What Firewalls Solve

A firewall filters network traffic based on rules: allow legitimate packets, block malicious or unwanted ones.

Use cases:

• Block external attackers from internal services.
• Restrict outbound (preventing exfiltration, unauthorized API calls).
• Network segmentation: production vs dev, DMZ vs internal.
• DoS protection: rate limit + drop suspicious patterns.
• Compliance: HIPAA, PCI-DSS require firewalls.

Real implementations:

• iptables / nftables (Linux): kernel-level packet filter.
• pf (BSD, macOS): packet filter framework.
• Windows Firewall: built-in OS firewall.
• AWS Security Groups: cloud firewall.
• GCP Firewall Rules: cloud firewall.
• Cloudflare WAF: layer-7 firewall (HTTP).
• pfSense / OPNsense: full firewall appliances.

Layers:

• L3 (Network): filter by IP. Most basic firewalls.
• L4 (Transport): filter by port + protocol (TCP/UDP).
• L7 (Application): deep packet inspection (payload-aware).

Stateless vs stateful:

• Stateless: each packet evaluated independently. Simple, fast, less powerful.
• Stateful: tracks connections; allows return traffic for established conns.

We'll build a stateful packet filter, similar to iptables. Learn:

• Rule matching.
• Connection tracking.
• NAT (Network Address Translation).

Reference: Linux netfilter docs, OpenBSD pf manual.