How Firewall Works?

Firewalls are the backbone of network security, acting as gatekeepers to filter incoming and outgoing traffic based on predefined security rules. Whether hardware-based or software-based, firewalls play a crucial role in preventing unauthorized access while allowing legitimate communication.

How a Firewall Operates

1. Packet Filtering – Inspects packets (data chunks) based on IP addresses, ports, and protocols.
2. Stateful Inspection – Tracks active connections to detect suspicious traffic patterns.
3. Application-Level Filtering – Analyzes payload content (e.g., HTTP requests) for malicious activity.
4. Proxy Service – Acts as an intermediary, masking internal network details.
5. Next-Gen Firewalls (NGFW) – Integrate intrusion detection (IDS), deep packet inspection (DPI), and threat intelligence.

You Should Know:

Linux Firewall Commands (iptables/nftables)

 View current firewall rules 
sudo iptables -L

Allow incoming SSH (Port 22) 
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Block an IP address 
sudo iptables -A INPUT -s 192.168.1.100 -j DROP

Save rules (Debian/Ubuntu) 
sudo iptables-save > /etc/iptables/rules.v4

For nftables (modern replacement) 
sudo nft list ruleset 

Windows Firewall (PowerShell)

 Check firewall status 
Get-NetFirewallProfile | Select-Object Name, Enabled

Allow an app through firewall 
New-NetFirewallRule -DisplayName "Allow HTTP" -Direction Inbound -Protocol TCP -LocalPort 80 -Action Allow

Block outbound traffic to an IP 
New-NetFirewallRule -DisplayName "Block Malicious IP" -Direction Outbound -RemoteAddress 123.45.67.89 -Action Block 

Cloud Firewalls (AWS/Azure/GCP)

• AWS Security Groups:

  aws ec2 authorize-security-group-ingress --group-id sg-123abc --protocol tcp --port 443 --cidr 0.0.0.0/0 
  

• Azure NSG:

  az network nsg rule create --nsg-name MyNSG --name AllowHTTPS --priority 100 --access Allow --protocol Tcp --direction Inbound --source-address-prefixes  --source-port-ranges  --destination-port-ranges 443 
  

Testing Firewall Rules

 Check open ports (Linux) 
nc -zv example.com 80

Windows equivalent 
Test-NetConnection -ComputerName example.com -Port 80 

What Undercode Say

Firewalls are essential but not foolproof. Combine them with:
– Intrusion Detection Systems (IDS) – `suricata -c /etc/suricata/suricata.yaml`
– VPNs for encrypted traffic – `openvpn –config client.ovpn`
– Regular log audits – `journalctl -u firewalld` (Linux) or `Get-WinEvent -FilterHashtable @{LogName=’Security’}` (Windows).

Always update firewall rules and monitor logs for anomalies. A misconfigured firewall can be worse than none at all.

Expected Output:

A secure, well-monitored network with minimal unauthorized access, logged traffic patterns, and adaptive rules to counter evolving threats.

Further Reading:

• Linux iptables Tutorial
• Microsoft Firewall Docs
• AWS Security Groups

References:

Reported By: Jainyashaswi Cloudsecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram