Patent ID: 7284269

Claim:
A firewall for a data communications network, comprising: an ingress module connected to the communications network on a first side of the firewall; an egress module connected to the communications network on a second side of the firewall; a modular structure having a plurality of sets of a plurality of modules each, the sets being arranged in series such that one set is upstream of the egress module and the remaining sets are upstream of exactly one of the sets, and such that one set is downstream of the ingress module and the remaining sets are downstream of exactly one of the sets; for each module in each of the sets, a plurality of connections, each connection coupling the module to one of the modules in the set downstream of the module's set; and for each module in each of the sets, a rule particular to that set, wherein each module in the modular structure forwards a data packet received from an upstream module to one of the modules in the set downstream of the module's set if the module determines that information within the data packet complies with the rule of the set to which the module belongs.