Networking
Firewall & DMZ
Router & NAT's own gotchas make a point of saying "NAT is not a firewall, even though it accidentally blocks unsolicited inbound traffic by default." A firewall is what that sentence is contrasting NAT against — a deliberate, rule-based security boundary, not a side effect of address translation.
- What it is
- A system that inspects network traffic and allows or blocks it according to explicit rules.
- Mental model
- A security guard checking IDs against a list — a deliberate policy decision, not NAT's accident of "the door happens to be locked because nothing told it to open."
- Key numbers
- Rules can match at Layer 3/4 (IP address, port, protocol) or, for an application-aware firewall, Layer 7 (the actual request content) — see OSI vs. TCP/IP Model for that same L4-vs-L7 distinction applied to load balancers.
- Reach for it when
- Any network boundary where you want explicit, auditable control over what's allowed to cross — home router, office perimeter, or a single embedded Linux device's own local rules.
Packet filtering
The earliest and simplest kind: a table of rules matching each packet independently against source/ destination IP, port, and protocol — allow or deny, evaluated fresh for every single packet with no memory of what came before it. Fast and simple, but blind to the difference between an unsolicited inbound packet and a reply to a connection the inside network actually opened.
Stateful inspection
The modern default: the firewall tracks which connections were legitimately initiated from the trusted side, and automatically allows the matching return traffic for those — everything else unsolicited is dropped. This is the same underlying idea as the connection table NAT keeps for its own translation, extended into an explicit, auditable security policy rather than a side effect of address rewriting.
Application-aware firewalls
A packet-filtering or stateful firewall only ever sees IP addresses and ports — it has no idea whether port 443 traffic is a normal web request or something malicious tunneled inside HTTPS to look like one. An application-aware (or "next-gen") firewall inspects Layer 7 content directly — the actual HTTP request, the actual DNS query — and can block based on what's really being asked for, not just where it's nominally headed.
The DMZ
A DMZ (Demilitarized Zone) is a separate network segment sitting between the fully trusted internal LAN and the fully untrusted internet, specifically for hosting anything that has to be reachable from outside — a public web server, a mail gateway. It's firewalled off from both sides independently: the internet can reach the DMZ but not the internal LAN, and if a DMZ server is ever compromised, the attacker still doesn't get a free path into the internal network, since that boundary was never opened to begin with.
Real-world applications
- Home router firewalls — the basic stateful firewall built into nearly every consumer router, usually invisible unless you go looking for its settings.
- Corporate network perimeters — dedicated firewall appliances sitting at the boundary between an office network and the internet.
- Cloud security groups — AWS/Azure/GCP implement the same stateful-firewall concept as software configuration attached to virtual machines and networks, rather than a physical box.
- Embedded Linux device firewalls — a device running Linux (see the Linux domain) can run its own local firewall rules (iptables/nftables) restricting what it accepts even on a trusted network, a real defense-in-depth layer for IoT fleets.
Gotchas
- An overly permissive rule set is one of the most common real-world security failures — "deny by default, allow explicitly" is the safer default policy, and it's easy to accidentally invert that while debugging and forget to tighten it back up.
- A firewall protects the boundary it sits on — it does nothing about a device already inside the trusted zone behaving maliciously (a compromised IoT device on the internal LAN, for instance); that's what network segmentation (VLANs, a DMZ) is for, not the firewall alone.
- A firewall rule that's technically correct but too broad (opening a whole port range instead of the one port actually needed) quietly expands the attack surface without ever showing up as an obvious bug.