Firewall, IDS, IPS, VPN and proxy explained: what each network control sees and blocks

Network diagrams in security reviews tend to be full of boxes labelled firewall, IPS, WAF, VPN and proxy. Teams buy or enable these controls and assume the network is "protected", without being clear about what each box can actually see. A firewall that only knows IP addresses and ports cannot stop an attack hidden in a valid HTTPS request; an IDS that nobody watches stops nothing.

In part 2 we covered addresses, ports and protocols. This part explains the main network security controls by two questions: what can it see, and what can it do?

Firewalls: allow or deny traffic by rules

A firewall controls which traffic may enter or leave a network or host, based on rules.

Packet filtering and stateful firewalls

The simplest firewalls look at each packet's source and destination address, port and protocol. Modern firewalls are stateful: they track connections, so a reply to an outbound request is allowed back in automatically, while unsolicited inbound packets are dropped.

Cloud security groups and host firewalls such as nftables work this way.

# nftables: allow SSH only from the office range, HTTPS from anywhere, drop the rest inbound
nft add table inet filter
nft add chain inet filter input '{ type filter hook input priority 0; policy drop; }'
nft add rule inet filter input ct state established,related accept
nft add rule inet filter input iif lo accept
nft add rule inet filter input ip saddr 198.51.100.0/24 tcp dport 22 accept
nft add rule inet filter input tcp dport 443 accept

Next-generation firewalls

Next-generation firewalls add application awareness, user identity and often intrusion prevention. They can, for example, allow a protocol only for a certain user group. To inspect encrypted traffic, they must decrypt it, which has privacy and operational costs.

What a firewall cannot do

A firewall that allows port 443 allows everything that arrives on port 443, including SQL injection in a form field. It also cannot help once an attacker uses an allowed path, such as a compromised laptop on the VPN.

IDS and IPS: watch for and stop known bad behaviour

An intrusion detection system (IDS) monitors traffic or host activity and raises alerts when it sees something suspicious. An intrusion prevention system (IPS) sits in the traffic path and can block it.

Both use two detection approaches:

• Signature-based: matches known patterns, such as a specific exploit payload. Accurate for known attacks, blind to new ones.
• Anomaly-based: learns normal behaviour and flags deviations, such as a server suddenly scanning others. Catches unknown attacks but produces more false positives.

There are also network-based (NIDS) and host-based (HIDS) variants. A host-based system sees what the network cannot: processes, file changes and decrypted traffic on the machine itself.

The most common real-world failure is not technical. An IDS generates hundreds of alerts per day, nobody tunes it, and within a month nobody looks. Fewer, high-confidence rules routed to a person beat full coverage that is ignored.

Web application firewalls

A web application firewall (WAF) is a specialised filter for HTTP. It understands requests, so it can block patterns such as injection payloads, oversized bodies or known bad bots. Managed rule sets are available on most CDNs and cloud load balancers.

A WAF is a useful extra layer and a good emergency patch for a newly published vulnerability. It does not replace fixing the application, because attackers regularly find payloads that rules miss. Also make sure the origin cannot be reached directly, or attackers simply go around the WAF.

VPNs: an encrypted tunnel over an untrusted network

A virtual private network (VPN) creates an encrypted tunnel between a device and a network, or between two networks, over an untrusted network such as the internet.

• Remote access VPN: an employee's laptop connects into the company network.
• Site-to-site VPN: two offices or an office and a cloud network are joined, often with IPsec.

A VPN protects traffic confidentiality and integrity on the way, and it narrows who can reach internal services. It also has well-known downsides:

• A connected device is often trusted with broad network access. A compromised laptop then becomes a doorway to everything.
• VPN gateways are internet-facing and a frequent target; unpatched gateways have been a leading cause of ransomware incidents.

Modern designs reduce these risks with per-application access (often called zero trust network access), device health checks and MFA on every connection. A later part of this series covers zero trust.

Proxies: an intermediary that speaks for someone

A proxy is a server that makes requests on behalf of someone else.

Forward proxy

A forward proxy sits in front of clients. Company laptops or servers send outbound web requests through it. It can enforce which destinations are allowed, scan downloads, log access and hide internal addresses.

A forward proxy is a strong egress control for servers: if a server can only reach the internet through a proxy that allows a few package repositories and APIs, malware on it has a much harder time calling home.

Reverse proxy

A reverse proxy sits in front of servers. Clients connect to it, and it forwards requests to the backends. Nginx, HAProxy, cloud load balancers and CDNs are reverse proxies. They terminate TLS, balance load, cache, add security headers and hide the backend topology.

Security note: when a reverse proxy forwards a request, the backend sees the proxy's IP. The client IP is passed in a header such as X-Forwarded-For. The backend must only trust that header when the request really came from the proxy, otherwise clients can spoof their address and bypass IP-based rate limits or allow-lists.

Where each control sits

Internet
   |
[ CDN / DDoS protection / WAF ]        reverse proxy layer, filters HTTP
   |
[ Edge firewall / security group ]     allows 443 only to the load balancer
   |
[ Load balancer / reverse proxy ]      TLS termination, routing
   |
[ App servers ] --- [ IDS sensor on mirrored traffic ]
   |        \
[ Database ] [ Forward proxy ] --> allowed external APIs only
   ^
Remote staff -> [ VPN or ZTNA gateway, MFA ] -> admin tools only

Misconfigurations we find most often

Key takeaways

• Firewalls allow or deny by address, port, protocol and state; they cannot see attacks inside allowed traffic.
• IDS detects and alerts, IPS sits inline and blocks; both are only as good as their tuning and the people who respond.
• A WAF understands HTTP and buys time, but it does not replace fixing the application.
• VPNs encrypt and restrict access but often grant too much trust to connected devices.
• Forward proxies control outbound traffic for clients; reverse proxies front servers and must pass client IPs safely.

References

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy: https://csrc.nist.gov/pubs/sp/800/41/r1/final
• NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems: https://csrc.nist.gov/pubs/sp/800/94/final
• nftables wiki: https://wiki.nftables.org/
• CISA and NSA, Selecting and Hardening Remote Access VPN Solutions: https://www.cisa.gov/resources-tools/resources/selecting-and-hardening-remote-access-vpn-solutions