Firewall काय आहे आणि प्रकार: Packet, Stateful, NGFW, WAF आणि UTM

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. रोजचे उदाहरण: इमारतीचा security guard

इमारतीचा guard = firewall. Visitor = packet/connection/HTTP. Book = rules. ID only = packet filter; आठवण = stateful; parcel उघडणे = proxy/WAF; phone line = circuit-level; photo+temp+robot = NGFW.

Street gate = network-based; apartment lock = host-based; rented cloud guard = cloud firewall; all-in-one booth = UTM.

2. Vertical diagram: firewall कुठे बसते

3. Firewall का लागतं?

हे का लागतं?

Network shared आहे. Filter नसेल तर प्रत्येक port = door. Firewall = allow/deny/inspect policy point.

• Attack surface कमी
• Tier isolation
• Deny logs
• Compliance

4. Firewall काय आहे?

हे काय आहे?

Firewall = rules नुसार allow/deny/inspect. Address/port/state/payload/intel. Host, appliance किंवा cloud service.

5. प्रकार 1 — Packet-filter (stateless)

प्रत्येक packet एकटा: IP/protocol/ports. Reply memory नाही. वेगवान. AWS NACL ≈ या family — deep: SG vs NACL.

• Pros: simple, fast
• Cons: return ports; misconfig
• Industry: routers / NACL

6. प्रकार 2 — Stateful inspection

Connection आठवतो. Outbound 443 allow → return auto. AWS SG = stateful — details SG vs NACL chapter.

• Pros: कमी rules
• Cons: state table / asymmetry
• Industry: perimeter + SG

7. प्रकार 3 — Application / proxy

Client connection terminate → server ला नवी. HTTP method/URL enforce. WAF = web specialised — CF+WAF, WAF explained.

8. प्रकार 4 — Circuit-level gateway

Session/circuit approve झाल्यावर bytes चालतात; deep payload कमी. Proxy पेक्षा हलके; visibility कमी.

9. प्रकार 5 — NGFW

Stateful + app awareness + IPS + intel. Vendors अनेक. AWS वर Network Firewall (Suricata) — या set च्या chapter 3.

10. प्रकार 6 — WAF

HTTP/HTTPS specialised. Network FW replace नाही. Shield/DDoS: Shield, DDoS project.

11. Host-based vs network-based

पुढचा chapter = Linux host FW hands-on. SELinux/fail2ban: hardening survey.

12. Hardware vs software vs cloud

13. UTM

एक box = FW+AV+web filter+VPN. Small office (Dr. Meera Sharma, Jaipur). Simple vs single failure + कमी depth.

14. तुलना table

15. Multi-industry

• Healthcare: network + WAF + host
• Fintech: NGFW + WAF + SG
• Ecommerce: edge WAF + NF + ufw
• Education: UTM → cloud
• Manufacturing: OT/IT split

16. Lab: तुमचा stack table ला map करा

कसं करायचं (step by step)

1. सध्याचे filters लिहा.
2. Type tag लावा.
3. एक public app vertical draw.
4. Gaps गोल करा.
5. Gap = ticket + chapter link.

Cleanup

1. फक्त paper — bill नाही.
2. Wiki मध्ये ठेवा.

17. Firewall decision checklist

1. Threat एक वाक्य.
2. Layer निवडा.
3. Form निवडा.
4. Default policy.
5. Allow + deny tests.
6. Logging dest.
7. On-call.
8. Deep chapter link.
9. Cost estimate.
10. Persist test.

18. Copy-paste quick commands

# --- Host (Ubuntu ufw) ---
sudo ufw status verbose
sudo ufw allow OpenSSH && sudo ufw allow 80/tcp && sudo ufw enable

# --- Host (RHEL firewalld) ---
sudo firewall-cmd --permanent --add-service=http && sudo firewall-cmd --reload

# --- Host (nft) ---
sudo nft list ruleset

# --- AWS pointers (details in linked chapters) ---
aws ec2 describe-security-groups --group-ids $SG
aws wafv2 list-web-acls --scope REGIONAL --region ap-south-1
aws network-firewall list-firewalls --region ap-south-1
aws route53resolver list-firewall-rule-groups --region ap-south-1

19. अजून industry stories

• Retail: host+network; WAF ecommerce only
• Media: CF+WAF; NF admin; Shield
• Gov: FMS mandate
• Startup: grow into NF
• Logistics: DNS+Suricata

20. Glossary

21. Practice: मोठ्याने explain

1. 60s guard story.
2. 60s four tools.
3. 60s four AWS.
4. 60s inspection VPC.
5. Record ×2.

22. Safe lab hygiene

• Prod SSH + DROP = console.
• Tag owner+expiry.
• Rollback file.
• Allowlist first.
• NF hourly — delete.

23. या set ची links

• Networking basics
• SG vs NACL
• Hardening survey
• CF+WAF
• WAF/Shield set

24. Rule-writing workshop

आधी English rule, मग tool. वाईट: bad stuff. चांगले: Drop 445 except 10.0.0.0/16.

1. Direction.
2. Match fields.
3. Action.
4. Observability.
5. Rollback.
6. Peer review.

25. Allow / deny matrix

26. दहा oral drills

1. Packet vs stateful ×3.
2. Four Linux tools.
3. Refused ≠ filtered.
4. Inspection VPC.
5. UTM when.
6. Suricata on AWS.
7. FMS stops drift.
8. No duplicate.
9. Two industries.
10. NF hourly delete.

27. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

28. Troubleshooting checklist

1. कुठल्या layer ने allow केले?
2. Default deny की allow?
3. State/flow logs.
4. HTTP → WAF samples.
5. Inspection hop bypass?

29. FAQ

30. Interview Q&A

31. Tips — English, मराठी आणि हिंदी

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.