Firewalls, Proxies and Intrusion Prevention

Introduction

Modern networks connect users, applications, cloud services, mobile devices and industrial systems across boundaries that cannot be protected by a single security mechanism. Firewalls control traffic flows, proxies mediate application communication, and intrusion detection and prevention systems identify or block suspicious activity. Together, these technologies implement important parts of defence in depth.

A firewall primarily enforces a traffic policy between networks or security zones. A proxy acts as an intermediary between a client and a server, often providing inspection, authentication, caching and content control. An intrusion detection system (IDS) observes activity and raises alerts, whereas an intrusion prevention system (IPS) can actively block or disrupt detected attacks. The distinctions are important because each technology has different visibility, strengths, failure modes and operational responsibilities.

This chapter concentrates on practical foundations suitable for network administrators and security technicians. It explains packet-filtering, stateful and next-generation firewalls; develops basic rules; examines forward and reverse proxies; introduces web filtering; and compares network-based detection and prevention techniques.

Learning Objectives

By the end of this chapter, you should be able to:

1. Compare packet-filtering, stateful and next-generation firewalls.
2. Explain security zones, default-deny policies and rule ordering.
3. Create and evaluate basic firewall rules.
4. Describe forward proxies, reverse proxies and web-filtering methods.
5. Distinguish IDS from IPS and compare signature, anomaly and behaviour-based detection.
6. Explain network detection and prevention workflows, including tuning and response.
7. Select suitable controls while considering performance, privacy, availability and governance.

1. Firewalls as Policy Enforcement Systems

A firewall is a device or software service that permits, rejects, logs or otherwise handles network traffic according to a defined policy. It may be deployed at a network perimeter, between internal segments, on a host, in a cloud environment or within a virtual network. A firewall is not automatically a complete security solution: permitted traffic can contain malicious content, compromised credentials can be used through approved services, and incorrectly configured rules can create exposure.

A firewall policy normally describes:

• Source: originating address, identity, interface or security zone.
• Destination: target address, service, application or zone.
• Protocol: such as TCP, UDP or ICMP.
• Port or service: for example, TCP 443 for HTTPS, subject to the actual service configuration.
• Action: allow, deny, reject, inspect, redirect or log.
• Direction and state: whether traffic is inbound, outbound or part of an established connection.
• Time and context: schedules, user identity, device posture or threat intelligence.

A useful security-zone model separates networks according to trust and function. Typical zones include the Internet, an external or untrusted zone; a DMZ containing public-facing servers; an internal user zone; a restricted management zone; and a guest or partner zone. The policy should permit only required flows between zones.

Figure: A zone-based architecture in which the firewall mediates traffic between untrusted, public-service and internal networks.

Default deny and least privilege

A well-designed policy follows least privilege: permit the minimum traffic required for a legitimate business function. A common baseline is “deny by default, allow by exception.” The final rule explicitly denies and logs traffic not matched earlier. This approach is safer than allowing all traffic and attempting to block known bad destinations, although it requires accurate knowledge of business requirements.

Rule order matters in many firewalls. The first matching rule may determine the result. A broad allow rule placed above a specific deny rule can unintentionally permit dangerous traffic. Administrators should therefore place specific exceptions before broad rules, remove obsolete rules and test changes before deployment.

2. Firewall Technologies

2.1 Packet-filtering firewalls

A packet-filtering firewall examines packet-header information, commonly including source and destination IP addresses, protocol, ports and interface. It does not normally understand the full connection or application content. A rule might allow TCP traffic from a web-server address to a database address on TCP 5432, while denying all other traffic.

Packet filtering is efficient, transparent and suitable for simple network segmentation. Its limitations include weak application awareness, difficulty distinguishing legitimate and malicious use of the same port, and limited understanding of fragmented or multi-stage traffic. A port number identifies a communication endpoint, not necessarily the application actually using it.

2.2 Stateful firewalls

A stateful firewall maintains a connection or flow table. For TCP, it can track the progression from connection establishment through data transfer and termination. Return traffic for an internally initiated connection can be permitted because it matches an existing state entry, while unsolicited inbound packets are rejected.

Stateful inspection improves security and usability compared with independent packet decisions. However, it consumes memory and processing resources, can be challenged by resource-exhaustion attacks, and does not by itself determine whether the content of an allowed session is harmful. UDP and some protocols require timeout-based or protocol-specific state handling because they do not provide TCP-like connection semantics.

2.3 Next-generation firewalls

A next-generation firewall (NGFW) combines conventional filtering and state tracking with deeper controls such as application identification, integrated intrusion prevention, user or identity awareness, URL filtering, malware inspection and encrypted-traffic analysis. Its application control may identify a service despite use of a non-standard port.

NGFW functions depend on current signatures, classification accuracy, certificates or decryption arrangements, and adequate capacity. Encrypted traffic creates a visibility trade-off: inspection may reveal threats but introduces privacy, key-management, performance and legal considerations. An NGFW should not be treated as infallible; evasive applications, unknown attacks and blind spots remain possible.

3. Creating Basic Firewall Rules

A rule should state who may communicate with whom, using which service, in which direction and for what purpose. Consider a small organisation with a public web server in a DMZ, an internal database server and employee workstations. A reasonable simplified policy is:

1. Internet clients may reach the DMZ web server on TCP 443.
2. The DMZ web server may reach the database on the database service port, such as TCP 5432, only when required.
3. Internal administrators may manage the web server using SSH, preferably from a restricted management subnet.
4. Internet clients may not directly reach the database or internal workstation network.
5. All unmatched traffic is denied and logged.

An illustrative rule table is:

The example is illustrative, not a universal template. IP addresses, ports, NAT, routing, authentication and vendor syntax must be verified in the actual environment. Public DNS, monitoring, backup and time services may require additional carefully restricted rules.

Worked rule-analysis example

Suppose a stateful firewall receives these packets:

• A workstation initiates an HTTPS connection to an approved external service.
• The external service sends a response packet belonging to that connection.
• An unrelated Internet host initiates a new connection toward the workstation.

With a rule allowing outbound HTTPS and stateful return traffic, the first packet is allowed and recorded in the state table. The response is allowed because it matches the established flow. The unrelated inbound connection is denied because it is not associated with an permitted internal session. This illustrates why stateful inspection is more expressive than independently allowing TCP 443 in both directions.

NAT and firewall policy

Network address translation (NAT) changes address or port information as traffic crosses a device. NAT can support address conservation and publication of internal services, but it is not a substitute for a firewall. A port-forwarding rule that maps a public address to an internal server creates reachability; a separate security policy must determine whether the traffic is allowed and inspected.

Operationally, every rule should have an owner, purpose, creation date, review date and logging requirement. Administrators should test both permitted and prohibited paths, check IPv4 and IPv6 behaviour, and ensure that emergency changes do not become permanent undocumented exceptions.

4. Proxies and Web Filtering

A proxy is an intermediary. Instead of a client communicating directly with a destination, the client sends a request to the proxy, which makes or mediates the onward request. This creates a control point for authentication, logging, caching, content inspection and policy enforcement.

Forward proxies

A forward proxy serves clients inside an organisation. It can enforce browsing policy, authenticate users, filter categories, restrict risky file types, scan downloads and record web-access events. It may also reduce bandwidth through caching, although widespread content-delivery networks and encrypted traffic have reduced the relative importance of traditional caching.

A forward proxy must be secured itself. Open proxies are frequently abused for spam, fraud and concealment. Access should be restricted to authorised networks or identities, administrative interfaces should be protected and logs should be monitored.

Reverse proxies

A reverse proxy sits in front of servers and represents them to clients. It can terminate TLS, route requests to a server pool, balance load, apply rate limits, hide internal addresses and integrate with a web application firewall (WAF). A reverse proxy is common in a DMZ or cloud edge architecture.

A reverse proxy does not automatically make an application secure. It must preserve important client information safely, validate headers, enforce appropriate timeouts and avoid becoming a single point of failure. TLS certificates, private keys and backend trust relationships require careful management.

Web filtering

Web filtering may use domain categories, URL reputation, malware intelligence, application classification, file-type controls, DNS policy or content inspection. DNS filtering is comparatively lightweight but may not distinguish all URLs hosted under one domain. Full URL and content inspection provides greater detail but raises privacy and performance concerns.

HTTPS encrypts the URL path and content from intermediate observers. An organisation seeking deeper inspection may deploy TLS interception: the proxy terminates the client TLS session and creates another session to the destination. This requires managed trust certificates and explicit governance. It can expose sensitive communications, interfere with certificate pinning and create a high-value repository of decrypted data. Banking, healthcare, legal and personal traffic may require exclusion or special handling.

5. Intrusion Detection and Prevention

An IDS monitors events and produces alerts; an IPS is positioned to block, reset or otherwise prevent traffic judged malicious. A system can be network-based (NIDS/NIPS), host-based (HIDS/HIPS), wireless, cloud-native or integrated into an NGFW. Network systems commonly inspect packets, flows, protocols and session metadata at strategic points.

Detection approaches

Signature-based detection compares activity with known patterns. It is effective for recognised exploits and malware but cannot reliably detect novel attacks and requires timely updates.

Anomaly-based detection establishes a baseline of expected behaviour and flags deviations. It may identify previously unknown activity, but legitimate changes can produce false positives. Baselines must account for time, season, business cycles and system changes.

Behaviour- and reputation-based detection combines context such as destination reputation, identity, sequence of actions, volume and historical behaviour. Modern systems often use several methods rather than relying on one classifier.

A detection is not automatically an incident. Analysts validate alerts using asset importance, event context, packet or flow evidence, authentication records and endpoint telemetry. False positives consume analyst time; false negatives allow attacks to continue. Tuning is therefore a continuous operational activity.

Network detection workflow

A practical workflow is:

1. Collection: obtain packets, flow records, DNS, authentication, firewall and endpoint events.
2. Normalisation: align timestamps, parse protocols and associate related events.
3. Detection: apply signatures, thresholds, reputation and behavioural analytics.
4. Enrichment: add asset criticality, user identity, vulnerability and threat-intelligence context.
5. Validation: determine whether the alert reflects malicious or legitimate activity.
6. Response: block an indicator, isolate a host, revoke credentials or escalate for investigation.
7. Recovery and learning: restore services, document evidence and improve rules or controls.

NIPS actions can include dropping a packet, blocking an address, terminating a session, rate-limiting traffic or directing a host to a quarantine segment. Automatic prevention is valuable for high-confidence attacks, but aggressive blocking can interrupt critical services. A balanced design uses confidence, asset criticality and change-control criteria.

Placement and visibility

Sensors placed at an Internet edge can observe scanning and external attacks. Sensors near critical server segments can detect lateral movement. Sensors at internal egress points can identify data exfiltration. A single sensor rarely provides complete visibility, especially where traffic is encrypted, switched locally, routed through cloud services or bypasses the monitoring point.

Network taps provide passive copies of traffic, while switched port mirroring provides selected copies. Taps can offer more faithful visibility but may cost more and require careful redundancy. High-speed links can overwhelm sensors; filtering, flow monitoring and distributed sensors may be necessary.

6. Applied Case: Illustrative College Network

Background

A college operates a public learning portal, an internal student-records system, staff workstations, a guest wireless network and a small IT management network. The portal has experienced repeated password attacks and suspicious uploads. Guest devices must have Internet access but must not reach internal systems.

Problem analysis

The original design uses one flat network and a broad outbound firewall rule. Logs show repeated login attempts, unmanaged guest devices contacting internal addresses and large outbound transfers from a compromised workstation. Because the firewall sees mainly addresses and ports, it cannot distinguish ordinary web access from harmful uploads.

Approach

The college redesigns the network into Internet, DMZ, staff, records, guest and management zones. A stateful NGFW allows HTTPS to the portal, restricts portal-to-records communication to the required application service and denies guest-to-internal traffic. A reverse proxy terminates external TLS and applies rate limits and WAF rules. A forward proxy and DNS filtering service enforce acceptable-use policy for managed staff devices, with documented exclusions for sensitive services.

NIDS sensors monitor the Internet edge and records segment. High-confidence exploit signatures can trigger IPS blocking, while unusual outbound transfers create alerts for analyst review. Administrative access is limited to the management network and protected with multifactor authentication. Rules have owners and review dates; logs are sent to a central monitoring platform.

Outcome

The design reduces exposed services, separates guest traffic, improves visibility and provides several response options. It does not guarantee prevention: stolen credentials, vulnerable applications and encrypted malicious traffic remain risks. The college therefore combines patching, endpoint protection, backups, security awareness and incident-response exercises with its network controls.

Learning points

1. Segmentation makes firewall policy meaningful.
2. A reverse proxy protects and scales public applications but cannot replace secure coding.
3. Prevention should be strongest where confidence is high and service interruption is tolerable.
4. Logs require ownership, retention rules and analysis; collection alone is not monitoring.
5. Technical controls must be supported by identity, patching and governance.

7. Limitations, Governance and Best Practices

Firewalls and IPS products have finite throughput, memory and inspection capacity. Deep inspection can increase latency, and fail-open or fail-closed behaviour creates different availability and security consequences. Redundant devices, state synchronisation and tested recovery procedures are essential for critical paths.

Privacy is especially important for proxy logs, user identities, URLs and decrypted content. Organisations should define a lawful purpose, minimise collection, restrict access, protect logs, set retention periods and inform users through appropriate policies. Administrative actions should be auditable. Automated blocking should support, not replace, accountable human oversight.

Recommended practices include:

• Start with an inventory of assets, services, owners and data sensitivity.
• Segment networks according to trust and business function.
• Use explicit, documented allow rules and a final deny rule.
• Prefer service identities and narrow source ranges over broad “any” rules.
• Review rules regularly and remove temporary exceptions.
• Synchronise device clocks and centralise relevant logs.
• Test IPv4, IPv6, NAT, failover and prohibited paths.
• Tune IDS/IPS rules against representative normal traffic.
• Update signatures, reputation feeds and software through change control.
• Protect management planes separately and use multifactor authentication.
• Measure alert quality, response time, blocked events and service impact.
• Maintain backups and an incident-response plan that includes containment and recovery.

Contemporary systems increasingly use cloud firewalls, secure access service edge (SASE), zero-trust policy, encrypted-traffic analytics and machine-learning-assisted detection. These developments can improve context and scalability, but they also increase dependence on identity providers, cloud availability, vendor classification and data-sharing arrangements. Machine learning produces probabilities or classifications, not guaranteed truth; human review and explainable operational evidence remain important.

Chapter Summary

Firewalls enforce communication policy between hosts and security zones. Packet filters use header information, stateful firewalls track flows and next-generation firewalls add application, identity, content and often IPS capabilities. Secure policies normally apply least privilege, default deny, careful rule ordering, logging and periodic review.

Forward proxies mediate client access, while reverse proxies protect and route public-facing servers. Web filtering can use DNS, categories, reputation and content inspection, but HTTPS interception requires careful technical, privacy and legal governance. IDS detects and alerts; IPS can actively block. Signature, anomaly, reputation and behaviour-based methods have complementary strengths and weaknesses.

Effective network defence is a process rather than a product. It combines segmentation, accurate rules, visibility, alert validation, controlled prevention, incident response, endpoint protection, patching and accountable governance.

Key Terms

Firewall: A system that enforces policy on network traffic.

Packet filtering: Filtering based mainly on packet-header fields.

Stateful inspection: Tracking flows or connections to inform traffic decisions.

Next-generation firewall: A firewall with advanced application, identity, content or IPS capabilities.

Security zone: A network area with a defined trust level and policy.

DMZ: A segmented network for services exposed to less-trusted networks.

Default deny: Rejecting traffic unless an explicit rule permits it.

NAT: Translating network addresses or ports between traffic domains.

Forward proxy: An intermediary serving internal clients.

Reverse proxy: An intermediary representing backend servers to clients.

Web filtering: Controlling web access using categories, reputation or content rules.

TLS interception: Terminating and re-establishing encrypted sessions for inspection.

IDS: Intrusion detection system that identifies and reports suspicious activity.

IPS: Intrusion prevention system that can block or disrupt suspicious activity.

Signature detection: Matching activity to known patterns.

Anomaly detection: Identifying deviation from an expected baseline.

False positive: Benign activity incorrectly reported as malicious.

False negative: Malicious activity missed by a detection system.

Network segmentation: Dividing a network into separately controlled areas.

Defence in depth: Using multiple complementary security controls.

Review Questions

Short Answer Questions

1. What information does a packet-filtering firewall normally inspect?
2. Why can a stateful firewall allow return traffic without allowing unsolicited inbound connections?
3. Distinguish a forward proxy from a reverse proxy.
4. What is the difference between an IDS and an IPS?
5. State two limitations of signature-based detection.

Long Answer Questions

1. Compare packet-filtering, stateful and next-generation firewalls, including their strengths and limitations.
2. Explain how default-deny policy, rule ordering and least privilege contribute to secure firewall design.
3. Describe how HTTPS affects web filtering and discuss the governance issues associated with TLS interception.
4. Explain the collection, detection, validation and response stages of a network intrusion-monitoring workflow.
5. Design a zone-based security architecture for an organisation with public servers, internal users, guest devices and a management network.

Analytical / Application Questions

1. A rule allowing traffic from “any source” to “any destination” on TCP 443 appears above a rule denying access to a sensitive server. Analyse the risk and propose a safer ordering and scope.
2. An IPS blocks a large volume of traffic after a software update, but the service becomes unavailable. Explain possible causes and develop a controlled tuning and rollback approach.
3. A company wants to inspect all employee HTTPS traffic, including personal banking sessions. Evaluate the technical, privacy, legal and operational issues and recommend a policy approach.

Multiple Choice Questions with Answers

Question 1

Which firewall type primarily evaluates packet-header fields without maintaining connection state?

A. Packet-filtering firewall

B. Stateful firewall

C. Reverse proxy

D. Host-based IPS

Correct Answer: A. Packet-filtering firewall

Question 2

What is the main security benefit of stateful inspection?

A. It automatically decrypts every application

B. It permits traffic based on known connection state

C. It replaces endpoint security

D. It guarantees that allowed content is harmless

Correct Answer: B. It permits traffic based on known connection state

Question 3

Which rule best follows least privilege for a web server accessing a database?

A. Allow the web server to all internal ports

B. Allow any Internet host to the database port

C. Allow the web server only to the required database service

D. Allow every host to every service temporarily

Correct Answer: C. Allow the web server only to the required database service

Question 4

What is the usual role of a forward proxy?

A. Represent backend servers to Internet clients

B. Mediate outbound client access

C. Replace a routing table

D. Store firewall state only

Correct Answer: B. Mediate outbound client access

Question 5

Which technology commonly terminates client connections and routes requests to backend servers?

A. Reverse proxy

B. Packet filter

C. DNS resolver only

D. Network tap

Correct Answer: A. Reverse proxy

Question 6

Which statement correctly distinguishes an IPS from an IDS?

A. An IPS can actively block suspicious traffic

B. An IDS always operates inline

C. An IPS only records normal traffic

D. An IDS must inspect application source code

Correct Answer: A. An IPS can actively block suspicious traffic

Question 7

What is a principal weakness of signature-based detection?

A. It cannot identify any known attack

B. It requires patterns and may miss novel attacks

C. It never generates false positives

D. It operates only on host passwords

Correct Answer: B. It requires patterns and may miss novel attacks

Question 8

Why is a final deny-and-log rule useful in a firewall policy?

A. It permits all unrecognised traffic

B. It documents and rejects unmatched traffic

C. It disables state tracking

D. It automatically patches servers

Correct Answer: B. It documents and rejects unmatched traffic

Question 9

What is a major concern with TLS interception?

A. It makes IP addresses unnecessary

B. It can expose sensitive communications and requires trust management

C. It prevents all phishing attacks

D. It works without certificates

Correct Answer: B. It can expose sensitive communications and requires trust management

Question 10

Which placement is especially useful for detecting lateral movement toward critical servers?

A. Only outside the organisation's router

B. Near the critical server segment

C. Inside an unused guest device

D. Only on a public DNS website

Correct Answer: B. Near the critical server segment