Computer Network & Network Security System — Network Security, NEC licence examination syllabus (Nepal Engineering Council).
Firewalls: the network's bouncer
Deciding who gets in and who gets turned away, packet by packet.
🚪 Three Types of Firewalls
Packet-filterChecks each packet individually against a set of rules (source/destination IP, port) — fast, but has no memory of past packets/connections.
StatefulTracks the STATE of active connections, so it can tell legitimate response traffic from unsolicited traffic — much smarter than simple packet filtering.
Application gateway (proxy)Operates at the application layer, actually understanding the protocol (like HTTP) being filtered — the most thorough, but also the slowest.
A DMZ (Demilitarized Zone) is a separate network segment, sitting between the internal trusted network and the untrusted internet, where public-facing servers (like a company's website) live — if that server gets compromised, the attacker still isn't directly inside the real internal network.
💡 One-liner: "Why place public servers in a DMZ instead of the internal network?" → Limits the damage if that public-facing server is compromised — the attacker lands in an isolated zone, not directly inside the sensitive internal network.
What "stateful is smarter" actually means
The difference is clearest with a concrete problem: letting replies back in.
A user inside the network browses a website.
Their machine sends from ephemeral port 51234 to the server's port 443.
The reply comes back FROM 443 TO 51234.
PACKET FILTER — no memory of the outbound request
To let that reply in, a rule must allow inbound traffic to
ports 1024–65535. Permanently. From anywhere.
→ an attacker can reach any of those ports at any time
STATEFUL FIREWALL — recorded the outbound connection
Allows in exactly the reply matching that connection's
4-tuple, and only while the connection is open.
→ nothing else gets through that port at all
So the gain is not merely "smarter". A packet filter forced to permit return traffic must open 64,000 ports permanently; a stateful firewall opens precisely the ones its own users created and closes them when the connection ends. The state table turns a permanent hole into a temporary, specific exception.
💡 The cost is memory and a limit: every tracked connection is an entry in a finite table. Flooding a stateful firewall with half-open connections to exhaust that table is a recognised denial-of-service technique — and the reason a packet filter, for all its bluntness, cannot be attacked the same way.
Where each type can and cannot see
🔍 What is visible at each layer
Packet filterReads IP addresses, ports, protocol flags. Cannot tell an HTTP request from any other traffic on port 80.
StatefulThe same fields plus connection state. Knows a packet belongs to an established conversation, but still not what it says.
Application gatewayReads the protocol itself — can block one URL, strip an attachment, or reject a malformed request. Slowest, and must understand each protocol individually.
The limitation worth stating: none of them can inspect encrypted traffic. A firewall sees that a TLS connection to some address exists and nothing about its contents — which is the confidentiality-versus-integrity conflict from the CIA triad chapter appearing as a practical engineering problem.
💡 A firewall also cannot help against traffic that never crosses it. An infected laptop carried inside the network is already past the perimeter, which is why "firewall at the boundary" is a necessary defence and never a sufficient one.