Overview
A firewall allows or blocks network traffic based on rules. Network firewalls filter packets by IP, port, and protocol (layer 3/4). Web application firewalls (WAFs) inspect HTTP requests (layer 7) to block attacks like SQL injection, cross-site scripting, and bots. In the cloud, security groups and network ACLs are firewalls attached to instances and subnets.
The core principle is least privilege: deny everything by default, then allow only the traffic each tier needs. A classic three-tier design allows internet traffic only to the load balancer on port 443, app traffic only from the load balancer, and database traffic only from the app tier.
The front entrance checks everyone (edge firewall / WAF), each floor has keycard doors (security groups), and the server room only opens for specific staff (database rules). A visitor who passes the front desk still cannot walk into the vault.
When to use it
- Every production network: default deny, explicit allow.
- Isolating tiers (web, app, data) from each other.
- Blocking known attack patterns at the edge (WAF).
- Restricting admin access (SSH, databases) to VPN or bastion hosts.
Where it shows up in interviews
Recognize it when: secure an architecture with multiple layers.
- Design a secure payment system
- Secure a three-tier web app
Recognize it when: block attacks and bots before they hit the app.
- Design a ticketing system under bot attack
- Handle a DDoS
Where it is used in real software
Stateful instance-level firewalls where rules can reference other security groups, such as 'allow 5432 from the app-tier group'.
AWS WAF, Cloudflare WAF, and ModSecurity apply managed rule sets such as the OWASP Core Rule Set.
Restrict which pods can talk to which, implementing zero-trust networking inside a cluster.
Key terms
- Stateful firewall
- Tracks connections; return traffic for allowed connections is permitted automatically.
- Stateless ACL
- Evaluates every packet independently; return traffic needs explicit rules.
- WAF
- Inspects HTTP content to block application-layer attacks.
- Ingress / egress
- Inbound / outbound traffic.
- Least privilege
- Grant only the minimum access required.
How it works, step by step
- 1Default deny
Block all inbound traffic unless a rule allows it.
- 2Allow the edge
443 (and 80 for redirect) from the internet to the load balancer only.
- 3Allow tier to tier
App port from the load balancer's group; database port from the app group.
- 4Restrict admin access
SSH or database consoles only from VPN or a bastion.
- 5Control egress
Allow outbound only to required destinations to limit data exfiltration.
Security group rules for a three-tier app
Rules reference other groups rather than IP ranges where possible
| Group | Inbound allow | From |
|---|---|---|
| alb-sg | 443, 80 | 0.0.0.0/0 |
| app-sg | 8080 | alb-sg |
| db-sg | 5432 | app-sg |
| cache-sg | 6379 | app-sg |
| bastion-sg | 22 | Corporate VPN range |
NOWGroup: alb-sg | Inbound allow: 443, 80 | From: 0.0.0.0/0
Even if an attacker compromises the load balancer's network, they cannot reach the database directly: only app servers are allowed on 5432.
Implementation
resource "aws_security_group" "db" { name = "db-sg" vpc_id = aws_vpc.main.id ingress { description = "PostgreSQL from app tier only" from_port = 5432 to_port = 5432 protocol = "tcp" security_groups = [aws_security_group.app.id] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["10.20.0.0/16"] # only within the VPC }}Complexity and performance
Network firewalls in hardware or kernel.
Pattern matching on HTTP content.
Trade-offs
Strict rules can block legitimate new integrations; manage rules as code with reviews so changes are fast and safe.
Aggressive rules may block real users (for example, forms containing SQL-like text); run in count mode before blocking.
Variants and related techniques
Do not trust the network at all: authenticate and authorize every request, often with mTLS.
Services like AWS Shield and Cloudflare absorb volumetric attacks at the edge.
Common mistakes
- Allowing 0.0.0.0/0 on SSH or database ports.
Fix: Restrict to VPN, bastion, or specific security groups.
- Relying only on the perimeter.
Fix: Add internal segmentation so one compromised host cannot reach everything.
Interview questions
What is the difference between security groups and network ACLs?
Security groups are stateful and attached to instances; network ACLs are stateless and attached to subnets, so they need explicit rules for return traffic.
Where would you put a WAF?
At the edge, in front of the load balancer or in the CDN, so malicious requests are dropped before consuming application resources.
Practice problems
| Problem | Difficulty | What it trains |
|---|---|---|
| Write rules for web, app, DB, and cache tiers | Easy | Least privilege. |
| Design protection for a public login endpoint | Medium | WAF, rate limits, bot detection. |