1. What Is a Firewall?

A firewall is a network security system that monitors and controls incoming and outgoing traffic according to a defined security policy.

It acts as a security checkpoint between networks, such as the public internet and a company's private network.

How Does a Firewall Work?

1. A device sends or receives network traffic.
2. The firewall examines information such as source and destination IP addresses, ports, protocols, and connection state.
3. It compares the traffic with configured security rules.
4. The traffic is allowed or blocked according to the policy.

Example

A company allows HTTPS traffic to its public website but blocks unauthorized connections to its internal database server.

             INTERNET
                 |
                 v
          [ FIREWALL ]
                 |
        +--------+--------+
        |                 |
        v                 v
   Public Website    Internal Database
   HTTPS Allowed     Restricted Access
    

Common Firewall Types

• Packet-filtering firewall: Filters traffic using packet header information.
• Stateful firewall: Tracks connection states when deciding whether traffic should be permitted.
• Next-Generation Firewall (NGFW): May combine traditional filtering with application awareness and intrusion prevention.
• Host-based firewall: Protects an individual computer or server.
• Cloud firewall: Enforces network security policies in cloud environments.

2. What Is a Web Application Firewall (WAF)?

A Web Application Firewall protects web applications and APIs by inspecting HTTP and HTTPS requests and applying application-layer security rules.

Unlike a traditional network firewall, which commonly focuses on network traffic and connection policies, a WAF focuses on web requests and application-specific attack patterns.

What Can a WAF Help Protect Against?

• SQL injection attempts.
• Cross-site scripting (XSS) attempts.
• Malicious or malformed HTTP requests.
• Some automated bot activity.
• Requests that violate configured application security policies.

Example

Imagine an online shopping website that stores customer information in a database. An attacker submits a crafted request designed to manipulate a database query. A properly configured WAF may identify and block the request before it reaches the application.

          CUSTOMER
              |
              v
          [ WAF ]
              |
       +------+------+
       |             |
       v             v
    Malicious     Permitted
     Request       Request
       |             |
       v             v
     BLOCK       WEB APP
                     |
                     v
                  DATABASE
    

Important: A WAF is not a replacement for secure application development. Developers must still use parameterized queries, input validation, output encoding, strong authentication, and appropriate authorization controls.

3. What Is an Intrusion Detection System (IDS)?

An Intrusion Detection System monitors network traffic or host activity to identify suspicious behavior, possible attacks, and security policy violations.

An IDS generally generates alerts rather than directly blocking the traffic it observes.

How Does an IDS Work?

1. It receives copies of network traffic or collects activity from a host.
2. It analyzes information using detection rules, known attack signatures, or anomaly detection.
3. When suspicious activity is identified, it records an event and generates an alert.
4. Administrators investigate the alert and decide what response is necessary.

Example

An IDS detects repeated connection attempts against multiple internal servers. It raises an alert so the IT team can investigate a possible scanning or intrusion attempt.

       NETWORK TRAFFIC
              |
       +------+------+
       |             |
       v             v
    Destination   [ IDS ]
                      |
                      v
                SECURITY ALERT
                      |
                      v
               IT INVESTIGATION
    

Common IDS Types

• NIDS: Network-based Intrusion Detection System, which monitors network activity.
• HIDS: Host-based Intrusion Detection System, which monitors activity on an individual host.

4. What Is an Intrusion Prevention System (IPS)?

An Intrusion Prevention System inspects traffic or system activity to identify threats and can automatically take action to stop detected attacks.

A network IPS is commonly deployed inline, allowing it to inspect traffic as it passes through the device.

How Does an IPS Work?

1. Network traffic passes through the IPS.
2. The IPS examines traffic for known attack signatures, suspicious patterns, or policy violations.
3. If a threat matches its prevention rules, it may drop packets, block traffic, or reset a connection.
4. It logs the event for security monitoring and investigation.

Example

An IPS identifies traffic matching a known exploit attempt against a vulnerable service. If its prevention policy is enabled and the traffic is correctly identified, it can block the malicious traffic before it reaches the service.

       INCOMING TRAFFIC
              |
              v
           [ IPS ]
              |
        +-----+-----+
        |           |
        v           v
      Threat      Safe Traffic
        |           |
        v           v
      BLOCK     INTERNAL SERVER
    

IPS rules must be configured and tested carefully. Incorrect rules can block legitimate business traffic. Encrypted traffic may also require suitable inspection capabilities to analyze its contents.

5. Firewall vs WAF vs IDS vs IPS: Comparison

These technologies are complementary, not interchangeable. Some modern security products combine several of these capabilities into one platform.

6. How Do These Technologies Work Together?

Consider a company that hosts a public website and maintains private employee and database networks. A layered security design might look like this:

                  INTERNET
                     |
                     v
              [ EDGE FIREWALL ]
                     |
                     v
                [ WAF / PROXY ]
                     |
                     v
                 [ IPS / NGFW ]
                     |
              +------+------+
              |             |
              v             v
         WEB SERVERS    INTERNAL NETWORK
              |             |
              v             v
           DATABASE     EMPLOYEE DEVICES

       IDS sensors monitor selected network segments.

       Security logs are sent to central monitoring.
    

This is an illustrative design, not a mandatory order for every environment. WAFs may be delivered through cloud services, firewalls may include IPS functions, and IDS sensors may monitor traffic from network taps or mirrored switch ports.

• Firewall: Restricts which connections can reach each network or service.
• WAF: Inspects web requests for application-layer threats.
• IPS: Blocks identified malicious traffic inline when configured to do so.
• IDS: Provides visibility and alerts about suspicious behavior.
• Central monitoring: Collects and correlates logs to help investigate incidents.

7. Which Security Technology Does a Company Need?

• Small office: Start with a properly configured firewall, endpoint protection, strong authentication, backups, and secure Wi-Fi.
• Public-facing website: Use a firewall plus an appropriately configured WAF, secure application code, and monitoring.
• Enterprise network: Consider network segmentation, firewalls, IPS, IDS or endpoint detection, centralized logging, and incident response.
• Cloud-based business: Apply cloud network controls, identity-based access, workload protection, application security, and appropriate logging.
• Organizations with sensitive data: Add stronger access controls, encryption, data protection measures, vulnerability management, and regular security reviews according to risk.

The right design depends on the company's assets, risks, architecture, compliance needs, staffing, and budget. Buying every tool is not enough; each control must be configured, monitored, tested, and maintained.

8. Frequently Asked Questions

9. Quick Knowledge Check

10. Key Takeaways

• A firewall controls permitted network traffic.
• A WAF focuses on protecting web applications and APIs.
• An IDS detects suspicious activity and raises alerts.
• An IPS can actively block identified threats.
• Layered security reduces dependence on any single tool.
• Security tools work best with secure configuration, updates, monitoring, and incident response.

Want to Learn Network Security with ATN Campus?

Build your networking knowledge through practical training, theory, and hands-on labs with ATN Campus.

Explore learning paths in:

• CCNA and CCNP
• Network Routing and Switching
• Subnetting and IP Addressing
• Network Security and CEH
• Cisco CyberOps
• Cloud Networking
• Python for Network Automation
• Practical Networking Labs

???? Want to learn networking? Visit ATN Campus.

???? Learn Networking.
???? Master Routing & Switching.
???? Practice with Real Labs.
???? Prepare for Certifications.
???? Build Your IT Career with ATN Campus.