Implementing a packet filtering firewall requires that you have an intimate knowledge of how network protocols work, and which services are required on your network. Unlike packet filters, they work at the connection rather than the packet level. A host with a proxy server installed becomes both a server and a client, and acts as a choke between the final destination and the client. The application gateway listens for incoming client service requests, which it then forwards on to the destination supplied by the client. Once it has fulfilled this request, it forwards the data back to the client.
Application gateways maintain two separate connections between external and internal systems.
Internal systems, therefore, never speak directly to untrusted external systems. The proxy server only lets specific services in and out of the network. They are configured to only permit specific services in and out of the network they protect. Application gateways and packet filters can be combined to provide better security and flexibility than if either was used alone. Authentication can be added to this, restricting who is permitted access to the external network.