Application gateway proxies give you control over which applications are allowed through the firewall, but packet inspection can be a more efficient system of protection. System security isn't easy, so choose a firewall that works on a platform with which you are familiar. Hardware firewall appliances can be easier to install than software, but software products give you more flexibility. Some firewall products include virtual private network features, but a VPN functions separately from a firewall. No matter what product you buy, do not expect it to solve the problem on its own.
Effective security requires active management.
When a host inside the private intranet wants to connect to a Web site, it sends its request to the NAT box, which translates the packet so that the request appears to be coming from the NAT box itself. When a response comes in, the packet goes directly to the NAT box, which again translates the packet and resends it within the private intranet. NAT originated as a stopgap remedy for the shortage of IP addresses, but it is often used as a security remedy. It is far from a security panacea, as it can introduce as many problems as it solves, but it is often incorporated into firewall products. The market is sufficiently mature to require greater product differentiation, so firewalls now frequently include content filtering modules capable of detecting viruses and malicious Java or ActiveX code.