9.2 Firewalls, IDS & IPS

Once identities and permissions are under control, defenders still need to police traffic moving across network boundaries. Firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) are core network defensive controls on the Cyber Test. Questions usually test whether you can distinguish firewall types and whether a sensor merely alerts or can actively block.

What a Firewall Does

A firewall is a network security device or software that sits between zones of different trust (for example, the internet and an internal network, or a user LAN and a restricted server segment). It evaluates traffic against a policy — a set of allow/deny rules — and either forwards or drops packets. Default-deny ("deny all unless explicitly allowed") is the stronger posture; default-allow is easier to misconfigure into exposure.

Firewalls implement segmentation: they shrink the attack surface by ensuring that only approved services are reachable across a boundary. They do not replace host hardening, patching, or good authentication — they are one layer in a deeper defense strategy covered in the next section.

Packet-Filtering Firewalls

A packet-filtering firewall (also called a stateless packet filter when it lacks connection tracking) inspects individual packets, typically looking at Layer 3/4 header fields: source and destination IP addresses, protocol (TCP/UDP/ICMP), and port numbers. Rules might say "allow TCP 443 to the web server subnet" or "deny all inbound Telnet (TCP 23)."

Strengths: fast, relatively simple, low latency. Weaknesses: limited context. Without remembering whether a packet belongs to an established conversation, a naive filter can be tricked by crafted packets that look like replies or that abuse allowed ports. Packet filters also generally do not understand application content (for example, malicious commands inside an allowed HTTPS session).

Think of a packet filter as a bouncer checking IDs at the door by looking at the address on the envelope — not reading the letter inside, and not always remembering who already came in.

Stateful Firewalls

A stateful firewall tracks connection state. When an internal host starts an outbound TCP connection, the firewall records that conversation in a state table. Matching return traffic is allowed because it belongs to an established session; unsolicited inbound packets that do not match a known state can be dropped even if a naive port rule might have been ambiguous.

Stateful inspection dramatically improves accuracy for protocols like TCP, where the difference between "reply to our request" and "unsolicited inbound probe" matters. Most modern network firewalls are stateful by default. On the exam, if a question emphasizes tracking established sessions or dynamic allow of return traffic, the answer is stateful inspection — not a simple static packet filter.

Proxy (Application-Layer) Firewalls

A proxy firewall (application proxy / application-layer gateway) does not simply forward packets between client and server. It terminates the client connection, inspects or rebuilds the request at the application layer, and opens a separate connection to the destination if policy allows. From the outside, the proxy is the visible endpoint.

Because proxies understand application protocols (HTTP, SMTP, and others depending on the product), they can enforce content rules: block certain URLs, strip dangerous attachments, or validate protocol compliance. That depth costs performance and can require protocol-specific proxy support. Proxy firewalls are stronger at application abuse detection than pure packet filters, but they are not a magic "read encrypted everything" solution without TLS interception and careful design.

Quick firewall comparison:

Intrusion Detection Systems (IDS)

An IDS monitors network or host activity for signs of malicious or policy-violating behavior and generates alerts. Classic approaches include:

• Signature-based detection — matches known attack patterns (like antivirus signatures). Good for known threats; weak against brand-new (zero-day) variants until signatures update.
• Anomaly-based detection — flags deviations from a learned "normal" baseline. Can catch novel behavior; risks more false positives if the baseline is noisy.

Network IDS (NIDS) watches traffic (often via SPAN/mirror ports or taps). Host IDS (HIDS) watches a single system's logs, files, or processes. Critically for the exam: a pure IDS is detective. It informs analysts; it does not, by definition, have to sit inline and stop the packet.

Intrusion Prevention Systems (IPS)

An IPS uses similar detection techniques but can actively block, drop, reset, or otherwise prevent malicious traffic. To do that effectively, an IPS is typically deployed inline — traffic must pass through it. That placement enables prevention but also means a failed IPS can become a network bottleneck or outage point if not engineered carefully (high availability, fail-open vs fail-closed policy decisions).

Exam distinction in one sentence: IDS detects and alerts; IPS detects and can block. If a question says "passive monitoring" or "out-of-band sensor," think IDS. If it says "inline" and "automatically drops the attack packet," think IPS. Many enterprise platforms blend IDS/IPS features; the Cyber Test still expects the conceptual split.

How Firewalls Relate to IDS/IPS

Do not treat these as interchangeable labels:

• Firewall — primarily enforces allow/deny policy between zones (ports, addresses, applications, users depending on generation)
• IDS — finds suspicious activity and notifies
• IPS — finds suspicious activity and intervenes

In practice, next-generation firewalls may include IPS signatures, application awareness, and user identity rules. For aptitude-exam purposes, answer with the primary function described in the stem. "Blocks TCP 23 from the internet" sounds like firewall policy. "Alerts when a known exploit payload is seen on the SPAN port" sounds like IDS. "Drops packets matching an exploit signature on the inline path" sounds like IPS.

Placement Mental Model

Picture a base network edge: internet → border firewall (stateful rules) → demilitarized zone (DMZ) services → internal firewall → mission LAN. An IDS sensor might watch a mirrored copy of DMZ traffic and page analysts. An IPS module might sit inline before critical servers to stop worm-like traffic automatically. Analysts still review alerts because automated blocks can false-positive and interrupt legitimate missions.

Master the three firewall depths (packet / stateful / proxy) and the IDS-vs-IPS action difference. Those two distinctions unlock most Cyber Test items in this topic.