Ultimate System Design For Beginners: How Networks Block 99% Web Traffic – Firewalls Explained

Firewalls serve as the foundational security gatekeepers of modern computer networks, monitoring and controlling traffic entering and leaving private perimeters. By sitting between trusted internal environments and untrusted public spaces like the internet, firewalls protect systems from unauthorized access, malicious payloads, and data leakage.

1. Why Do We Need Firewalls? (The Problem Statement)

As devices connect to open networks, they become instantly exposed to automated scanners, malicious actors, and unauthorized connection requests from across the globe. Without an intermediary security layer, any machine on a private network is vulnerable to direct intrusion.

• The Status Quo Vulnerability: Raw internet connectivity allows any external IP address to attempt handshakes with internal servers and client machines.
• The Perimeter Defense Problem: Private corporate networks and home routers require a centralized inspection point to filter legitimate traffic from malicious attacks before packets reach internal hosts.
• The Dual-Directional Requirement: Security is needed both ways—blocking incoming threats from reaching internal machines, and preventing sensitive corporate data or unauthorized protocols from leaking outward.

2. Core Mental Model: The Real-World Analogy

The term "firewall" is borrowed directly from the physical construction practice of building fire-resistant barriers through the middle of buildings to contain a fire and prevent it from spreading across entire structures.

Just as physical fire walls compartmentalize architectural spaces to contain thermal damage, network firewalls compartmentalize digital spaces to contain online threats and prevent unauthorized lateral movement inside an organization.

3. What is a Firewall? (Definition & Primary Functions)

A firewall is a specialized security system that monitors and controls network traffic based on a pre-configured set of security rules.

• Placement: It physically or logically sits at the boundary between a trusted network (e.g., a corporate intranet or home network) and an untrusted network (the public internet).
• Control Plane: It decides whether to allow, drop, or challenge incoming and outgoing packets.
• Form Factors: Firewalls can be implemented in hardware appliances, software daemons, cloud-native services, or hybrid architectures.
• Content Filtering: Beyond raw security, firewalls restrict access based on application rules—such as schools blocking adult content or state-level firewalls filtering access to specific domains.

4. Architectural Evolution of Firewalls

Over the history of networking, firewall technology has evolved from simple connection trackers to highly intelligent, application-aware security systems.

5. Stateful Firewalls

A stateful firewall maintains a table of active network connections (state table) and uses this context to evaluate traffic rather than inspecting every single packet in isolation.

• How it Works: It tracks the lifecycle of a TCP handshake or UDP stream. If an outgoing connection is initiated from the private network, the stateful firewall remembers it and automatically permits legitimate return packets belonging to that established session.
• Performance: Because it evaluates traffic at a macro level (the connection state) rather than inspecting deep payload contents packet-by-packet, stateful firewalls are extremely fast and consume fewer CPU resources.
• Limitation: They lack deep visibility into what application data or malicious payload is encapsulated inside the approved connection streams.

6. Proxy-Based Firewalls

A proxy-based firewall interposes itself directly in the communication path, acting as an intermediary between the client and the external server.

Client 
   |
   | (Establishes connection #1)
   v
Proxy Firewall (Inspects all outgoing/incoming packets)
   |
   | (Establishes completely separate connection #2)
   v
External Web Server

• Connection Isolation: A proxy firewall prevents any direct socket-to-socket connection between the client and the internet recipient.
• Inspection Workflow:
  1. The client connects to the firewall.
  2. The firewall inspects outgoing packets, then initiates a brand-new, isolated connection to the web server.
  3. When the web server replies, the firewall intercepts the response, inspects the packets, and delivers the payload to the client over a separate internal connection.
• Trade-off: While offering significantly higher security by breaking direct network peering, proxy firewalls introduce processing latency, especially during periods of heavy network traffic.

7. Next-Generation Firewalls (NGFW)

Modern networks require intelligent firewalls capable of understanding application protocols, user identities, and suspicious behavioral patterns. Next-Generation Firewalls (NGFWs) provide this advanced intelligence.

• Deep Packet Inspection (DPI): Inspects packet payloads beyond standard IP/port headers to determine which application and content type are actually being transmitted.
• Application Awareness: Knows precisely which applications are running and which ports they occupy. This protects against advanced malware that attempts to terminate a legitimate running service (e.g., a Node.js or Go application) to hijack its port.
• Identity Awareness: Enforces granular access control policies tied to user authentication, department login, and specific device profiles.
• Sandboxing: Isolates suspicious code fragments extracted from incoming packets and executes them in a secure, isolated sandbox environment to observe behavior before allowing the packets to enter the production network.

8. Web Application Firewalls (WAF)

While traditional firewalls protect private internal networks from malicious web exposure, a Web Application Firewall (WAF) protects web applications themselves from malicious HTTP/HTTPS traffic.

• HTTP/HTTPS Inspection: Operates at Layer 7 of the OSI model, deeply inspecting web requests moving between the public internet and public-facing web servers.
• Attack Mitigation: Specifically designed to block common web application vulnerabilities, including:
  • SQL Injection (SQLi): Malicious database query strings injected into input forms.
  • Cross-Site Scripting (XSS): Malicious client-side scripts injected into trusted web pages.
  • Cross-Site Request Forgery (CSRF): Forcing authenticated users to execute unwanted actions on a web application.
  • File Inclusion Attacks: Unauthorized remote file loading into application execution runtimes.

9. Comprehensive Comparison of Firewall Types

10. Summary and Key Takeaways

• Fundamental Definition: A firewall is a security system that monitors and controls network traffic based on configurable security rules, sitting between trusted and untrusted networks.
• Real-World Inspiration: Borrowed from physical construction fire walls, network firewalls compartmentalize digital traffic to contain online threats.
• Stateful Efficiency: Stateful firewalls save connection state information rather than inspecting every single packet, making them fast and efficient.
• Proxy Isolation: Proxy-based firewalls break direct client-to-server connections by establishing isolated intermediary sessions, enhancing security at the cost of potential latency.
• Next-Gen Intelligence: NGFWs incorporate deep packet inspection (DPI), application awareness, identity-based rules, and code sandboxing to neutralize sophisticated modern threats and port-hijacking malware.
• Web Application Protection (WAF): WAFs operate at Layer 7 to shield web applications from HTTP-based attacks such as SQL injection, XSS, and cross-site request forgery.
• Multi-Layer Defense: Modern enterprise architectures frequently combine multiple firewall types (Network NGFWs and Application WAFs) to achieve comprehensive 360-degree security coverage.