PracticeBlogFlashcardsEspañol

Firewalls, WAF, IDS, IPS, and Proxies

Key Takeaways

  • Firewalls enforce traffic policy based on criteria such as address, port, protocol, state, application, user, or content.
  • A WAF protects web applications by inspecting HTTP and HTTPS application-layer traffic for web attack patterns.
  • IDS detects and alerts; IPS can block or modify traffic inline.
  • Forward proxies protect users going out; reverse proxies protect services being accessed from outside.
  • Rule order, default deny behavior, logging, and exact source/destination scope are common exam traps.
Last updated: April 2026

Network security devices are often tested by placement and function. Read whether the scenario needs to allow, block, inspect, alert, proxy, or protect a web application.

Control Comparison

ControlMain purposeTypical placement
Packet-filtering firewallFilter by IP, port, protocolNetwork boundary or router ACL
Stateful firewallTrack connection stateNetwork perimeter or segmentation boundary
Next-generation firewallAdd app/user/content awarenessEdge or internal segmentation point
WAFInspect web requests and responsesIn front of web applications
IDSDetect and alert on suspicious activitySensor span port, tap, or host
IPSDetect and block inlineInline network path
Forward proxyControl user web accessBetween users and internet
Reverse proxyFront-end and protect serversBetween clients and internal web services

Firewall Rule Anatomy

A firewall or ACL rule should identify:

  • Direction or interface.
  • Source.
  • Destination.
  • Service or port.
  • Action.
  • Logging.
  • Rule order.

Example for a public website with an internal database:

OrderSourceDestinationServiceAction
10InternetReverse proxyTCP 443Allow/log
20Reverse proxyWeb appTCP 443Allow/log
30Web appDatabaseTCP 5432Allow/log
40InternetDatabaseAnyDeny/log
99AnyAnyAnyDeny/log

Common trap: an allow-any rule placed above a deny rule makes the deny rule ineffective. Firewalls typically process rules in order until a match is found.

WAF Use Cases

A WAF is the better answer when the scenario mentions:

  • SQL injection attempts in web requests.
  • Cross-site scripting payloads.
  • Malicious HTTP headers.
  • Path traversal attempts.
  • Bot or rate-limit behavior against web endpoints.
  • Virtual patching for a known web vulnerability while code is fixed.

A WAF is not a replacement for secure coding, parameterized queries, patching, or authentication. It is a compensating and detective/preventive layer for web traffic.

IDS vs IPS

FeatureIDSIPS
Traffic pathUsually out of bandInline
Main actionAlertBlock, drop, reset, or alert
Failure concernMissed detectionBlocking legitimate traffic
Best clue"Detect without disrupting traffic""Prevent malicious traffic in real time"

If a question says the business cannot risk accidental blocking, IDS is often safer. If the requirement is to stop known malicious traffic inline, IPS is stronger.

Proxy Scenarios

Forward proxy:

  • Users connect to the proxy.
  • Proxy fetches internet resources for users.
  • Enforces URL filtering, malware scanning, authentication, and logging.

Reverse proxy:

  • External clients connect to the proxy.
  • Proxy forwards to internal web services.
  • Can provide TLS termination, load balancing, authentication, caching, and hiding server details.

PBQ-Style Rule Fix

Current rules:

OrderSourceDestinationServiceAction
1AnyAnyAnyAllow
2InternetDatabaseAnyDeny
3InternetWebTCP 443Allow

Problem: Rule 1 allows everything before later rules are checked.

Fix:

  1. Remove or move the broad allow rule.
  2. Add specific allow rules for required flows.
  3. Add explicit denies for prohibited high-risk flows if needed.
  4. Keep a final default deny and log rule.

Exam rule: specific allow rules should be above broad deny rules when needed, and broad allow rules should not defeat the policy.

Test Your Knowledge

A company wants to detect suspicious traffic but cannot risk the control blocking legitimate production packets. Which deployment best fits?

A
B
C
D
Test Your Knowledge

A web application is receiving SQL injection and cross-site scripting attempts. Which control is most directly designed to inspect and block these HTTP-layer attacks?

A
B
C
D
Test Your KnowledgeMulti-Select

Which firewall rule qualities are important in a secure design? Choose three.

Select all that apply

Specific source and destination
Required service or port only
Logging for important allow or deny events
An allow-any rule at the top
No final deny rule
Up Next

VPN, Remote Access, and NAC

Continue learning