), which will examine the data packets and pass them to the appropriate computer on the network if the packets are deemed to be safe. 

Next-Generation Firewalls (NGFW)

These are the most advanced type of firewall. They include packet header inspection, deep packet inspection, stateful inspection and other types of network security systems like an IDS/IPS or antivirus. Packet inspection means looking at the header information of a data packet while deep packet inspection means looking at the actually data within the data packet, many NGFWs can even look at data for encrypted traffic.