Firewalls & IDS/IPS
Encryption protects data in transit, but a network also needs to control which traffic is allowed in and out at all. A firewall enforces that policy: it sits at a boundary and decides, packet by packet, what may pass. Detection systems then watch what does get through for signs of attack.
What firewalls filter on
Firewalls make decisions using fields available in the packet headers:
- IP addresses - source and destination.
- Ports - which service the traffic is headed for (443, 22, 3389, ...).
- Protocol and TCP flags - for example, is this a brand-new connection
(a bare
SYN) or part of an existing one?
Rules match on these fields and either permit or drop the packet.
Stateless vs stateful
The key distinction is whether the firewall remembers connections:
| Stateless filter | Stateful firewall | |
|---|---|---|
| Decision basis | Each packet judged in isolation | Tracks the state of each connection |
| Connection memory | None | Keeps a table of active connections |
| Return traffic | Needs an explicit rule | Automatically allows replies to permitted flows |
| Cost | Cheap and fast | More memory and processing |
| Security | Coarse - easy to fool | Finer - can reject packets that fit no known flow |
A stateless filter judges every packet on its own header fields. A stateful firewall remembers that a host inside opened a connection, so it can automatically permit the matching replies while blocking unsolicited inbound packets - far more precise.
A stateful firewall's connection table is not free. A typical entry (source and destination IP:port, protocol, TCP state, timers) runs somewhere around 150-300 bytes. Track 500,000 concurrent connections - a plausible number for a busy edge firewall - and that alone is 75-150 MB of memory, plus the CPU cost of a table lookup on every single packet, not just the first one of a flow. A SYN flood sending, say, 50,000 new half-open connections per second can fill a table sized for steady-state traffic within seconds, since each spoofed SYN consumes a table slot until it times out - which is exactly why appliances publish a "connections per second" limit as a headline spec, separate from raw throughput.
A stateful firewall only permits reply traffic that matches an entry it created when it saw the outbound (or inbound) request. That assumes every packet of a connection, in both directions, actually passes through the same firewall. In networks with multiple paths - ECMP load-shared links, BGP multi-homing, or a redundant pair of firewalls that are not state-synced - the request can go out through one path and the reply can come back through a different one. The returning firewall (or the same firewall on a different interface) has no matching state-table entry for that reply, so it silently drops a perfectly legitimate packet as "not part of any known connection." The symptom looks like random, intermittent connectivity failures that vanish when you disable one of the redundant paths - which is often the only clue that routing, not the firewall rules themselves, is the actual cause. The fix is either to force symmetric routing for stateful flows, or to run the firewall pair with active state synchronization so either box can match the reply.
DMZ
A DMZ (demilitarized zone) is a subnet between the internet and the internal network for servers that must be reachable from outside, such as a public web or mail server. Those hosts sit in the DMZ so that if one is compromised, the attacker still faces another firewall before reaching the trusted internal network.
IDS and IPS
Firewalls decide what is allowed; detection systems inspect the allowed traffic for attacks:
- An IDS (Intrusion Detection System) monitors traffic and alerts when it sees something suspicious.
- An IPS (Intrusion Prevention System) sits inline and can block the traffic it flags, not just report it.
Both detect in two ways. Signature-based detection matches traffic against a database of known attack patterns - accurate for known threats, blind to new ones. Anomaly-based detection learns a baseline of normal behavior and flags deviations - it can catch novel attacks but produces more false positives.
A sound firewall policy is default-deny: block everything, then explicitly allow only the traffic you need. The opposite (default-allow, block known-bad) means anything you forgot to consider gets through. Starting from deny turns every mistake into a blocked connection rather than an open hole.