Firewall Fundamentals Explained | Network Security for Beginners

Episode overview

This episode is a beginner-focused guide to firewalls—what they are, where they sit in a network, the major rule/policy concepts behind them, the main firewall “generations”/types, and practical examples (including Windows Firewall and a Cisco ASA-style ruleset). It frames firewalls using real-world analogies like traffic cops and bouncers.

---

What a firewall is / what it does

A firewall is a security device (often hardware, but it can also be software) that:

• Monitors and controls network traffic
• Allows or denies traffic based on rules/policies set by the user

Firewalls conceptually work on:

• Ingress traffic = traffic entering your network
• Egress traffic = traffic leaving your network

---

Where firewalls are placed (deployment)

Perimeter / internet gateway

• Typically deployed on the perimeter / internet gateway so incoming external traffic must pass through it to be inspected and filtered.

Internal segmentation

• Can also be used for internal segmentation, separating departments/zones so traffic between parts of the internal network is controlled.

Host-based (software) firewalls

• Example shown: Windows Defender Firewall with Advanced Security
• Emphasizes local inbound/outbound rules on the host.

---

Rule / policy fundamentals

Rules and policies

Key ideas the episode emphasizes:

• Firewalls use rules / policies (instructions for what to allow or block)
• It also mentions related concepts such as access control lists (ACLs) as a simple rule structure.

Default deny philosophy (allow-list approach)

• “Block everything unless explicitly allowed”
• Compared to allow-by-default + deny specific items, which is harder to keep secure because the deny surface changes over time.

Stateful vs stateless

• Stateless: evaluates packets individually (source/destination/protocol/port rules)
• Stateful: tracks connection state and allows return traffic only for legitimate sessions

---

Types (“generations”) of firewalls

1. Packet filtering firewalls (1st gen)

   • Check basic packet attributes: IP, port, protocol
   • Pros: simple, fast, low cost, often built-in
   • Cons: limited context, vulnerable to spoofing, no application awareness

2. Stateful inspection firewalls (2nd gen)

   • Maintains a state table and tracks active connections
   • Pros: more secure than packet filtering; efficient for established connections
   • Cons: still limited application visibility

3. Proxy / application-layer firewalls (3rd gen)

   • Acts as an intermediary that inspects traffic at the application layer
   • Uses content/context filtering (described via a “concierge” analogy)
   • Pros: application-aware filtering (the “deep inspection” concept)
   • Cons: performance overhead/latency, more application-specific knowledge required

4. NGFWs / Next-Gen Firewalls (4th gen)

   • Combine traditional firewalling with advanced capabilities like:
     • IPS (Intrusion Prevention)
     • application control
     • threat intelligence / behavior-based detection
   • Pros: strong protection against modern threats
   • Cons: more complex to tune, higher cost, more resource intensive (dedicated CPU/RAM; often deployed as an appliance)

---

How firewalls process rules

• Rules are typically evaluated top-down:
  • Traffic matches the first applicable rule (or set of criteria), which triggers allow/deny/reject/drop
• Rule “anatomy” (fields mentioned):
  • Source (IP/host/network, potentially user)
  • Destination (IP/host/network)
  • Protocol (TCP/UDP/ICMP, etc.)
  • Port/service (examples: 80/443 HTTP/HTTPS, 22 SSH, 3389 RDP)
  • Action taken when matched

---

Actions: allow vs deny vs reject vs drop

• Allow: permits traffic
• Deny/Reject:
  • Blocks traffic and can return an error/response to the user/app
• Drop:
  • Silently discards packets with no response
  • This can make attacker reconnaissance harder (they can’t easily tell if a port is closed versus filtered)

---

Practical examples and rule creation

Cisco ASA example (conceptual)

• Shows permit rules for TCP web traffic and HTTPS to internal hosts
• Shows deny rules for specific “known malicious” IP(s)

Windows Defender Firewall example

Demonstrates creating rules based on:

• A specific program (requires executable path)
• Specific ports and protocols (TCP/UDP)

Examples mentioned:

• Allowing web ports (80/443)
• Custom proxy ports (e.g., 8080)
• RDP (3389)

---

Operational guidance / management

• Firewalls are not “set and forget”:
  • Rules should be reviewed and updated regularly
  • New vulnerabilities may require temporarily blocking while patching or changing rules

---

Benefits and limitations (security perspective)

Benefits

• Access control (prevent unauthorized access)
• Threat protection (e.g., block port scans, DoS, some malware)
• Policy enforcement and compliance support
• Logging and auditing for investigations and incident response (potentially useful for forensics)

Limitations

• Not a “silver bullet” / only one layer of defense
• Weaker against threats that originate inside (e.g., insider threats)
• Doesn’t fully address sophisticated attacks (e.g., APT, nation-state behaviors, zero-days)
• Risk of misconfiguration (poor rules can create “holes”)
• Can’t stop user-driven risks like viruses via allowed traffic, phishing/social engineering
• Highlights egress risk: malware may need outbound communication for command-and-control

---

Main speaker(s) / sources

• Daniel Lowry (host), associated with Anti-Siphon Training (the video references the channel/training group name throughout).