Coursify

Short Notes on Firewalls (Network Security)

Short Notes on Firewalls (Network Security)

Verified Sources
Nov 4, 2026

A Firewall is a controlled gateway between trusted and untrusted networks (e.g., Internet vs. internal LAN). Its core purpose is to enforce access control by applying security rules to network traffic. Firewalls can block obvious threats, reduce the attack surface, and provide logging for monitoring and incident response.
Mermaid overview of typical placement and traffic flow:

Key terms you’ll see across notes:

  • Packet filtering
  • Stateful inspection
  • Application-layer inspection
  • WAF

⚠️ Important: A firewall is a control, not an absolute guarantee. Many attacks can bypass misconfigurations or exploit allowed services, so the firewall must be part of a broader security architecture.

Footnotes

  1. NIST Computer Security Resource Center - Firewalls (and related network security concepts) (https://csrc.nist.gov) - Reference guidance for firewall concepts and security control framing. ↩

Firewall Basics (Packet Filtering vs Stateful Inspection)

Types of Firewalls (Write-Short-Notes Style)

  1. Packet-Filtering Firewalls (Stateless)

    • Make decisions per packet using header fields like source/destination IP, port numbers, and protocol.
    • Example notes you can write:
      • “Uses ACL-like rules (allow/deny) per packet.”
      • “Does not inherently track connection/session state.”

    Packet filtering is usually fast and common, but stateless behavior can be limited for complex traffic legitimacy checks.

  2. Stateful Firewalls

    • Track the state of network connections (sessions).
    • Allow return traffic for established sessions while blocking unsolicited traffic.
    • Example notes:
      • “Maintains a connection table (state) to distinguish legitimate responses from spoofed/unsolicited packets.”

    Stateful inspection improves control compared to pure packet filtering.

  3. Application-Layer Firewalls / Next-Generation Firewalls (NGFW)

    • Inspect traffic beyond headers (e.g., behavior, protocol semantics).
    • Can detect application-specific patterns and enforce deeper policy controls.
    • Example notes:
      • “Performs deeper inspection at the application layer (e.g., HTTP-aware controls).”

    These are more capable but may require more processing and careful tuning.

  4. Web Application Firewalls (WAF)

    • Focus specifically on protecting web applications by filtering HTTP/HTTPS requests.
    • Typical capabilities in notes:
      • “Detects malicious web payloads and request patterns.”
      • “Protects against common web attacks targeting application logic.”

    WAF differs from general-purpose firewalls because it targets web protocols and application patterns.

✅ Pro Tip: In short-note answers, always state what layer the firewall inspects (network vs transport vs application) and what fields/signals it uses for decisions.

Footnotes

  1. NIST Computer Security Resource Center - Firewalls (and related network security concepts) (https://csrc.nist.gov) - Reference guidance for firewall concepts and security control framing. ↩ ↩2 ↩3 ↩4

  2. OWASP Web Application Firewall (WAF) guidance (https://owasp.org) - Explains WAF purpose and how it differs from general firewall controls. ↩

How a Firewall Typically Makes Allow/Deny Decisions

  1. 1
    Step 1

    The firewall receives a packet/flow and extracts key attributes such as source/destination IP, protocol, and port(s).

  2. 2
    Step 2

    Rules are evaluated (e.g., deny inbound to sensitive ports, allow web traffic to specific servers).

  3. 3
    Step 3

    For stateful systems, the firewall checks whether the packet belongs to an established/allowed session.

  4. 4
    Step 4

    For application-layer inspection, it validates protocol semantics and/or content patterns.

  5. 5
    Step 5

    The firewall either allows the traffic to continue, blocks it, and (often) records an event in logs.

  6. 6
    Step 6

    "Relevant events are written to logs to support auditing and troubleshooting."

    Footnotes

    1. NIST Computer Security Resource Center - Firewalls (and related network security concepts) (https://csrc.nist.gov) - Reference guidance for firewall concepts and security control framing. ↩

Firewall Rule Basics (What to Mention in Short Notes)

When writing short notes, include the common rule components:

  • Action: allow or deny
  • Direction: inbound or outbound
  • Source/Destination: IP ranges or networks
  • Port(s): service ports (e.g., 80/443)
  • Protocol: TCP/UDP/ICMP (and sometimes higher-level protocols)
  • Optional conditions: interface, time window, session state, application signature
  • Logging: whether to record the decision and metadata

A well-structured firewall policy typically follows the principle of least privilege (only permit what’s necessary).

📌 Pro Tip: A common short-note phrasing is: “Rules match traffic attributes and apply an allow/deny action; stateful firewalls additionally validate connection/session legitimacy.”

Footnotes

  1. Security policy and firewall rules/logging best practices (https://csrc.nist.gov) - General guidance supporting policy/rule design and audit/logging considerations. ↩

  2. NIST Computer Security Resource Center - Firewalls (and related network security concepts) (https://csrc.nist.gov) - Reference guidance for firewall concepts and security control framing. ↩

Firewall Capabilities by Inspection Depth

A quick comparison for short notes (higher = more inspection detail).

Common Exam-Style Short-Note Prompts

Typical Firewall Deployment Lifecycle (High-Level)

Define policy

Plan

List required services, permitted networks, and risk assumptions."

Implement rules

Configure

Create allow/deny rules, state settings, and logging policies."

Validate behavior

Test

Test legitimate flows and verify blocked traffic matches expectations."

Go live

Deploy

Enable firewall for production traffic with monitoring in place."

Tune & audit

Maintain

Update rules, review logs, and adjust to new services/threats."

Footnotes

  1. Security policy and firewall rules/logging best practices (https://csrc.nist.gov) - General guidance supporting policy/rule design and audit/logging considerations. ↩

Keyword Deck (Use as Mini Notes)

  • Firewall
  • Packet filtering
  • Stateful inspection
  • Application-layer inspection
  • WAF
  • Access control
  • Logging

Firewall Short Notes Quick Review

1 / 5
Question · Term

Define a firewall.

Click to reveal
Answer · Definition

A Firewall enforces security rules to allow or deny network traffic.

Knowledge Check

Question 1 of 4
Q1Single choice

Which component primarily matches packet header fields like IP addresses, ports, and protocol?

Explore Related Topics

1

Token Ring: Short Note (IEEE 802.5) — Working, Features, and Comparison

2

Knowledge: Short Notes with a Clear Conceptual Framework

3

Finite-State Machines (FSM): A Short Note with Core Theory and Examples

Browse all research articles