Firewall Fundamentals - A Comprehensive Report
Firewall Fundamentals - A Comprehensive Report
Comprehensive Explanation
Prepared by: Green Armor Cyber Security Company and Academy | GREEN ARMOR Cyber
Security
1. Introduction
In an era where cyber threats are increasing and evolving rapidly, cybersecurity has become a
fundamental pillar for protecting digital assets, whether for individuals or large organizations.
The firewall represents the first and most crucial line of defense in an integrated cybersecurity
strategy.1 This security system acts as a vital barrier, controlling data traffic between trusted
and untrusted networks, preventing unauthorized access, and protecting against a wide range
of cyberattacks.1 This report will cover the fundamentals of firewalls, their mechanisms,
various types, critical importance, limitations, and diverse deployment scenarios, to provide a
comprehensive understanding of this pivotal security component.
2. What is a Firewall?
A firewall is a security system designed to monitor and filter incoming and outgoing network
traffic based on a set of predefined security rules.1 It acts as a barrier or control point
between a trusted internal network (such as a company network or home network) and
untrusted external networks (such as the internet).2 Its primary purpose is to allow only
authorized and secure communications while blocking potential threats and unauthorized
access.1
A firewall is defined as a digital security system that monitors data traffic between a device
and the internet, allowing or blocking data based on specific security rules.4 It aims to protect
networks and devices from external threats by monitoring and filtering incoming and outgoing
data traffic.4 It resembles a physical wall separating a secure place from an insecure one.4 In
the modern digital environment, the primary goal of a firewall is to monitor and analyze
incoming and outgoing data traffic, then make decisions about allowing or blocking this data.3
A firewall helps protect sensitive company data from theft or manipulation and allows the
company to control which websites employees can visit and which programs they can run,
thereby reducing the likelihood of exposure to threats.1
The concept of firewalls has undergone a significant transformation over the years. Initially, it
was primarily viewed as a "barrier" or "security system" that monitored and filtered based on
static rules. However, recent developments indicate that firewalls have become "an intelligent
component capable of self-learning and real-time threat analysis".6 This evolution directly
reflects the changing nature of cyber threats, which are no longer limited to simple attacks
detectable by static rules but now include complex and sophisticated attacks, such as
zero-day attacks, which cannot be detected by traditional methods. This shift means that a
firewall is no longer just a passive checkpoint but a dynamic system that adapts to evolving
threats, making it an integral part of an integrated and adaptable security architecture, rather
than just a static device.
A firewall is not merely a protection program; it is a complex and integrated security system
that works in harmony to protect networks.7 It includes essential components such as: a User
Interface (UI) that allows administrators to manage rules, a Rules Engine that applies security
policies, a Stateful Packet Inspection system that analyzes data traffic, a Web & Application
Filtering system to control access to websites and applications, and a Logs & Monitoring unit
that records security activities for review.7 These units continuously update the threat
database and security rules to counter the latest intrusion attempts and network attacks.7
3. How Does a Firewall Work?
A firewall operates by monitoring and analyzing data traffic between networks, filtering this
data based on a set of predefined rules.1 The firewall controls all incoming and outgoing
network traffic on your computer based on internal rules and user-defined rules.8 This is done
by allowing or denying individual network connections.8
The basic operating principles of a firewall involve monitoring data traffic and applying strict
security rules. The firewall examines data packets, which are small units of data transmitted
across networks, to determine whether they should be allowed or blocked.2 The firewall relies
on a set of pre-programmed rules to determine how to handle data traffic.5 These rules are
defined based on multiple criteria, including:
● IP Addresses (Source and Destination): The firewall checks the source and
destination of the data. If the data comes from an untrusted or suspicious source, it can
be blocked.4
● Port Numbers: The firewall checks the ports used in the connection and prevents
access to unauthorized ports to avoid cyberattacks.4
● Protocol Type: The firewall monitors the type of protocol used in the connection, such
as HTTP or FTP. If the protocol is unknown or suspicious, it may be blocked.4
● Keywords/Content: In more advanced firewalls, data containing suspicious or
unwanted content can be blocked.6
When data packets arrive at the firewall, it inspects them against these rules to determine
their legitimacy.5 Each packet is evaluated against Access Control Lists (ACLs) in a sequential
manner, with rules processed from top to bottom.10 Once a packet matches a specific rule, the
associated action is executed: Allow the packet to pass, Deny with a notification sent to the
sender, or Drop, which silently discards the packet.5
Firewalls rely on a fundamental cybersecurity principle known as "Default Deny" or the
"Principle of Least Privilege." This principle means that firewalls "maintain a default policy to
deny all traffic that does not explicitly match any rule".5 This approach significantly
strengthens the network against unforeseen vulnerabilities (Zero-day vulnerabilities); instead
of trying to identify and block everything harmful, which is impossible given evolving threats,
the firewall only allows what is explicitly known and authorized. This greatly reduces the attack
surface and makes the firewall a highly proactive and effective security tool, even in the face
of new threats for which signatures have not yet been identified.
4. Types of Firewalls
Firewalls have evolved significantly to meet increasing security needs, varying in their
operation and the level of protection they provide. They can be classified based on their
inspection mechanism or form factor and deployment.
Firewall Types by Inspection Mechanism:
● Hardware Firewalls:
These are standalone devices placed between a company's internal network and the
internet.1 They provide strong protection for the entire network by inspecting data
passing through the device.1 Suitable for large networks and organizations requiring
comprehensive network-level protection.1 Examples include routers with built-in
firewalls.4
● Software Firewalls:
These are programs installed on individual devices, such as computers and servers.1
They monitor and inspect data traffic directly from the system.1 Suitable for protecting
specific devices or applications.1 Examples include Windows Firewall.4
● Cloud-Based Firewalls:
Offered as a service (Firewall-as-a-Service) in cloud environments, such as those used
in Azure or Oracle Cloud Infrastructure (OCI) systems.6 They provide protection for
cloud infrastructure 7 and are characterized by flexibility and automatic scalability to
handle changing workloads.6 They can be added to the cloud environment without
disrupting existing network flows.18 A prominent example is Oracle Cloud Infrastructure
Network Firewall.18
The emergence of "cloud-based firewalls" and "managed native cloud network
firewalls" 6 is a direct response to the increasing shift towards cloud computing. With
organizations increasingly adopting cloud environments, relying on traditional physical
or software firewalls is no longer sufficient. This reflects a broader trend towards
"Security-as-a-Service" and the transition to a cloud security model. Cloud firewalls
offer advantages such as flexibility, automatic scalability, and simplified management,
making them essential for protecting dynamic cloud environments. This means that
organizations moving to the cloud must re-evaluate their security strategies to integrate
firewall solutions specifically designed for cloud environments.
● Hybrid Firewall:
This type combines the advantages of physical, software, and cloud firewalls to provide
a higher level of security.6
Table 1: Comparison of Key Firewall Types
Transport) 13
Inspection Inspects Tracks Inspects Intermediary Deep packet
Mechanism individual connection application between user inspection, IPS,
packets (IP, state and content and and service 12 application
Port, Protocol)analyzes protocols 1 control 2
4 2
context
Key Features Simple filtering, Connection Application IP masking, IPS,
relies on ACLs tracking, better content caching, anti-malware,
10
security 2 inspection, granular AI, SD-WAN,
application control 12 VPN 11
blocking 1
Advantages Simple, Higher security Granular Enhanced Comprehensiv
lightweight, than packet application security (no e protection,
11
low cost filtering, good control, direct advanced
2
performance advanced connection), threat
threat improved detection,
detection 2 privacy, integration 11
granular
control 12
Limitations Limited Does not Slower Bottleneck, Complexity,
security, no inspect deep performance, protocol high cost,
content application higher limitations, requires
inspection, content 2 complexity, complexity, continuous
vulnerable to resource single point of updates, may
spoofing 2 intensive 11
failure 12 require
additional
licenses 11
This table provides a quick overview and direct comparison between the main types of
firewalls. This summary helps the reader understand the evolution from simple firewalls to
more complex ones (NGFWs) and how each type responds to different security requirements.
It also supports the decision-making process for organizations when choosing the most
suitable firewall for their needs, by highlighting the trade-offs between security, performance,
and complexity.
5. Importance and Benefits of Firewalls
Firewalls play a pivotal role in cybersecurity, performing several essential tasks to maintain the
security of devices and networks.4 They provide an indispensable layer of security in security,
commercial, and even home sectors.7
● Preventing Unauthorized Access: The firewall monitors incoming and outgoing traffic,
preventing unauthorized access to your device or network by intruders or malicious
software.2 It acts as a gatekeeper, ensuring that only authorized and secure
connections are allowed.19
● Protection Against Cyberattacks: The firewall helps protect against cyberattacks
such as Distributed Denial of Service (DDoS) attacks and phishing attacks, which
attempt to exploit network vulnerabilities.4 It helps mitigate malware threats by filtering
traffic and preventing malware entry.2
● Controlling Applications and Services: The firewall can be configured to allow only
certain applications and services to run while blocking others, protecting the device
from applications that may contain malicious software.1 It enables administrators to
define rules that allow access to specific parts of the network.1
● Monitoring Suspicious Activities: The firewall monitors unusual network activities and
alerts the user if suspicious activities or intrusion attempts are detected.4 It provides an
activity log (Logging and Monitoring) that allows for data traffic analysis.6
● Protecting Sensitive Data and Connected Devices: The firewall helps prevent the
leakage of sensitive personal data such as passwords or banking information by
controlling permitted network traffic.1 It acts as a barrier to protect devices connected
to the network, whether in home or enterprise networks.4
● Network Address Translation (NAT) and Port Forwarding: Firewalls often include
Network Address Translation (NAT) capabilities, which allow multiple devices within the
network to share a single public IP address.1 NAT conceals internal IP addresses, making
it difficult for external attackers to identify and target specific devices on the network.1
Additionally, firewalls can use port forwarding, redirecting incoming traffic to specific
internal devices or servers, enabling secure hosting of services behind the firewall.19
NAT is often viewed merely as a mechanism for providing IP addresses, but its security
role extends far beyond that. It "conceals the identities of individual devices within the
network," "provides an additional layer of security," and "makes it difficult for external
attackers to identify and target specific devices".1 This reveals that NAT is not just a
technical function but a fundamental security feature that contributes to Network
Topology Obscurity. By hiding private IP addresses behind a single public IP address,
NAT significantly reduces the attack surface and makes the internal network less
vulnerable to direct reconnaissance and targeted attacks from outside, greatly
enhancing network privacy and security.
6. Limitations of Firewalls
Despite their critical importance, firewalls are not a magic bullet for cybersecurity and have
their own limitations. These limitations must be understood to ensure a comprehensive and
effective security strategy.
● What a Firewall Cannot Protect Against:
○ Internal Threats: Firewalls are primarily designed to protect against external
attacks. However, they may not be effective against threats originating from within
the network, such as malicious employees or compromised devices that have
managed to bypass initial defenses.17
○ Attacks Bypassing Protocols: Some modern attacks can bypass standard
network protocols, making them difficult for traditional firewalls to detect.17
○ Zero-Day Attacks: Traditional firewalls that rely on predefined rules or known
signatures may be slow in detecting new and unknown threats, known as
"zero-day attacks".17 These attacks require next-generation firewalls with
behavioral analysis and artificial intelligence capabilities.
○ Advanced Malware: Firewalls alone cannot fully combat all types of viruses and
malware.7
● Difference Between Firewalls and Antivirus Software:
There is a fundamental difference in the function of firewalls and antivirus software 7:
○ Firewall: Prevents threats before they enter the device or network.7 It acts as a
gatekeeper at the perimeter.
○ Antivirus Software: Deals with malicious programs after they have already
infected the device.7 It works to clean and remove threats that have managed to
enter. Sources 7 confirm that a firewall does not replace antivirus software, and
organizations need to combine them. This clear distinction between the functions
of firewalls and antivirus is not just a detail; it is the cornerstone of a broader
security concept known as "Defense-in-Depth." This concept emphasizes the
importance of a multi-layered security strategy, where no single security solution
is sufficient for complete protection. Firewalls (as the first line of defense at the
perimeter) must integrate with antivirus software (for endpoint protection),
Intrusion Detection Systems (IDS), Security Information and Event Management
(SIEM) systems, and other tools to create multiple layers of protection. This
significantly reduces the likelihood of a successful attack even if one layer of
defense is breached.
● Importance of Correct Configuration and Continuous Updates:
A firewall relies on predefined rules, meaning that any configuration error could lead to
blocking authorized access or, worse, allowing unauthorized access.7 Firewall updates
provide protection against new threats, so it is essential to ensure that the firewall is
continuously updated.4 Opening ports on a router may pose potential security risks if
not handled carefully.21
7. Firewall Deployment Scenarios
Firewall deployment scenarios vary to suit different environments and security needs, from
simple home networks to complex cloud infrastructures.
● Home Networks:
In home networks, firewalls are often integrated into routers.4 Software firewalls
installed on individual computers (such as Windows Firewall) can also be used to
provide customized protection for each device.4 These firewalls act as a barrier to
protect devices connected to the home network from external risks.4
● Corporate and Enterprise Networks:
Organizations typically use robust physical firewalls (Hardware Firewalls) placed at the
network's ingress or egress to monitor all data passing through it.1 Next-Generation
Firewalls (NGFWs) are also widely used in large enterprises to provide comprehensive
protection against modern threats, including application inspection and intrusion
prevention.2 Firewalls can control which websites employees can visit and which
programs they can run, reducing the likelihood of exposure to threats.1
In corporate environments, firewalls can be categorized into:
○ Network Firewalls: Control the flow of traffic into and out of network segments,
helping to isolate traffic.11
○ Host Firewalls: Control the flow of traffic into and out of individual devices, where
each workstation and server is likely to have its own firewall.11
● Cloud Environments:
With increasing reliance on cloud computing, cloud-based firewalls have become
essential for protecting resources and data in virtual environments.6
Example: Oracle Cloud Infrastructure (OCI) Network Firewall:
Offered as a native managed cloud service, powered by Palo Alto Networks NGFW
technology.18 It is deployed as a highly scalable instance within a specific Virtual Cloud
Network (VCN).18
Common deployment scenarios in OCI include:
○ Securing traffic between on-premises environments and OCI.18
○ Securing traffic between OCI and the internet.18
○ Securing traffic between different Virtual Cloud Networks (VCNs) within OCI.18
Benefits in cloud environments include:
○ Transparent Integration: Can be added without disrupting existing network
flows.18
○ Granular and Customizable Security Policies: Including traditional protocol
filtering and application traffic recognition (as of mid-2024).18
○ Advanced Threat Protection: Integrates a sophisticated threat engine for
automatic defense against known malware and command-and-control attacks.18
○ Fully Managed Service: Simplifies security operations by offloading
infrastructure management to the cloud provider.18
○ Flexibility and Scalability: Automatically scales to handle varying traffic loads,
ensuring consistent performance and protection.6
○ SSL Inspection: Ability to decrypt and inspect encrypted traffic for threats.18
8. Conclusion and Recommendations
Works cited
1. جدران الجماية | التحكم في مرور بيانات الشركة عبرfirewall | الحماية تبدأ..., accessed May 25, 2025,
https://my-communication.com/firewall/
2. What Is the Purpose of a Firewall in Network Security? - Performance Networks,
accessed May 25, 2025,
https://www.performancenetworks.co.uk/blog/what-is-the-purpose-of-a-firewall
-in-network-security/
3. my-communication.com, accessed May 25, 2025,
https://my-communication.com/firewall/#:~:text=%D8%AC%D8%AF%D8%A7%D8
%B1%20%D8%A7%D9%84%D8%AD%D9%85%D8%A7%D9%8A%D8%A9%20%D
9%87%D9%88%20%D9%86%D8%B8%D8%A7%D9%85%20%D8%A3%D9%85%D
9%86%D9%8A,%D9%83%D9%8A%D9%81%20%D9%8A%D8%AA%D9%85%D9%
91%20%D8%B0%D9%84%D9%83%D8%9F
4. ما الجدار الناريFirewall اليوم السابع- ؟ وما دوره فى حماية أجهزتك؟, accessed May 25, 2025,
https://www.youm7.com/story/2024/10/13/%D9%85%D8%A7-%D8%A7%D9%84%
D8%AC%D8%AF%D8%A7%D8%B1-%D8%A7%D9%84%D9%86%D8%A7%D8%B1
%D9%8A-Firewall-%D9%88%D9%85%D8%A7-%D8%AF%D9%88%D8%B1%D9%8
7-%D9%81%D9%89-%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A3%D
8%AC%D9%87%D8%B2%D8%AA%D9%83/6740037
5. What is a Firewall? | Firewall Definition - Palo Alto Networks, accessed May 25,
2025, https://www.paloaltonetworks.com/cyberpedia/what-is-a-firewall
6. كيف تحمي الجدران النارية بياناتك من الهجمات اإللكترونية؟ شرح مبسّط..., accessed May 25, 2025,
https://azaitech.com/%D9%85%D8%A7%D9%87%D9%8A-%D9%88%D8%B8%D9
%8A%D9%81%D8%A9-%D8%A7%D9%84%D8%AC%D8%AF%D8%B1%D8%A7%
D9%86-%D8%A7%D9%84%D9%86%D8%A7%D8%B1%D9%8A%D8%A9-firewall-
%D9%88%D9%85%D9%87%D9%85%D8%AA%D9%87%D8%A7-%D9%81/
7. :: مكونات جدار الحماية..., accessed May 25, 2025,
https://bacuratec.sa/firewall-components/
8. help.eset.com, accessed May 25, 2025,
https://help.eset.com/ees/10.1/ar-EG/idh_config_epfw_basic_group.html#:~:text=
%D8%AC%D8%AF%D8%A7%D8%B1%20%D8%AD%D9%85%D8%A7%D9%8A%D
8%A9,%D8%A7%D9%84%D8%AE%D8%AF%D9%85%D8%A7%D8%AA%20%D8%
A7%D9%84%D8%AA%D9%8A%20%D8%AA%D8%AD%D9%85%D9%84%20%D8
%AA%D9%87%D8%AF%D9%8A%D8%AF%D8%A7%D8%AA%20%D9%85%D8%A
D%D8%AA%D9%85%D9%84%D8%A9.
9. | جدار الحمايةESET Endpoint Security, accessed May 25, 2025,
https://help.eset.com/ees/10.1/ar-EG/idh_config_epfw_basic_group.html
10.What Are Firewall Rules? | Firewall Rules Explained - Palo Alto Networks, accessed
May 25, 2025,
https://www.paloaltonetworks.com/cyberpedia/what-are-firewall-rules
11. روبودين- ً مقدمة قصيرة جدا- جدار الحماية, accessed May 25, 2025,
https://robodin.com/fire-wall/
12.What Is a Proxy Firewall? | Proxy Firewall Defined & Explained ..., accessed May 25,
2025, https://www.paloaltonetworks.com/cyberpedia/what-is-a-proxy-firewall
13.What is a Proxy Firewall? | NordLayer Learn, accessed May 25, 2025,
⚡️
https://nordlayer.com/learn/firewall/proxy/
14.Guide To Fortinet Firewall Types latest FortiGate Firewalls - Netwise
Technology, accessed May 25, 2025,
https://netwisetech.ae/fortinet-firewall-types
15.FortiGate Next Generation Firewall - Fortinet - Konverge | Technologies,
accessed May 25, 2025, https://konverge.co.in/fortinet-firewall/
16.How Cisco ASA Firewall Secures Your Business Data - NetCom Learning,
accessed May 25, 2025,
https://www.netcomlearning.com/blog/Everything-You-Need-to-Know-About-Ci
sco-ASA-Firewall
17. حلقة الوصل- ماهو الجدار الناري وهل يغني عن برامج الحماية من الفيروسات؟, accessed May 25, 2025,
https://linktek.net/%D9%85%D8%A7%D9%87%D9%88-%D8%A7%D9%84%D8%A
C%D8%AF%D8%A7%D8%B1-%D8%A7%D9%84%D9%86%D8%A7%D8%B1%D9%
8A/
18. | جدار حماية الشبكةOracle اإلمارات العربية المتحدة, accessed May 25, 2025,
https://www.oracle.com/ae-ar/cloud/networking/network-firewall/
19. :: أمان الشبكة- FasterCapital, accessed May 25, 2025,
https://fastercapital.com/arabpreneur/%D8%A3%D9%85%D8%A7%D9%86-%D8
%A7%D9%84%D8%B4%D8%A8%D9%83%D8%A9--%D8%AF%D9%88%D8%B1-
%D8%AC%D8%AF%D8%B1%D8%A7%D9%86-%D8%A7%D9%84%D8%AD%D9%
85%D8%A7%D9%8A%D8%A9-%D9%81%D9%8A-%D8%B6%D9%85%D8%A7%D
9%86-%D8%A3%D9%85%D9%86-%D8%A7%D9%84%D8%B4%D8%A8%D9%83
%D8%A9.html
20. جدار حمايةNAT: تعزيز األمان في المجال الرقمي- VPN Wiki - FineVPN ..., accessed May 25,
2025, https://finevpn.org/ar/glossary/nat-firewall/
21.5465 - إعدادات جدار الحمايةWireless MAXg Router: دليل مستخدم جهاز, accessed May 25,
2025, https://support.usr.com/support/5465/5465-ar-ug/firewall.html