Firewall: packet filtering & stateful rules

A firewall is a network security control that enforces traffic policy by inspecting and filtering packets at one or more OSI layers. Packet filtering and stateful rules are the two foundational mechanisms. Stateless packet filtering evaluates each packet in isolation against source/destination IP, port, and protocol fields. Stateful inspection tracks the full connection state table, allowing only packets that belong to an established, permitted session. Next-generation firewalls (NGFW) extend this model with deep packet inspection (DPI), application-layer identification, TLS decryption, and user-identity awareness. Firewalls operate at network perimeters, between internal segments, and increasingly as host-based agents on endpoints. Their placement directly determines the attack surface exposed to untrusted networks. Misconfigured rules — overly permissive ACLs, missing egress filtering, or shadow rules — are among the most common causes of lateral movement and data exfiltration in compromised environments.

Blue Team monitoring of firewall infrastructure relies on several concrete data sources. Firewall deny logs should be ingested into a SIEM such as Splunk or Elastic and correlated against internal asset inventories to identify unexpected outbound connection attempts. High-frequency deny events from a single internal host indicate port scanning or C2 beaconing. On Windows endpoints, host-based firewall events are recorded under Event ID 5152 (packet blocked) and 5157 (connection blocked) in the Security log, and under the Windows Filtering Platform (WFP) audit subcategory. Sudden changes to firewall rules generate Event ID 4950 and 4954. Network-level anomalies such as asymmetric traffic volumes, long-duration flows to unusual ASNs, or traffic on non-standard ports should trigger investigation. Tools like Zeek, Suricata, and NetFlow analyzers complement firewall logs by providing full session metadata. Periodic rule-base audits using tools such as Tufin or AlgoSec detect rule bloat, duplicate entries, and permissive any/any rules that bypass intended policy.

Red Team operators test firewall controls through several precise techniques. Firewall evasion commonly exploits fragmentation: splitting a malicious payload across multiple IP fragments can bypass stateless filters that do not reassemble traffic before inspection. Protocol tunneling over allowed ports — such as DNS over port 53, HTTPS over port 443, or ICMP tunneling — bypasses rules that filter by port alone without DPI. Tools like nmap support fragmentation (-f), decoy scans (-D), and source port spoofing (--source-port) to probe filtering policies without triggering signatures. Living-off-the-land techniques use built-in Windows utilities such as certutil or bitsadmin to exfiltrate data over HTTP/S, which most perimeter firewalls allow by default. On the hardening side, defenders should apply least-privilege egress filtering, enforce explicit deny-all defaults, and segment networks using internal firewalls to limit blast radius. NGFW policies should enforce TLS inspection on egress traffic to detect encrypted C2 channels. Rule bases must be reviewed quarterly, and any change should go through a formal change management process with automated policy verification.