Bridge WAF
What is a firewall?
A firewall is a control point that sits between networks, or on a single machine, and decides which connections are allowed through. It judges each connection by rules about addresses, ports and protocols rather than by what the traffic says. Its purpose is to keep unwanted connections out and let expected ones in. This entry of the glossary gives the computer firewall definition for the classic kind, which works from addresses and ports.
How it works
Rules are written as simple conditions: this source address, this destination port, this protocol, allow or refuse. Each connection is checked against them in order, and in many rule sets the first match decides. In a default-deny setup, anything no rule allows is refused, which is the safer default.
Where a firewall runs sets its kind. A network based firewall stands at the edge of a network and filters everything crossing it. A host based firewall runs on one machine and filters only that machine's traffic. Both work from the same rule shape. Because they read addresses and ports, they work at the levels described under layer 3 and 4 in the OSI model.
Why it matters
A service should be reachable on the ports it needs and closed on the rest. A firewall makes that a rule instead of a hope: at the network edge, a database port can be closed to the internet while the web port stays open. That is the purpose of a firewall in practice, and the firewall protection it gives a network: fewer open ports, fewer addresses that can reach them, and a clear list of rules to review.
The limit follows from the same design. A web request to an open port looks permitted to a firewall, because its address, port and protocol all match the rules. What the request asks for is not part of the decision. Judging the content of requests is the job of a web application firewall, and how the two differ is set out in WAF vs firewall.
What a firewall does not do
A firewall of this kind does not read the content of a request. Its firewall rules cover addresses, ports and protocols, and stop there, so the firewall cannot tell two requests apart when both use the same open port and protocol. It does not repair a weakness inside an application. It cannot judge traffic that never passes through it, such as a connection that is already inside the network. The rules also need upkeep: a rule for ports and addresses written for last year's layout can block a service that is meant to work, or leave open one that should be closed.
A firewall is one layer of several. Which layer sees which kind of problem is the question behind any firewall choice, and the honest answer is that each sees its own part.
Related terms
These entries cover the terms closest to this one.
- Web application firewall: the kind that reads the content of requests, where a network based firewall or a host based firewall reads only addresses, ports and protocols.
- OSI model: the layered description of a network that shows where those rules apply.
- Layer 3 and 4: the levels at which addresses, ports and protocols are visible to a firewall.
Back to the glossary.