How Does a Firewall Work?

There are five main types of firewall architectures: packet-filtering, stateful inspection, circuit-level, application-level and next-generation. But which one is right for your business's cybersecurity needs?

Packet-filtering firewalls are the original and most basic type of firewall structure. They create a checkpoint at a traffic router or switch, performing a simple check of the data packets coming through the router, inspecting information such as the destination and origination IP address, packet type, port number and other surface-level information without opening the packet to inspect the contents further.

Packets that don't meet a set of established criteria are not forwarded and cease to exist. Packet-filtering firewalls are relatively simple and don't have a large impact on system perform because they aren't very resource-intensive. However, this means that they are easier to bypass compared to firewalls with more in-depth inspection capabilities.
 

Circuit-level gateways are another type of firewall that quickly approve or deny traffic without consuming significant computing resources. These firewalls monitor the transmission control protocol (TCP) handshakes across the network to determine if the session being initiated is legitimate and whether the remote system can be trusted.

While circuit-level gateways are not resource-intensive, just like packet-filtering firewalls, they are also easy to bypass. This firewall does not check the packet itself, so a packet containing malware can pass through if it had the right TCP handshake.
 

Stateful inspection firewalls combine the previous two architecture offerings into a greater level of protection than a packet-filtering firewall and circuit-level gateway could provide alone. This firewall examines each packet and verifies the TCP handshake — offering more security than the other firewalls but putting a greater strain on your computing resources.

Stateful inspection firewalls do exact a greater toll on network performance and could slow down the transfer of legitimate packets compared to other solutions.
 

Application-level gateways, also known as proxy firewalls, also combine elements of packet-filtering and TCP handshake verification. Proxy firewalls operate at the application layer, hence the name, to filter incoming traffic between your network and the traffic source. Packets are filtered not only according to the service for which they are intended but also by certain other characteristics.

This firewall looks at the packet and the TCP handshake protocol, but it goes a step further by performing deep-layer packet inspections that check the actual contents to verify that no malware is housed inside. Once everything checks out, the packet is sent on to its destination. This offers an extra layer of separation between the origination location of the packet and the individual devices on your network.

While providing considerable data security, proxy firewalls do dramatically affect network performance and create slowdown because of the extra steps in the process.
 

Next-generation firewalls are the hardest to define because they are still being configured. Most next-gen firewalls combine surface-level packet inspection, stateful inspection and deep packet inspection (checking the actual contents of the data packet). Some next-gen firewalls may include other technologies as well, such as intrusion prevention systems or artificial intelligence. Because there is no set definition of a next-gen firewall, it is important to verify the firewall's specific capabilities before investing in one.

With technology being an integral part of business, it is important to place security at the top of your list. Do you choose a firewall that provides simple protection but doesn't impact your network performance? Do you choose a firewall that provides deeper inspection and verification of data but costs more and has a high impact on performance?

The answer is that you choose what is right for your business, and that means creating multiple layers of protection and firewalls, both at the network and asset level. Additional firewalls make your network tougher to crack and add additional protection layers as you delve into the most important company assets and locations.

You should start the process with a security policy audit and assessment to identify what assets on your network need protection. You should also consider the capabilities of your network, the compliance requirements for your industry and the current resources you have in place to manage these firewalls.