Firewall

A firewall is a software and/or hardware-based security mechanism that controls access according to a defined security policy by inspecting incoming and outgoing traffic in a computer network. Its primary purpose is to protect a private network from unauthorized access, malicious software, and network attacks originating from the external world such as the internet.

^{Güvenlik duvarın ve tehditleri simgeleyen görsel (}Anadolu Ajansı⁾

Firewalls operate by filtering data packets according to predefined rules. These rules are configured based on characteristics of network traffic such as source IP address destination IP address port number and protocol type. These controls are grounded in two fundamental security approaches:

• Permissive Approach (Default Allow): Only known threats are blocked; all other traffic is permitted.
• Strict Approach (Default Deny): Only explicitly defined and authorized traffic is allowed; everything else is blocked.

In enterprise networks these two approaches are often applied in combination. Strict rules are enforced for regions such as DMZ (Demilitarized Zone) while user internet access may be governed by more permissive rules.

Firewalls are classified according to the following technical architectures:

Filtering is performed solely based on packet header information such as IP address port and protocol. Previous connection states are not considered. It is simple and fast but weak in detecting attacks.

Decisions are made based on connection states. The firewall tracks whether a connection has been initiated and whether a session is still active. It is more secure but consumes more processor and memory resources.

Acts as an intermediary between client and server examining traffic at the application level. Used for protocols such as HTTP FTP and SMTP. Provides content filtering and user authentication. Can operate in transparent or non-transparent modes.

Tracks TCP sessions without inspecting packet contents. SOCKS protocol is an example. Operates at the connection layer and provides low-level filtering.

Enhances privacy by preventing private IP addresses from being visible externally. Although primarily used for address management it also contributes to security.

Modern firewalls are integrated with the following services:

• Antivirus Scanning: Analyzes HTTP FTP and SMTP traffic to block malicious software.
• Content Filtering: Filters web pages emails and application traffic based on categories.
• VPN Support: Enables secure access for remote offices through encrypted tunnel connections.
• IDS/IPS: Integrates with intrusion detection and prevention systems to identify threats.
• Logging and Reporting: Maintains traffic logs to enable security analysis and auditing.

The performance of firewalls should not be evaluated solely based on network parameters such as bandwidth or number of sessions but also by the extent to which they block malicious traffic. Filter coverage can be measured by integrating with IP data from independent blacklisting providers. Additionally the effectiveness of firewalls can be assessed by using them in conjunction with multi-port IDS systems.

Firewalls must be configured in accordance with the organization’s access control policy. It must be clearly defined who can access which services when and in which direction. This is achieved through access control lists ACLs time-based rules and user authentication mechanisms. Network security policies must be documented in writing and integrated with all system components.

^{The visual representing the 'encryption' feature of the firewall}Anadolu Ajansı⁾

Although firewalls form a strong defense line they have certain limitations:

• They do not protect against internal threats such as attacks originating from within the network.
• They cannot monitor traffic that does not pass through them.
• They cannot directly analyze the contents of virus-infected files and applications.
• Poor configurations can create serious vulnerabilities.

Firewalls are one of the fundamental security components in modern computer networks. These systems which operate at different levels and through various methods are indispensable for filtering network traffic enforcing access control and preserving system integrity. However effective use requires more than just installation; it must be supported by security policies up-to-date threat intelligence and continuous monitoring processes.