Skip to content

📘 10-01: Firewalls & ACLs

Network Systems

Module 10: Security in Network Design

Home All Notes Practice Quiz

🧱 What a Firewall Does

A firewall filters traffic between network zones based on a rule set (policy) — permitting or denying by address, port, protocol, and more.

🧱 Firewall Types

Type Behavior
Stateless (packet filter) Checks each packet in isolation
Stateful Tracks connections; auto-allows legitimate return traffic
NGFW Adds deep packet inspection, app/user awareness, integrated IPS
WAF Protects web apps (SQLi, XSS) at Layer 7
UTM Bundles firewall + IPS + AV + content filter + VPN

Stateful firewalls understand sessions; stateless ones don't.

📌 Access Control Lists (ACLs)

An ACL is an ordered list of permit/deny rules matched top-down.

  • Match criteria: source/dest IP, port, protocol.
  • First match wins, then processing stops.
  • Ends with an implicit deny all — anything not permitted is dropped.
  • Applied inbound or outbound on an interface.

📌 Directions of Filtering

Direction Purpose
Ingress Filter traffic coming in (block external threats)
Egress Filter outbound (stop exfiltration, malware call-home, spoofed sources)

🧭 Rule Order Scenario

ACL and firewall rules are evaluated in order. A broad rule placed too early can override a more specific rule below it.

Example policy goal:

  • Allow users to browse the web.
  • Allow IT administrators to SSH to network devices.
  • Block all other inbound management traffic.

Better rule order:

  1. Permit admin subnet to SSH to device-management subnet.
  2. Permit user subnets to HTTP/HTTPS as required.
  3. Deny other management traffic.
  4. Deny everything else by default.

If the deny rule is placed before the admin SSH permit, legitimate admin traffic is blocked. If a broad permit is placed first, unwanted traffic may bypass the intended restrictions.

Tip

Key idea — Firewalls enforce policy between zones. Stateful > stateless; NGFW adds app-awareness/IPS. ACLs are ordered, first-match, with an implicit deny at the end.

See also: IDS & IPS, Secure Network Design