1. What Is a Firewall?

A firewall is a network security system that monitors and controls incoming and outgoing traffic according to a defined security policy.

It acts as a security checkpoint between networks, such as the public internet and a company's private network.

How does a firewall work?

1. A device sends or receives network traffic.
2. The firewall examines relevant information, such as source and destination IP addresses, ports, protocols, connection state, and application details where supported.
3. It compares the traffic with its security rules.
4. The traffic is allowed, blocked, or otherwise handled according to the configured policy.

Example

A company allows HTTPS traffic to its public website but blocks unsolicited connections to its internal database server.

Internet
   |
   v
[ Firewall ]
   |
   +---- Public Web Server: HTTPS allowed
   |
   +---- Internal Database: restricted access
    

Common firewall types

• Packet-filtering firewall: Filters traffic using packet headers and rules.
• Stateful firewall: Tracks connection states when deciding whether traffic should be permitted.
• Next-Generation Firewall (NGFW): Can combine traditional filtering with application awareness, threat intelligence, and intrusion prevention capabilities.
• Host-based firewall: Protects an individual computer or server.
• Cloud firewall: Enforces network security policies in cloud environments.

2. What Is a Web Application Firewall (WAF)?

A Web Application Firewall protects web applications and APIs by inspecting HTTP and HTTPS requests and applying application-layer security rules.

Unlike a traditional network firewall, which commonly focuses on network traffic and connection policies, a WAF focuses on web requests and application-specific attack patterns.

What can a WAF help protect against?

• SQL injection attempts.
• Cross-site scripting (XSS) attempts.
• Malicious or malformed HTTP requests.
• Some automated bot activity and application-layer attack patterns.
• Requests that violate configured application security policies.

Example

Imagine a shopping website that uses a database to store product and customer information. An attacker submits a crafted request designed to manipulate a database query. A properly configured WAF may identify and block the request before it reaches the application.

Customer
   |
   v
[ WAF ]
   |
   |-- Suspicious request --> Block or challenge
   |
   +-- Permitted request --> Web Application
                                  |
                                  v
                               Database
    

Important: A WAF is not a replacement for secure application development. Developers must still use parameterized queries, input validation, output encoding, strong authentication, and appropriate authorization controls.

3. What Is an Intrusion Detection System (IDS)?

An Intrusion Detection System monitors network traffic or host activity to identify suspicious behavior, possible attacks, and security policy violations.

An IDS generally generates alerts rather than directly blocking the traffic it observes.

How does an IDS work?

1. It receives network traffic copies or collects activity from a host.
2. It analyzes the information using detection rules, known attack signatures, or anomaly detection.
3. When it identifies suspicious activity, it records an event and alerts the security team.
4. Administrators investigate the alert and decide what response is necessary.

Example

An IDS detects repeated connection attempts against multiple internal servers. It raises an alert so the IT team can investigate a possible scanning or intrusion attempt.

Network Traffic
       |
       +-----------------------> Destination
       |
       +--> [ IDS Monitoring ]
                  |
                  v
             Security Alert
                  |
                  v
            IT Investigation
    

Common IDS types

• NIDS: Network-based Intrusion Detection System, which monitors network activity.
• HIDS: Host-based Intrusion Detection System, which monitors activity on an individual host.

4. What Is an Intrusion Prevention System (IPS)?

An Intrusion Prevention System inspects traffic or system activity to identify threats and can automatically take action to stop detected attacks.

Unlike a passive IDS sensor, a network IPS is commonly deployed inline, allowing it to inspect traffic as it passes through the device.

How does an IPS work?

1. Network traffic passes through the IPS.
2. The IPS examines the traffic for known attack signatures, suspicious patterns, or policy violations.
3. If a threat matches its prevention rules, it may drop packets, block traffic, or reset a connection.
4. It logs the event for security monitoring and investigation.

Example

An IPS identifies traffic matching a known exploit attempt against a vulnerable service. If its prevention policy is enabled and the traffic is correctly identified, the IPS can block the malicious traffic before it reaches the service.

Incoming Traffic
       |
       v
    [ IPS ]
       |
       +---- Malicious traffic --> Block
       |
       +---- Permitted traffic --> Internal Server
    

IPS rules must be configured and tested carefully. Incorrect rules can block legitimate business traffic, and encrypted traffic may require appropriate inspection capabilities to analyze its contents.

5. Firewall vs WAF vs IDS vs IPS: Comparison Table

These technologies are complementary, not interchangeable. Some modern security products combine several of these capabilities into one platform.

6. How Do These Technologies Work Together?

Consider a company that hosts a public website and maintains private employee and database networks. A layered security design might look like this:

                       INTERNET
                           |
                           v
                  [ Edge Firewall ]
                           |
                           v
                  [ WAF / Web Proxy ]
                           |
                           v
                    [ IPS / NGFW ]
                           |
                 +---------+----------+
                 |                    |
                 v                    v
          [ Web Servers ]      [ Internal Network ]
                 |                    |
                 v                    v
           [ Database ]        [ Employee Devices ]

     IDS sensors monitor selected network segments.
     Logs from security devices are sent to central monitoring.
    

This is an illustrative design, not a mandatory order for every environment. WAFs may be delivered through cloud services, firewalls may include IPS functions, and IDS sensors may monitor traffic from network taps or mirrored switch ports.

• Firewall: Restricts which connections can reach each network or service.
• WAF: Inspects web requests for application-layer threats.
• IPS: Blocks identified malicious traffic inline when configured to do so.
• IDS: Provides visibility and alerts about suspicious behavior.
• Central monitoring: Collects and correlates logs to help the security team investigate incidents.

7. Which Security Technology Does a Company Need?

• Small office: Start with a properly configured firewall, endpoint protection, strong authentication, backups, and secure Wi-Fi.
• Public-facing website: Use a firewall plus an appropriately configured WAF, secure application code, and monitoring.
• Enterprise network: Consider network segmentation, firewalls, IPS, IDS or endpoint detection, centralized logging, and incident response procedures.
• Cloud-based business: Apply cloud network controls, identity-based access, workload protection, application security, and appropriate logging.
• Organizations with sensitive data: Add stronger access controls, encryption, data protection measures, vulnerability management, and regular security reviews according to risk.

The right design depends on the company's assets, risks, architecture, compliance needs, staffing, and budget. Buying every tool is not enough; each control must be configured, monitored, tested, and maintained.

8. Frequently Asked Questions

9. Quick Knowledge Check

10. Key Takeaways

• A firewall controls permitted network traffic.
• A WAF focuses on protecting web applications and APIs.
• An IDS detects suspicious activity and raises alerts.
• An IPS can actively block identified threats.
• Layered security reduces dependence on any single tool.
• Security tools work best when combined with secure configuration, updates, monitoring, and incident response.

Want to Learn Network Security with ATN Campus?

Build your networking knowledge through practical training, theory, and hands-on labs with ATN Campus.

Explore learning paths in:

• CCNA and CCNP
• Network Routing and Switching
• Subnetting and IP Addressing
• Network Security and CEH
• Cisco CyberOps
• Cloud Networking
• Python for Network Automation
• Practical Networking Labs

???? Want to learn networking? Visit ATN Campus.

???? Learn Networking.
???? Master Routing & Switching.
???? Practice with Real Labs.
???? Prepare for Certifications.
???? Build Your IT Career with ATN Campus.