Hackers can fool such firewalls by forging source addresses via IP packet spoof- ing. Since client-server connections are direct, hackers can also use packet sniffers to discern a network s address structure with relative ease. In our library analogy, the equivalent of a packet-filtering firewall would be the librarian keeping a list of trusted students, then allowing only those individuals into the locked stack to retrieve books. This might make book retrieval faster, but it would require that a list be created and maintained. It would also be vulnerable to impostors who turn up at the front desk bearing fake IDs.
Proxy servers are different.
They start by performing network address translation, mapping all of a network s internal IP addresses to a single safe IP address. Since the latter is the only address the untrusted network is aware of, spoofing attacks are no longer possible. Because they operate at the Application layer of the OSI model, proxy servers can do a lot more. Each of these proxies accepts only packets generated by services it is designed to copy, forward, and filter. Application-specific proxies are almost infinitely configurable.