A2.4.1 · Network security
Firewalls
By the end you can
Discuss how well firewalls protect a network: rules, allow and deny lists, what they do well and what gets past them.
A is a security device or program that sits between a trusted network and an untrusted one (usually the internet) and checks every packet that tries to go in or out. The word comes from the walls built in buildings to stop a fire spreading.
How it decides#
A firewall is configured with a list of rules. Each rule says allow or deny for traffic matching some combination of source address, destination address, port number and protocol (TCP or UDP). The firewall checks a packet against the rules in order; the first rule that matches decides, and nothing further down is read. If no rule matches, the packet is blocked: a good rule list ends with “deny everything else”.
Two ways of building the lists: a says what is allowed and blocks the rest (strict, safest), and a says what is blocked and allows the rest (flexible, but you only block what you already know about). A simple firewall examines each packet alone; a stateful firewall also remembers which connections are open, so replies to a connection you started are let back in. A next-generation (application layer) firewall goes further and inspects the content of the packets, not only the headers.
Rules, checked from the top
- 1DENY everything from 198.51.100.0/24 (a range known for attacks)
- 2ALLOW TCP from anywhere to the web server 192.168.1.10, port 443
- 3ALLOW TCP from the office 192.168.1.0/24 to anywhere, port 443
- 4ALLOW TCP from the office 192.168.1.0/24 to anywhere, port 80
- 5DENY everything else
What happens to each packet
- ALLOWA customer (203.0.113.9) opens the websiteDecided by rule 2.
- DENYAn address from the bad range (198.51.100.7) opens the websiteDecided by rule 1.
- ALLOWA laptop in the office (192.168.1.23) loads a secure pageDecided by rule 3.
- DENYA laptop in the office tries to send mail directly (port 25)Decided by rule 5.
- DENYSomeone outside (203.0.113.9) tries to log in to the web server by SSH (port 22)Decided by rule 5.
- DENYA laptop asks a DNS server to look up a name (UDP, port 53)Decided by rule 5.
Try moving the first rule below the second: the bad address now matches the “allow the website” rule first and gets in. Notice too that the DNS lookup is denied: with “deny everything else”, anything you forgot to allow stops working.
How effective is it?#
What firewalls do well: they control access, so only authorised traffic can reach network resources; they log traffic and raise alerts, which helps spot and investigate attacks; they are versatile and scalable (modern ones add VPN support, intrusion prevention and deep packet inspection); and application-level firewalls can protect specific services.
What gets past them: threats inside the network, such as a malicious insider or a laptop already infected; malicious data sent to an allowed address and port, which a header-only firewall cannot see; sophisticated attacks hidden in encrypted traffic or imitating normal behaviour; and phishing, which tricks a person into letting something in. And a firewall is only as good as its rules and its updates: stale rules leave gaps.
The balanced judgement is that a firewall is an essential first line of defence but never the only one. That is the conclusion a Discuss answer should reach, with the countermeasures of A2.4.3 as the other layers.
Check yourself
Firewalls
Quick questions, made fresh every time and marked here. Do a few until they feel easy.
Exam practice
Paper 1-style questions
5 questions · 18 marks
Write your answer as you would in the exam, then show the mark points and tick each one your answer made. These are our own questions in the style of the exam, not past-paper questions.
1.Describe how a firewall decides whether to let a packet through.
[3]Describe: A detailed account: say what happens, step by step if it is a process.
2.Distinguish between a whitelist and a blacklist.
[2]Distinguish: Make the differences between two things clear.
3.Outline the limitations of firewalls.
[4]Outline: A brief account: the main points, without much detail.
4.A firewall has two rules: (1) allow all traffic to the web server on port 443; (2) deny all traffic from the address range 198.51.100.0/24. Explain why the order of these rules matters.
[3]Explain: Give reasons: say what happens AND why, or how one thing causes another.
5.Discuss the effectiveness of firewalls at protecting a school network.
[6]Discuss: Look at the question from more than one side, weigh the points against each other, and come to a conclusion.
Past papers
Old exam questions on this topic
From HL Paper 1, May 2014 to November 2025. These papers were set on the previous syllabus, so the wording may differ from today's exam, but the topic is the same. Find the questions and markschemes in your school's past-paper pack.
| Paper | Question | Marks | About |
|---|---|---|---|
| November 2024 | 5 | 3 | How a firewall inspects traffic |
| May 2023 TZ1 | 11(e) | 2 | Filtering traffic by its headers (same in TZ2) |
| November 2021 | 10(b) | 4 | Next-generation firewalls and intrusion prevention |
| November 2020 | 9(c) | 4 | Defences such as a perimeter firewall |
In a nutshell
- A firewall is hardware or software that monitors traffic and allows or blocks it by rules: source and destination address, port and protocol.
- Rules are checked in order and the first match wins; unmatched traffic is blocked (default deny), so rule order matters.
- A whitelist names what is allowed; a blacklist names what is blocked. Stateful firewalls also track connections; next-generation firewalls inspect content.
- Strengths: access control, logging and alerts, versatility and application-level checks.
- Limitations: weak against insiders, content hidden in allowed or encrypted traffic, and out-of-date or wrong rules. A firewall is one layer of defence, not the whole answer.