Changes

==Physical and Virtual==

==Physical and Virtual==

Firewalls can be either physical devices which sit on the network between the Internet and the internal client, or software systems which are installed onto the client's device.

Firewalls can be either physical devices which sit on the network between the Internet and the internal client, or software systems which are installed onto the client's device.

===Hardware==

===Hardware===

Hardware firewalls are generally considered the best front-line of defense. When an incoming connection reaches the protected network, the connection must first go through this hardware firewall.  If the connection is unwanted, it will generally be ignored.  In this case, the entity attempting to connect will simply have their request time out.  Some will outright reject the request, which is a less effective defense method. (If rejected outright, a potential attacker will know he has found an active device, whereas if the request is ignored, it will be more difficult to know if there is even a device to connect to.)<br />

Hardware firewalls are generally considered the best front-line of defense. When an incoming connection reaches the protected network, the connection must first go through this hardware firewall.  If the connection is unwanted, it will generally be ignored.  In this case, the entity attempting to connect will simply have their request time out.  Some firewalls will outright reject the request, however, which is a less effective defense method. (If rejected outright, a potential attacker will know he has found an active device, whereas if the request is ignored, it will be more difficult to know if there is even a device to connect to.)<br />

To the outside world, there is only one device (the firewall) on the protected network. Even when a connection is permitted, the communication still passes through the firewall using a specified port.  Therefore, even active connections do not reveal the internal [[IP address]] of devices.<br />

To the outside world, there is only one device (the firewall) on the protected network. Even when a connection is permitted, the communication still passes through the firewall using a specified port.  Therefore, even active connections do not reveal the internal [[IP address]] of devices.<ref name="WhatIsMyIPAddress.com">“What is a Firewall?” WhatIsMyIPAddress.com, whatismyipaddress.com/firewall. Accessed 7 Sept. 2017.</ref><br />

However, Hardware firewalls often do not know what connections are being used for.  Most do not collect the packets and reassemble messages, so connections can be abused without the firewall knowing.  Even the ones which do attempt to analyze traffic can have difficulty understanding what is going on. [[Encryption]] almost guarantees that the firewall will be ignorant.  

However, many hardware firewalls (all but the newest types) often do not know what connections are being used for.  Most do not collect the packets and reassemble messages, so connections can be abused without the firewall knowing.  Even the ones which do attempt to analyze traffic can have difficulty understanding what is going on.<ref name="WhatIsMyIPAddress.com">“What is a Firewall?” WhatIsMyIPAddress.com, whatismyipaddress.com/firewall. Accessed 7 Sept. 2017.</ref>

===Software==

===Software===

Software firewalls are not typically considered a good first line of defense, but a good addition to a tiered defense system.  They digitally intercept and attempt to analyze traffic on the client's system.  Anything not seen as a threat is allowed through to the rest of the device's system and applications. Since this kind of firewall operates on the [[OSI model]]'s application layer, it has an easier time of understanding what the communication link is being used for.<br />

Software firewalls are not typically considered a good first line of defense, but a good addition to a tiered defense system.  They digitally intercept and attempt to analyze traffic on the client's system. Since this kind of firewall operates on the [[OSI model]]'s application layer, it has an easier time of understanding what the communication link is being used for.<br />

However, unwanted communication must be blocked at the computer (or mobile device), so the communication has already gotten through the hardware firewall (assuming there is one).

However, this unwanted communication must be blocked at the computer (or mobile device), so the communication has already gotten through the hardware firewall (assuming there is one). Although the attempt was still ignored, the external entity now knows there is at least one active device at that IP address.<ref name="WhatIsMyIPAddress.com">“What is a Firewall?” WhatIsMyIPAddress.com, whatismyipaddress.com/firewall. Accessed 7 Sept. 2017.</ref>

*Hardware vs Software: http://whatismyipaddress.com/firewall

 

*Types: https://www.cisco.com/c/en/us/products/security/firewalls/what-is-a-firewall.html

==Types==

 

Less for defense than for utility, the proxy firewall simply redirects certain kinds of traffic to a proxy, while letting other traffic pass directly through.  This is not a type of firewall which is commonly used in modern networks, although this feature can be used in conjunction with others in a more advanced firewall system.<ref name="Cisco">“What Is a Firewall?” Cisco, 6 Sept. 2017, www.cisco.com/c/en/us/products/security/firewalls/what-is-a-firewall.html. Accessed 7 Sept. 2017.</ref>