Introduction Firewalls force all network packets in and out of an organization through a single controlled point, thus isolating the traffic on the insecure Internet from the internal networks within the organization. At the entry point, firewalls filter the incoming and outgoing traffic according to a well-defined security policy, deciding what data or services are available to the network nodes on the two sides of the firewall.
Firewalls perform security checks by inspecting each passing packet.
The levels of security provided by firewalls thus depend on how thoroughly firewalls examine the bits within the packets. Modern network-level packet filters have become increasingly sophisticated, and now maintain information about the state of connections passing through them, some of the packet contents, etc. Application-level proxies or gateways mediate traffic between a protected network and the Internet by actually interpreting a small portion of the bytes in the packets. Proxies prevent remote network nodes from establishing direct connections to the nodes inside the firewall. In particular, proxies usually hide the internal network from the outside world by performing network address translation, so that the only externally visible network address is the firewall's own.