I was reading about firewalls and I have this query.
Is each firewall a packet filter? Why or why not?
I know that the first generation of firewall's were essentially packet filters, but how does it work now?
Thanks
A firewall is just some device or software which filters the network traffic. This can be done at the packet level (usually called packet filter firewall (PFL) or layer 3,4 firewall) but also at the application level (usually called application level firewall (ALG), secure web/mail gateway (SG, SWG...) or similar). You'll often find both PFL and ALG technologies in modern firewalls, i.e. some filtering is done at the packet level and some at the application level.
With a packet filter the filtering is done based on properties of the packet at layer 4,3 or even 2 (i.e. Port, IP, Mac). With application level firewalls filtering is done on the content of the application layer, i.e. URL, type of the content etc. For example pure packet filters cannot block malware by its content while application level filters can do it. But pure packet filters can block download of the malware if the IP address (not hostname!) is known to propagate malware and thus communication with this IP address can be simply denied.
answered Jul 24 '16 at 17:04
-
And - actually - ALG's are not firewalls ;) they are an Application-Level Gateways, and the simpliest of them look/work like firewalls, but even an ordinary one of ALG's is a complete different kind of software – Alexey Vesnin Jul 24 '16 at 17:52
-
@AlexeyVesnin: "firewall" only describes a kind of separation device/software and not a specific technology. Such separation can be done at packet level or application level. Several of the so called NGFW (next generation firewalls) include application level gateways (filtering proxies). – Steffen Ullrich Jul 24 '16 at 20:37
-
agreed about NGFW, but - IMHO - ALG's are either NGFW or, mostly, DPI/DSI/IPS/IDS in some combo of mentioned techniques. In my opinion a firewall is a ruleset for filtering packets source+target+proto+flags, like IPFW – Alexey Vesnin Jul 24 '16 at 21:26
firewallpage on Wikipedia. – Aria Jul 24 '16 at 17:04