Because proxy servers and firewalls are so often bundled together, people often confuse the two. However, a packet-filtering firewall operates at the Network layer of the OSI model, while proxy servers work at the Application layer. Packet filters use routers to filter information coming to and from a network. On the other hand, creating complex access rules can be difficult. Further, all packet filters can do is grant or deny access based on a packet s apparent source or destination address.
Hackers can fool such firewalls by forging source addresses via IP packet spoof- ing.
Since client-server connections are direct, hackers can also use packet sniffers to discern a network s address structure with relative ease. In our library analogy, the equivalent of a packet-filtering firewall would be the librarian keeping a list of trusted students, then allowing only those individuals into the locked stack to retrieve books. This might make book retrieval faster, but it would require that a list be created and maintained. It would also be vulnerable to impostors who turn up at the front desk bearing fake IDs. Proxy servers are different.