This is better than packet filtering but still falls short of total security. These proxies take external requests, examine them and forward legitimate requests to the internal host that provides the appropriate service. Application gateways can support functions such as user authentication and logging. The use of proxies for different services prevents direct access to services on the internal network, protecting the enterprise against insecure or misconfigured internal hosts. Strong user authentication can be enforced with application gateways.
Proxies can provide detailed logging at the application level.
Application level firewalls shall be configured such that out-bound network traffic appears as if the traffic had originated from the firewall. In this manner, direct access to network services on the internal network is not allowed. Applications gateways require a proxy for each service, such as FTP, HTTP, etc., to be supported through the firewall. Deny the services until the firewall vendor has developed a secure proxy - this is the preferred approach, as many newly introduced Internet services have unacceptable vulnerabilities. Develop a custom proxy - this is a fairly difficult task and should be undertaken only by very sophisticated technical organizations.