What can a stateful firewall do that a stateless firewall cannot?

Track the state of connections and filter by connection-related rules

Which feature is typical of a next-generation firewall (NGFW)?

Deep packet inspection and filtering by application type

No ability to track connections

A packet arrives on port 443 from 198.51.100.40. What happens?

It is allowed, because rule 1 matches first

It is denied, because rule 2 is more specific

It is denied, because deny rules always win

It is dropped, because no rule matches

Which three parts does a typical ACL rule specify?

Direction, criterion and action

A network has three segments and two internet connections. Where should firewalls be placed?

On each segment and at each internet entry and exit point

Only at the busiest internet connection

Only on the most sensitive segment

What now happens to an HTTPS request on port 443 from 198.51.100.9?

It is allowed, because the allow rule now matches first

It is dropped, because no rule matches

It is denied, because deny rules always take priority

It is denied, because the address is in a blocked range

AP® Cybersecurity 3.4 Protecting Networks: Firewalls Notes and Practice

1. Types of network firewalls (3.4.A)

A firewall allows or denies network traffic coming into or leaving a network. It is software, which can run on a standalone device or be built into another network device such as a router 3.4.A.1.

Type	What it filters on
Stateless firewall 3.4.A.2	Information in each packet’s header: internet protocol (IP) addresses, ports and protocols
Stateful firewall (also called dynamic packet filtering) 3.4.A.3	Everything a stateless firewall checks, plus the state of connections passing through, which gives more control over what is allowed in and out
Next-generation firewall (NGFW) 3.4.A.4	Stateless and stateful filtering, plus advanced features such as intrusion prevention, deep packet inspection and filtering by application type

2. Access control lists (3.4.B)

Network administrators write a set of rules called an access control list (ACL). The firewall uses it to permit or deny inbound and outbound traffic 3.4.B.1.

Rules are checked in order. The first rule that matches is executed 3.4.B.2.
A typical rule states the direction (inbound or outbound), the criterion (IP address, logical port, service or application) and the action (permit or deny) 3.4.B.3.

How to read it: TCP is the transmission control protocol. Port 443 carries Hypertext Transfer Protocol Secure (HTTPS) web traffic. Port 3389 carries remote desktop connections. A range such as 198.51.100.0/24 means every address from 198.51.100.0 to 198.51.100.255.

Firewall ACL: school web server

# read top to bottom, first match wins
1  DENY   inbound  TCP 443  from 198.51.100.0/24   # known bad range
2  ALLOW  inbound  TCP 443  from ALL                # HTTPS for everyone else
3  ALLOW  inbound  TCP 3389 from 10.0.5.0/24       # remote desktop, admin subnet only
4  DENY   inbound  ANY      from ANY                # default deny

3. Where firewalls go (3.4.C)

Each network segment should have a firewall controlling the flow of data in and out of it 3.4.C.1.
Segments have different security needs, so each firewall’s security level is set independently 3.4.C.2.
Every point of data ingress and egress between the internal network and the public internet needs a firewall 3.4.C.3.

This is why the screened subnet in topic 3.3 sits between two firewalls: a looser one facing the internet and a stricter one facing the internal network.

4. Writing firewall rules (3.4.D)

Start from the requirements: which types of traffic, from which sources or to which destinations, should be allowed or denied 3.4.D.1.
Rules can allow or deny inbound or outbound traffic by source or destination port or IP address, service, protocol or application 3.4.D.2.
Order changes the result. Changing the order of the same rules can change which traffic gets through, so think about precedence: specific rules usually go before broad ones 3.4.D.3.

In the ACL above, swap rules 1 and 2 and the “known bad range” gets in: rule 2 allows all port 443 traffic first, and rule 1 is never reached. Test that in the simulator.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

Rule orderFirst match wins: a firewall reads rules like a bouncer reading a list from the top and stopping at the first line that fits.
Firewall typesStateless reads the envelope, stateful remembers the conversation, next-generation also opens the letter.
ACL ruleEvery rule has three parts: which way (direction), what to match (criterion), what to do (action).

Common misconceptions

"A firewall checks every rule and picks the best match."
Not quite. Rules are checked in order and the first rule that matches is applied. A broad rule placed too early can make later rules useless.
"A firewall must be its own box."
Not quite. A firewall is software. It can run on a standalone device or be built into another device, such as a router.
"One firewall at the edge of the network is enough."
Not quite. Each segment should have its own firewall, set to that segment's security needs, and every internet entry and exit point needs one.

Action	Source	Destination	Direction	Port number	Protocol
Deny	198.51.100.0/24	10.0.1.20	Inbound	443	HTTPS
Allow	ALL	10.0.1.20	Inbound	443	HTTPS
Allow	10.0.5.0/24	10.0.1.20	Inbound	3389	RDP
Deny	ALL	ALL	Inbound	ALL	ALL

From	Port	Result
`192.0.2.20`a student at home opening the school site	`443`	Allowed (as ordered here)
`198.51.100.7`a server in the known bad range	`443`	Denied (as ordered here)
`10.0.5.12`the network admin connecting by remote desktop	`3389`	Allowed (as ordered here)
`192.0.2.20`a stranger trying remote desktop	`3389`	Denied (as ordered here)

Exam traps

If a specific deny rule sits below a broad allow rule, the deny rule is never reached.
A firewall is software; it can be built into a router.
An NGFW adds intrusion prevention, deep packet inspection and application filtering on top of stateless and stateful filtering.

By the numbers

Say each list out loud, then tap to check.

3 firewall types Say them, then tap

stateless (headers)
stateful (connection state)
next-generation (plus intrusion prevention, deep packet inspection, application filtering)

3 parts of an ACL rule Say them, then tap

direction
criterion
action

2 placement rules Say them, then tap

a firewall on every segment

a firewall at every internet ingress and egress point

In 30 seconds

A firewall is software, standalone or built into a device like a router, that allows or denies traffic.
Stateless: filters on header information (IP addresses, ports, protocols). Stateful: also tracks connection state. NGFW: both, plus intrusion prevention, deep packet inspection and filtering by application.
An ACL is the ordered rule set. Rules run top to bottom; the first match is executed. Each rule has a direction, a criterion and an action.
Place a firewall on every segment (each with its own security level) and at every point where data enters or leaves for the internet.
Changing the order of rules changes what is allowed, so put specific rules before broad ones.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Rule number	Action	Source	Direction	Port number	Protocol
1	Allow	ALL	Inbound	443	HTTPS
2	Deny	198.51.100.0/24	Inbound	443	HTTPS

Rule number	Action	Source	Direction	Port number	Protocol
1	Allow	ALL	Inbound	443	HTTPS
2	Deny	198.51.100.0/24	Inbound	ALL	ALL

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

Firewalltap to flip

Software that allows or denies network traffic in or out of a network using a set of rules called an access control list (ACL); it runs on its own device or inside another one, such as a router.
Example and CED codes
Access control list (ACL)tap to flip

The ordered set of rules a firewall uses to permit or deny inbound and outbound traffic; the first matching rule is executed.
Example and CED codes
Stateless firewalltap to flip

A firewall that filters each packet using header information such as internet protocol (IP) addresses, ports and protocols.
Example and CED codes
Stateful firewalltap to flip

A firewall that tracks the state of connections passing through it and filters by connection-related rules as well as header information.
Example and CED codes
Next-generation firewall (NGFW)tap to flip

A firewall with stateless and stateful filtering plus advanced features such as intrusion prevention, deep packet inspection and filtering by application type.
Example and CED codes
Screened subnettap to flip

A network segment, created with firewall zones and rules, between the internet and the internal network that holds public-facing resources; a lower security zone.
Example and CED codes

Questions students ask

What is the difference between a stateless and a stateful firewall?

A stateless firewall filters each packet using header information such as IP addresses, ports and protocols. A stateful firewall, also called dynamic packet filtering, also tracks the state of connections, so it can filter by connection-related rules.

Why does the order of firewall rules matter?

Rules are checked in order and the first matching rule is executed. If a broad allow rule comes before a specific deny rule, the deny rule is never reached.

Where should firewalls be placed?

Every network segment should have a firewall controlling data in and out of it, with its security level set independently, and every point where data enters or leaves between the internal network and the internet should have one.

3.4 Protecting Networks: Firewalls