Firewall, IDS and IPS — the network's border guard
What stops traffic, what just warns, and what a DMZ is
A firewall is a security component that controls which traffic may pass between two networks — typically between the internal network and the internet. It works based on a rule set where traffic is either allowed or denied and the main rule should always be to deny by default and only open what is actively needed.
§Types of firewalls
| Type | What it does |
|---|---|
| Packet filtering firewall | Looks at IP address port and protocol for each packet in isolation |
| Stateful firewall | Remembers a connection's state and can distinguish responses from new, unsolicited traffic |
| Next-generation firewall (NGFW) | Sees deeper into the content itself and can recognise applications and threats not just ports |
§IDS and IPS — the difference
An IDS (Intrusion Detection System) monitors traffic or systems for signs of attack and raises an alarm but does not intervene itself — a human operator or another system must react. An IPS (Intrusion Prevention System) on the other hand sits actively in the path of traffic and can block or reject traffic immediately if it is judged harmful. The advantage of IPS is faster response; the disadvantage is that a misjudgement (false positive) can block legitimate traffic where an IDS would only warn without disrupting operations.
- 01Signature-based detection recognizes known patterns from previous attacks — fast and accurate, but blind to completely new attacks
- 02Anomaly-based detection learns what normal traffic is and raises an alarm for deviations – can catch unknown attacks but gives more false alarms
- 03Most modern solutions combine both approaches to cover each other's weaknesses
§DMZ — a zone in between
A DMZ (demilitarized zone) is a network segment that lies between the open internet and the internal network. Servers that need to be accessible from outside are placed here — e.g. a web server or mail server — so they can be reached from the internet without giving direct access to internal systems. If a server in the DMZ is compromised, the attacker is still outside the internal network and must get through one more layer of defence to proceed.
“A firewall determines what may come in. An IPS determines whether what came in behaves nicely.”
— Professional basic rule in network security.