The levels of security provided by firewalls thus depend on how thoroughly firewalls examine the bits within the packets. Modern network-level packet filters have become increasingly sophisticated, and now maintain information about the state of connections passing through them, some of the packet contents, etc. Application-level proxies or gateways mediate traffic between a protected network and the Internet by actually interpreting a small portion of the bytes in the packets. Proxies prevent remote network nodes from establishing direct connections to the nodes inside the firewall. In particular, proxies usually hide the internal network from the outside world by performing network address translation, so that the only externally visible network address is the firewall's own.
Many proxies contain extra logging or support for user authentication.
As a result, the security policy implementation is hard-coded into the proxy code, and has to be developed on a protocol by protocol basis, e.g., one for HTTP and one for X windows, etc. In both cases, conventional firewalls do not inspect most of the bytes in the network packets that pass the filter rules. With the advent of mobile code such as Java applets or ActiveX controls, where code that is developed in one network node can be transported to and executed at another node, this assumption is no longer valid. Worse yet, the transport and execution of mobile code may be completely invisible to the end user, for example, via clicking a button on a WWW page, thus making the associated security threat even more serious. Just as conventional firewalls confine malicious break-in attempts within the firewall machines, active firewalls insulate the internal network from the damages caused by foreign code by executing all mobile programs on the firewalls.