Lesson 12: Perimeter Defense — Firewalls, WAF, DMZ, and IDS/IPS
In the previous lesson we mapped how attackers hit the application directly — XSS, SQL injection, buffer overflow, and credential theft. This lesson moves to the defense side: the tools that sit on the boundary between the open internet and the organization's network, stopping much of that threat la
In brief: packet filtering is a guard checking each packet alone against a rule list, while stateful remembers the whole conversation — but that very memory can be flooded (SYN Flood). A WAF guards the application, a DMZ isolates exposed servers in a buffer zone, IDS alerts and IPS also blocks. A VPN wraps traffic in an encrypted tunnel, and a NACL filters at the subnet level while remembering nothing.
- Packet Filtering Firewall
- Filters packets at the network layer (Layer 3) and transport layer (Layer 4) against predefined static rules (ACLs) — IP address, port, protocol, and direction — without any regard to connection state.
- Stateful Firewall & State Table
- A firewall that analyzes conversation context rather than treating each packet in isolation: when a SYN packet is approved, a row opens in the State Table (a log held in RAM) with the IP, ports, and expected sequence number (SEQ); future packets are checked only against that row. The same table that lets it spot a forged connection also exposes the firewall to a SYN flood that fills up its RAM.
- WAF (Web Application Firewall)
- A security component that filters HTTP/S traffic at the application layer, analyzes the full request content (not just protocol details), and specifically protects against attacks such as SQL injection, XSS, and CSRF from the OWASP Top 10.
- DMZ (Demilitarized Zone)
- An isolated area hosting services that must be internet-accessible (Web, mail, DNS), so a breach there confines the attacker to the DMZ alone. In a single-firewall configuration, one device manages all the traffic; in a dual-firewall configuration, two separate devices — one between the internet and the DMZ, one between the DMZ and the internal network — raise the cost of a breach.
- IDS vs IPS
- IDS monitors traffic and system events (via signature-based or anomaly-based methods) and only alerts, without blocking. IPS combines that same detection capability with active, real-time blocking.
- VPN (Virtual Private Network)
- Enables an encrypted, secure connection over an untrusted public network, via an encrypted virtual 'tunnel' and identity authentication — so even as data passes through the open internet, it remains undecipherable.
- Network ACL (NACL)
- An additional, stateless defense layer at the subnet/VLAN level, filtering inbound and outbound traffic via static Allow/Deny rules based on IP addresses and ports — before traffic even reaches the main firewall.