What Is a Firewall and Its Types: Packet, Stateful, NGFW, WAF and UTM

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Everyday example: the building security guard

Think of your office building. A security guard at the gate is a firewall. Visitors are packets (or connections, or HTTP requests). The visitor book is the rule set. The guard can: (1) check only the ID card number — like a packet filter that looks at IP and port; (2) remember that this courier was already signed in upstairs — like stateful inspection; (3) open the parcel and read the letter — like an application / proxy firewall or WAF; (4) call the floor receptionist on a phone line you already opened — like a circuit-level gateway; (5) also check temperature, banned-list photos and "are you a robot?" — like a next-gen firewall (NGFW).

One guard at the street gate is a network-based firewall. A lock on each apartment door is a host-based firewall. A rented guard company in the cloud is a cloud firewall. A "do everything" booth that also sells SIM cards and CCTV is UTM (Unified Threat Management) — convenient, but one booth fails and many services suffer.

2. Vertical diagram: where firewalls sit

3. Why do we need firewalls?

Why do we need this?

Networks are shared. Without a filter, every port on every host is a door. Attackers scan, flood, inject and pivot. A firewall is the policy point that says allow, deny or inspect before traffic reaches the workload.

• Reduce the attack surface (close what you do not need)
• Enforce least privilege between tiers (web ≠ database)
• Log denied attempts for forensics
• Meet compliance (PCI, ISO, RBI) that demands perimeter controls

4. What is a firewall?

What is it?

A firewall is a control that evaluates network traffic against a rule set and decides allow, deny or inspect. Rules can look at addresses, ports, connection state, application payloads or threat intelligence. Placement can be on a host, on a network appliance, or as a cloud service.

5. Type 1 — Packet-filter (stateless)

Looks at each packet alone: source/dest IP, protocol, ports. No memory of "this is a reply to a request we allowed". Fast and cheap. Classic example: many Network ACL (NACL) behaviours on AWS — see the deep class chapter Security Group vs NACL (we do not repeat that lab here).

• Pros: simple, high throughput, predictable
• Cons: must open ephemeral return ports carefully; easy to misconfigure
• Industry: edge routers, some cloud NACLs, old border routers

6. Type 2 — Stateful inspection

Remembers connections. If you allowed outbound TCP to 443, the return packets belonging to that flow are allowed automatically. Security Groups on AWS are stateful — again, details in the SG vs NACL chapter.

• Pros: fewer rules, safer defaults for return traffic
• Cons: state table memory; asymmetric routing can break state
• Industry: most enterprise perimeter firewalls, cloud SGs

7. Type 3 — Application / proxy firewall

Terminates the client connection and opens a new one to the server (or inspects deeply at the application protocol). Can enforce HTTP methods, URLs, SMTP commands. A reverse proxy with security policies is in this family. WAF is the specialised web flavour — deep chapters: CloudFront+WAF survey and AWS WAF explained.

8. Type 4 — Circuit-level gateway

Works around session / circuit setup (often SOCKS-style ideas): once a circuit is approved, bytes flow without deep app inspection. Lighter than a full proxy; weaker visibility into payloads.

9. Type 5 — Next-gen firewall (NGFW)

Combines stateful firewalling with application awareness, intrusion prevention (IPS), sometimes sandboxing and threat intel feeds. Vendors: Palo Alto, Fortinet, Cisco, Check Point, and cloud NGFW offerings. On AWS you will also meet AWS Network Firewall (Suricata-compatible) in chapter 3 of this set.

10. Type 6 — Web Application Firewall (WAF)

Specialises in HTTP/HTTPS: SQLi, XSS, bots, rate limits, geo, OWASP rules. Not a replacement for network firewalls — it sits where web traffic lives (CDN, ALB, API Gateway). For DDoS layers and Shield, see Shield Standard vs Advanced and the DDoS-resilient project.

11. Host-based vs network-based

Next chapter is the Linux host-firewall hands-on. The broader hardening survey (SELinux, fail2ban, auditd…) lives in Linux security hardening — link, do not duplicate.

12. Hardware vs software vs cloud firewall

13. UTM — Unified Threat Management

One box (or one license) that bundles firewall + antivirus + web filter + VPN + sometimes email filter. Popular in small offices (example: Jaipur dental clinic of Dr. Meera Sharma wanting one appliance). Trade-off: simplicity vs single point of failure and weaker best-of-breed depth.

14. Comparison table

15. Multi-industry snapshots

• Healthcare (Adaeze Okonkwo, Lagos): network FW between EMR and internet; WAF on patient portal; host FW on jump hosts.
• Fintech (Arjun Mehta, Mumbai): NGFW/IPS on egress; WAF on /login; SG tiers in VPC.
• Ecommerce (Lucas Meyer, Berlin): CloudFront+WAF edge; Network Firewall for east-west; ufw on bastions.
• Education (Sofia Alvarez, Bogotá): UTM for small campus; migrate critical apps to cloud FW later.
• Manufacturing (Kenji Watanabe, Osaka): OT network segmented by industrial FW; IT uses NGFW.

16. Lab: map your current stack to the table

How to do it (step by step)

1. List every filter you already run (SG, NACL, ufw, WAF, vendor NGFW).
2. Mark each as packet / stateful / proxy / NGFW / WAF / UTM.
3. Draw the vertical path for one public app (use the diagram above).
4. Circle gaps (e.g. no host FW on bastion, or no WAF on login).
5. Write one ticket per gap; link the matching deep chapter.

Cleanup

1. This lab is paper/architecture only — no cloud spend.
2. Store the diagram in your team wiki.

17. Firewall decision checklist

1. Write the threat in one sentence (scan, SQLi, malware DNS, lateral SSH).
2. Pick the layer: packet / stateful / proxy / NGFW / WAF / DNS / host.
3. Pick the form: host tool, network appliance, or cloud service.
4. Default deny or default allow? Write it down.
5. Plan allow tests and deny tests before go-live.
6. Plan logging destination (file, CloudWatch, SIEM).
7. Name the on-call for false positives.
8. Link the deep chapter you will not duplicate (SG/NACL, WAF, hardening).
9. Estimate monthly cost (especially Network Firewall).
10. Schedule a reboot or failover test for persistence.

18. Copy-paste quick commands

# --- Host (Ubuntu ufw) ---
sudo ufw status verbose
sudo ufw allow OpenSSH && sudo ufw allow 80/tcp && sudo ufw enable

# --- Host (RHEL firewalld) ---
sudo firewall-cmd --permanent --add-service=http && sudo firewall-cmd --reload

# --- Host (nft) ---
sudo nft list ruleset

# --- AWS pointers (details in linked chapters) ---
aws ec2 describe-security-groups --group-ids $SG
aws wafv2 list-web-acls --scope REGIONAL --region ap-south-1
aws network-firewall list-firewalls --region ap-south-1
aws route53resolver list-firewall-rule-groups --region ap-south-1

19. More industry stories

• Retail POS (Kenji, Osaka): host FW on till PCs; network FW between stores and HQ; WAF only on ecommerce, not on private VPN APIs.
• Media streaming (Priya, Pune): CloudFront+WAF for viewers; Network Firewall for origin admin VPC; Shield Advanced on match-day.
• Gov portal (Fatima, Rabat): FMS mandates WAF CRS + DNS Firewall across ministries; local teams cannot disable.
• Startup (Diego, São Paulo): start with SG+ufw+CloudFront WAF; add Network Firewall when east-west grows.
• Logistics (Mei, Singapore): DNS Firewall blocks sinkholes; Suricata drops known C2 on inspection VPC.

20. Glossary (short)

21. Practice: explain out loud

1. 60 seconds: building-guard story for firewall types.
2. 60 seconds: iptables vs nftables vs firewalld vs ufw.
3. 60 seconds: SG vs NACL vs Network Firewall vs WAF.
4. 60 seconds: inspection VPC with Transit Gateway.
5. Record yourself once; fix filler words; record again.

22. Safe lab hygiene

• Never practice DROP rules on a production SSH session without console access.
• Tag every cloud lab resource with owner and expiry.
• Keep a written rollback: old ruleset file or SG snapshot.
• Prefer allowlists over giant denylists when starting.
• After lab, delete Network Firewall — it bills hourly.

23. How this set links other chapters

• Networking basics / ports — foundations before filters.
• SG vs NACL class — stateful vs stateless on AWS VPC.
• Linux hardening survey — SELinux, fail2ban, auditd beyond FW.
• CloudFront+WAF survey — CDN/HTTPS + light WAF.
• WAF explained / hands-on / Shield / DDoS project — L7 and DDoS depth.

24. Rule-writing workshop

Write rules in English first, then translate to the tool. Bad: "block bad stuff". Good: "Drop TCP 445 from 0.0.0.0/0 on INPUT; allow TCP 445 only from 10.0.0.0/16".

1. Name the direction: inbound, outbound, or east-west.
2. Name the 5-tuple or domain or HTTP path.
3. Name the action: accept, drop, alert, challenge.
4. Name the hit counter / log you will check.
5. Name the rollback (previous ruleset file).
6. Peer-review with someone who did not write it.

25. Sample allow / deny matrix

26. Ten oral drill questions

1. Say three differences between packet filter and stateful.
2. Name four Linux host firewall tools.
3. Why does connection refused ≠ filtered?
4. What is an inspection VPC for?
5. When is UTM a good first buy?
6. Where do Suricata rules run on AWS?
7. What does Firewall Manager stop?
8. Why link SG vs NACL instead of rewriting?
9. Give one healthcare and one fintech firewall story.
10. What do you delete first in lab cleanup for cost?

27. Common errors and fixes

Each row is a real mistake students and juniors hit. Read the fix before you panic.

28. Troubleshooting checklist

1. Can users reach the app? If yes, which layer allowed it — edge, network, host?
2. Check default policy: default-deny or default-allow?
3. For stateful issues, inspect connection tables / flow logs.
4. For HTTP attacks, jump to WAF sampled requests — not SG.
5. Confirm you are not double-NATing past the inspection hop.

29. FAQ

30. Interview Q&A

31. Tips in English, Marathi and Hindi

Revision, interview and comparison cards

Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.

More cards: Ravi Sir's Cards.