Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?

share|improve this question

A simple packet filter firewall can only filter out packets based criteria such as source IP address and destination port number (e.g.80 and 443). But a packet from a trusted source IP address (e.g., an intranet host) and destined for port 80 (http) on the web server, may be allowed by a simple packet filter firewall. Yet that packet (well, that series of packets) can still contain malicious data, such as form input characters that make up an SQL injection attack against the web application.

share|improve this answer

A simple packet filter firewall might not necessarily be stateful, meaning it cannot look at the conversation not just the individual packets. In addition, these devices are not usually complex enough to deal with application (TCP/IP Layer 5) data and specifics. You might use a network level firewall to filter and block network attacks, but a web application firewall is designed to better deal with the specifics of HTTP requests at the application layer. Using a stateful Layer 3 firewall with a web application firewall would be a good combination.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.