This method is more secure because the CERN HTTP server is a large, complex piece of code, and one of the basic rules of firewalls is that you should not run large, complex pieces of code on them. FTP and Telnet can be proxied with the FTP gateway and Telnet gateway from Trusted Information Systems' freely available Firewall Toolkit. Similarly, with the Telnet proxy, you always connect to the Telnet proxy on the firewall first, and then give the proxy a command to connect to the remote host. This may sound as though you are first logging onto the firewall, and then running the client, but in fact, the proxy method is much better. Except for making the initial connection, the proxy is transparent to the Macintosh client.
Commercial firewalls based on application-level gateways provide similar functionality.
Some make the gateway completely transparent to the user. The only consolation in this is that the Web browsers support multiple protocols, so you can still get to Gopher and WAIS resources through a firewall via a Web browser. Anarchie merits special attention, since Archie clients are a bit different from most other Macintosh clients. For example, you might travel to a customer site which has Internet access and find you need to FTP a file from your desktop workstation. One way to incorporate these devices into a firewall is to present the user with the challenge before access to the gateway is allowed.