A proxy usually controls HTTP(S) traffic going outbound. IE it can be blocked, and so forth. How is this different to a firewall working on port 80/443?

Also, if a firewall is to control outbound http(s) traffic, how can it block ads? Would that not be a reverse proxy?

  • To help you differentiate, you have to change your terms: a proxy controls the content outbound, not general traffic. Firewalls allow traffic, proxies allow content (which can sometime look like blocking traffic).
    – schroeder
    Oct 18, 2014 at 22:05

3 Answers 3


I would recommend doing a little reading on the OSI model. It might help shed a little light on this, but I will give you a brief overview so this makes more sense. Remember that these concepts can blend together and a firewall could have all of these features.

A traditional network firewall operates at layer 3 and layer 4 of the OSI model, which is IP addressing/ICMP and TCP/UDP. In its simplest sense, it's a hierarchical rule chain that blocks or allows specific packets which match a specific criteria. This type of firewall implementation has little to no awareness of "higher" layers of the OSI model.

An application proxy is typically said to exist at layer 7 of the OSI model, the application layer. These proxies must understand the protocols that they proxy, such as HTTP. A firewall can often have these features as well. A web proxy, with its awareness of web protocols, can have content filtering features which could filter ads. A device or software package described as a firewall could have these features. These are typically called application firewalls or layer 7 firewalls.


A normal firewall typically works on Layer 3 and 4 of OSI model, a proxy can work on Layer 7. Also another thing that a proxy does is: anonymise the requests.

E.g.: A normal firewall can block based on destination / origin IP or TCP/UDP ports. A proxy can block based on protocol (https) and / or url (http://stackexchange.com)...

Now most of the modern firewalls can have the same functions of the proxies making hard to distinguish from them but all is related with power and logic...

To have a fast firewall in is work we should not have it doing more than what is necessary. this makes harder to cause a denial of service. Also having powerful firewalls can make us expend lots of more money.


The word "firewall" just describes some device or software to separate security zones. It is not a description of a specific technical implementation. Implementation range from simple packet filters like iptables at OSI layer 3..4 up to application level gateways at OSI layer 7. (Application) proxies instead refer to forwarding a protocol at the application level (layer 7). Firewalls can also include proxies for deeper protocol inspection, like Sophos NGFW (formerly Astaro) does.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .