1

Is it possible to use a firewall appliance as WAF? To make it more clear, lets think of a model like this:

Internet > router > Firewall > webserver

Can the firewall act as a WAF and block some special http requests according to some rule sets?

My question is about the possibility of this matter, maybe there are a few firewalls which can and many others that can't.

Improve this question
4
  • "firewall appliance" is a very broad term and includes a range of devices, i.e. simple layer 3/4 filtering, DPI, proxies ... . Some of these have this kind of inspection depth, some don't. And "... some special http requests according to some rule sets ..." is similar broad. What kind of functionality do you exactly need? "some special" does not say anything useful. If you need WAF functionality you need a WAF or some appliance which includes a WAF. If you need something less than a WAF specify exactly what you need.
    – Steffen Ullrich
    May 3, 2021 at 6:46
  • 1
    You've just asked, "can a firewall be used as a firewall?" The answer appears obvious. I suspect that you have some undisclosed context or requirements, else the question makes no sense.
    – schroeder ♦
    May 3, 2021 at 7:07
  • If you just want to know if it is possible, as you now state in your question, this is easily and quickly googled. Please do at least a little research before posting questions here.
    – schroeder ♦
    May 3, 2021 at 16:54
  • thank you my friend @schroeder. Firewalls and WAFs are two different things as you know, ofc both block or filter or ... but they are not the same. So I didn't ask "can a firewall be used as a firewall?". The differences between these 2 brought this question to my mind. And I googled it and didn't get any clear answer and this is one step that might help me for other ends. As you can see there are others who got my question and gave me the answer I seek. A simple "yes Conceptually" that brought a series of other questions.
    – Miky1992
    May 5, 2021 at 7:52

1 Answer 1

Reset to default
1

Yes. Conceptually, a firewall appliance (or a firewall application) will be able to distinguish between HTTP and HTTPS requests and, in the case of HTTP requests, will be able to view all the data being transmitted (not just the domain and IP). It can then block or modify any data going through. Not all firewalls have this capability, however. You will need to find one that meets your requirements.

You can also do this with HTTPS requests if you have a firewall that supports TLS interception, but then you'll need to install the firewall appliance's root certificate into your browser for it to trust it.

Improve this answer
5
  • "A firewall appliance" - whatever this exactly is. This describes a broad range of devices. A simple layer 4 firewall appliance can only filter based on IP and port.
    – Steffen Ullrich
    May 3, 2021 at 6:42
  • @SteffenUllrich Yeah, it does depend on what it is. I was thinking something along the lines of pfsense or another hardware-based firewall. My point is that firewalls can do this in general, not that all firewall implementations are capable of it.
    – forest
    May 3, 2021 at 6:46
  • @forest: There are firewall which can do this - since many firewalls have WAF functionality built in. Firewalls which don't have such functionality might do a bit of it with IDS signatures (if they have these) - but it is unclear if this is sufficient for the weakly described use case ("some special http requests"). So in essence: if the firewall has the functionality it can do it. But not all firewalls have the functionality. Therefore I don't agree with the generic "A firewall appliance ... will be able ..." in your answer.
    – Steffen Ullrich
    May 3, 2021 at 6:52
  • @SteffenUllrich Thanks. I've edited my answer to include that point.
    – forest
    May 3, 2021 at 6:59
  • 1
    TLS interception is not required. If the firewall can do "TLS termination", you can simply install the cert on the firewall. But, then, the OP states HTTP, not HTTPS, so I'm not sure that the TLS parts of the answer are within scope. But I'm not sure what the OP's requirements are. All in all, the answer is "if the firewall can do it, then it can do it..."
    – schroeder ♦
    May 3, 2021 at 7:31

Not the answer you're looking for? Browse other questions tagged .