Firewalls: Types, Generations, and Network Architectures

Firewalls are one of those things everyone has heard of but few people actually understand beyond "it blocks bad traffic." In reality, firewalls have gone through decades of evolution, and the differences between each generation matter a lot when you are designing or securing a network.

This is Topic 5 in my series on network security. Let's break down what firewalls actually do, the four generations of firewall technology, and the architectures that put them to work.

What Firewalls Actually Protect Against (and What They Don't)#

A firewall monitors and controls traffic based on security rules. Simple enough. But there is a common misconception that a firewall is a complete security solution. It is not.

What firewalls cannot protect against:

• Insider attacks - if the threat is already inside your network, the firewall is irrelevant
• Connections that bypass it - rogue wireless access points or VPN tunnels that skip the firewall entirely
• Malware in encrypted traffic - if traffic is encrypted, the firewall cannot inspect the payload (unless it has SSL decryption)
• Social engineering - no firewall stops a user from clicking a phishing link

Understanding these limitations is just as important as understanding what firewalls do well. A firewall is one layer in a defense-in-depth strategy, not the whole strategy.

The Four Generations of Firewalls#

1st Generation: Packet Filter (Stateless)#

The original firewall concept. Operates at OSI Layers 3 and 4.

Each packet is examined individually based on source/destination IP, MAC address, protocol, and ports. After making a permit or deny decision, the firewall forgets about the packet entirely. There is no memory of previous packets or connections.

Strengths: High performance, scalable, works as a solid first line of defense.

Weaknesses: No application-layer awareness. Cannot track connection state, so it cannot tell the difference between a legitimate response and an unsolicited inbound packet.

2nd Generation: Stateful Firewalls#

This was a major leap. Stateful firewalls operate at Layers 3, 4, and 5, and they maintain a state table that tracks every active connection.

The firewall knows whether a packet is starting a new connection, belongs to an existing one, or is terminating a session. This means return traffic is automatically allowed for established connections. No need to write explicit rules for response packets.

Stateful firewalls can also detect attacks like SYN floods by monitoring connection states and spotting anomalies.

3rd Generation: Application-Level Firewalls#

This generation splits into two approaches:

Proxy Firewalls create separate connections with both the client and the server. The direct connection between them is broken. The firewall reconstructs packets, which means it can sanitize malicious content. The downside is that you need a separate proxy for each application protocol (HTTP, FTP, etc.), and the CPU overhead is significant.

Deep Packet Inspection (DPI) works transparently without breaking connections. It filters across all 7 OSI layers, can categorize traffic by application (Skype, BitTorrent, etc.), and provides IDS/IPS functionality. It can also inspect outbound traffic to prevent data exfiltration.

4th Generation: Next-Generation Firewalls (NGFW)#

NGFWs combine everything from previous generations and add:

• Application awareness - identifies applications regardless of port
• Deep packet inspection with anti-malware
• Integrated IPS
• SSL decryption - can inspect encrypted traffic
• Policy based on applications, users, and content rather than just IP and port

ML-Powered NGFWs (2020+)#

The latest evolution adds machine learning:

• Inline ML inspection - files are analyzed during download and blocked instantly if malicious
• Zero-delay signatures - threat signatures updated within seconds
• ML-powered IoT visibility - automated security for IoT devices
• Automated policy recommendations based on behavioral analysis

Firewall Architectures#

Having a good firewall is not enough. Where and how you deploy it matters just as much.

Dual-Homed (Two-Leg Perimeter)#

The simplest setup. The firewall has two interfaces connecting two networks (typically internal and external). A special case of this is a screening router, where the router itself acts as the firewall.

Single-Homed Bastion Host#

A heavily secured server that provides proxy services. Internet hosts can only connect to the bastion host, never directly to internal systems.

Screened Host#

Combines a screening router with a bastion host. The router filters traffic at the packet level, while the bastion host handles application-level filtering. No single point of failure, but if the bastion host gets compromised, the attacker is inside the intranet.

Screened Subnet#

This is where things get interesting. A perimeter network sits between the internal network and the Internet:

• External router (Access router) protects the perimeter from the Internet
• Perimeter network contains the bastion host. If the bastion is compromised, the attacker is contained in the perimeter
• Internal router (Choke router) controls access to the internal network

Even if an attacker takes over the bastion host, they are still separated from the internal network by the choke router. This is the key insight of the screened subnet design.

Multi-Homed (Three-Leg Perimeter / DMZ)#

The firewall has three or more interfaces: internal, external, and DMZ. This leads us to one of the most important concepts in network architecture.

The DMZ#

The DMZ (Demilitarized Zone) is a perimeter network segment that exposes services to the untrusted network without exposing the internal network.

Key points about the DMZ:

• Its security level is different from both the internal and external networks. It is not "inside" or "outside." It is its own zone
• External attackers cannot reach the internal network directly, even if they compromise a DMZ server
• Typical DMZ services: web servers, email servers, DNS servers, FTP servers

The DMZ is one of the most fundamental concepts in network security architecture, and it comes up constantly in both real-world design and security exams.

CBAC: The Predecessor to Modern Zone-Based Firewalls#

Context-Based Access Control (CBAC) was introduced in 1997 as a Cisco IOS feature. It provided stateful packet filtering at Layer 5, tracked TCP connections, detected SYN floods, and could dynamically create temporary ACL entries for return traffic.

CBAC had one critical weakness: its default policy was allow all. This meant that any traffic not explicitly filtered would pass through.

In 2006, CBAC was replaced by Zone-Based Policy Firewall (ZPF), which flipped the default to deny all. ZPF is the subject of the next post in this series.

Wrapping Up#

Firewalls have come a long way from simple packet filters to ML-powered next-gen devices. But the core principles remain the same: control traffic flow, enforce security policies, and create boundaries between trust zones.

The architecture matters just as much as the technology. A next-gen firewall deployed incorrectly is less effective than a properly architected screened subnet with basic stateful filtering.

Next up: Zone-Based Policy Firewall (ZPF) and how it structures security into zones with explicit policies.

This is part of my study series on Security of Computer Networks and Clouds.