Packet Filtering Firewall — With Real Examples
A Packet Filtering Firewall is the most basic type of network firewall. It examines source IP, destination IP, port numbers, and protocol before allowing or blocking traffic. This is called Layer-3/Layer-4 filtering in the OSI model.
How Packet Filtering Works
Packet filtering checks incoming and outgoing packets using rules:
IF Source IP = Allowed AND Port = 80 THEN Permit traffic ELSE Block
Key Fields Checked
- Source IP
- Destination IP
- Source Port
- Destination Port
- Protocol (TCP/UDP/ICMP)
Real-Life Example
Permit 192.168.1.5 → Port 443 (HTTPS) Deny 10.5.20.50 → Port 22 (SSH)
Advantages
- Fast performance
- Low resource usage
- Easy to configure
- Good for small networks/home users
Limitations
- Cannot inspect packet contents
- No protection against encrypted threats
- Does not detect malware/trojans
- Cannot identify applications
Where Packet Filters Are Used
- Home routers
- Basic firewalls
- Cloud security groups (AWS/GCP/Azure)
- ISP perimeter filters
Example AWS Security Group Rule
Allow: 0.0.0.0/0 → TCP 443 Deny: All others
Conclusion
Packet filtering is essential for basic network security. While modern networks need deep inspection firewalls, packet filtering is still the foundation of network security rules.
