Firewall Types Explained for Software Developers

As a developer, you’ll encounter firewalls in several contexts. A host firewall on your Linux machine protects open services. In a corporate network, a gateway firewall controls traffic between network segments. A web application firewall specifically defends web applications. All are called firewalls, but they serve different purposes. Comparing UFW, OPNsense, and Cloudflare WAF directly would miss that distinction.

This article breaks down the key differences quickly and clearly. For deeper details on each firewall type, IRC-Security.de offers comprehensive explanations.

As a software developer, you should know the fundamentals and basic categories. Whether you’re studying for a university exam or preparing for your AP1 or AP2 exams as a certified IT specialist in application development (FIAE), systems integration (FiSi), or data and process analysis (FIDP), understanding firewall basics matters.

For IT specialists in application development, AP1 and AP2 exams focus mainly on firewall fundamentals. Specific products like OPNsense, pfSense, or FortiGate are rarely tested directly.

What Is a Firewall?

In essence: a firewall controls network traffic according to defined rules. It decides whether to allow or block data based on criteria like IP address, port, protocol, connection state, or application.

Key terms to know:

• IP address: A numerical identifier for a device or network interface.
• Port: A logical endpoint for a network service, such as port 443 for HTTPS.
• Protocol: A ruleset for data transmission, such as TCP, UDP, HTTP, or DNS.
• TCP: A connection-oriented transport protocol with acknowledgment and error checking.
• UDP: A connectionless transport protocol without guaranteed delivery.
• Rule: A condition that specifies which network traffic is allowed, denied, or logged.
• Policy: A general principle governing how network traffic is handled.
• Default Deny: Everything is forbidden unless explicitly allowed.
• Default Allow: Everything is allowed unless explicitly blocked.
• Logging: Recording firewall events for audit and troubleshooting.

How Firewall Systems Work (AP1/AP2 Exam Focus)

For your IHK exam in AP1 and AP2, you need to understand how firewalls operate. The concepts below are exam-relevant: packet filtering, whitelists, blacklists, and related ideas.

Packet Filtering

A firewall inspects each network packet against defined criteria:

• Source and destination IP address
• Source and destination port
• Protocol (TCP, UDP, ICMP)
• Connection state (in stateful firewalls)
• Traffic direction (inbound or outbound)

Firewall Placement

Firewalls are deployed at different points in a network:

• Host firewall: Runs directly on an endpoint or server.
• Network firewall: Sits between two or more network segments.
• Gateway firewall: Controls the boundary between an internal network and the Internet.

Security Zones

Firewalls divide networks into zones with different trust levels:

• Trust: The internal network you trust.
• Untrust: An untrusted network, typically the Internet.
• DMZ: A network hosting publicly accessible servers.

Rule Processing

Firewall rules are evaluated in a fixed order. The first matching rule determines what happens to a packet, so rule order is critical.

Default Policy

The default policy specifies what happens when no rule matches:

• Default Deny: Traffic not explicitly allowed is blocked. This is the more secure approach.
• Default Allow: Traffic not explicitly blocked is allowed.

NAT (Network Address Translation)

NAT translates private IP addresses to public ones. This lets multiple internal devices communicate through a single public address. While not a security feature per se, it’s often deployed alongside firewalls.

Common AP1/AP2 Exam Questions and Answers

Question: What’s the difference between a stateful and a stateless firewall?

A stateless firewall checks each packet independently without tracking connection state. A stateful firewall remembers active connections and can automatically allow response packets from established sessions.

Question: What is a DMZ?

A DMZ (demilitarized zone) is a separate network for servers that must be reachable from the Internet. It sits between your trusted internal network and the Internet, preventing a breach of a public server from compromising your internal systems.

Question: What role does the default policy play?

The default policy determines what happens when no rule matches a packet. With Default Deny, unapproved traffic is blocked—the safer choice. With Default Allow, unapproved traffic is permitted.

Question: What is the Defense in Depth principle?

Defense in Depth means combining multiple independent security controls. A single firewall doesn’t cover everything. True protection comes from layering a host firewall, network firewall, DNS filtering, WAF, and monitoring.

Question: How does a host firewall differ from a network firewall?

A host firewall runs directly on a single device and protects its network access. A network firewall sits between network segments and controls traffic flowing between them.

Stateful and Stateless Firewalls

• A stateless firewall examines each packet in isolation and doesn’t track whether the packet belongs to an existing connection.

• A stateful firewall maintains the state of active connections. Response packets from allowed sessions are automatically permitted.

The stored connection state is called connection tracking. Modern operating system and router firewalls typically work in a stateful manner.

Host Firewalls on Linux

A host firewall runs directly on a machine and protects its network access. It controls whether services like a web server, database, or SSH daemon are reachable from the network.

On Linux, the kernel subsystem Netfilter handles packet processing and filtering.

nftables

You’ve probably come across nftables, possibly alongside iptables.

nftables is the modern Linux framework for configuring packet filtering, NAT, and other network rules. It organizes rules into tables and chains.

• Table: A container for related firewall rules.
• Chain: An ordered list of rules for a specific processing point.
• Hook: The point in the network stack where a chain executes.
• NAT: Network Address Translation, the remapping of network addresses.
• Masquerading: A form of source NAT where internal devices communicate through the router’s public address.

nftables is ideal for servers, container hosts, routers, and custom firewall setups.

When to Use nftables

• System administrators and DevOps engineers who need precise control over packet filtering
• Developers running their own Linux servers or container hosts
• Network engineers configuring NAT, masquerading, or complex routing scenarios
• Less suitable for beginners without Linux experience

iptables

iptables is the legacy management tool for Linux firewall rules. Many existing scripts and guides still use it. For new projects, nftables is generally preferred, but you should understand how to work with iptables.

iptables and nftables are not complete firewall programs with their own management interface. They configure packet filtering in the Linux kernel.

But they’ll save your life when you need to keep unwanted packets out of your system.

UFW

UFW, short for Uncomplicated Firewall, simplifies Linux firewall configuration.

A rule like:

sudo ufw allow 22/tcp

allows incoming TCP connections on port 22, which is typically used for SSH.

SSH, or Secure Shell, provides encrypted remote access to a machine.

UFW works well for individual Linux machines and smaller servers. For complex router rules, multiple zones, or extensive network segmentation, it’s less convenient.

When to use UFW: recommendation

• Beginners and developers who need a basic firewall on a Linux machine quickly
• Homelab users with single servers like Raspberry Pi or VPS
• Students learning about Linux firewalls
• Less suitable for enterprise networks with multiple zones

firewalld

firewalld is a firewall manager used primarily on Fedora, Red Hat Enterprise Linux, and related distributions. It uses zones to assign network interfaces or sources different trust levels.

Typical zones include:

• public: Untrusted public network.
• home: Relatively trusted home network.
• internal: Internal corporate or server network.
• trusted: Network traffic is largely accepted.
• drop: Traffic not explicitly allowed is dropped.

firewalld uses nftables as its backend on current installations. Some distributions may still use iptables.

A backend is the technical component that actually implements the rules.

When to use firewalld: recommendation

• Enterprise administrators on Fedora, RHEL, CentOS, or Rocky Linux
• Server administrators in corporate environments needing zone-based management
• Developers on Red Hat-based distributions
• Less suitable for Ubuntu/Debian systems (where UFW is more common)

Network and Gateway Firewalls

A network firewall doesn’t protect just a single machine. It controls traffic between entire networks.

A gateway is a system that routes data traffic between different networks. In a home network, the router typically handles this.

Common uses include:

• Separating LAN, WLAN, servers, and IoT devices
• Controlling internet access
• Port forwarding
• Setting up VPN connections
• Managing multiple internet connections
• Logging network traffic

LAN refers to the local area network. IoT stands for Internet of Things and includes networked devices like cameras, sensors, or smart plugs. I mention these because they often appear in exams. You should know them.

Complete Firewall and Router Distributions

A firewall distribution is a complete operating system designed specifically as a router and firewall. It runs on a dedicated machine, appliance, or virtual machine.

An appliance is a device whose hardware and software are assembled for a specific purpose.

OPNsense

OPNsense is a FreeBSD-based firewall and router distribution with a web interface. You’re seeing a lot of discussion about OPNsense in forums and social media right now.

It supports, among other features:

• Stateful firewall
• NAT
• VLANs
• DHCP
• DNS
• VPN
• Multi-WAN
• Traffic shaping
• IDS and IPS
• Plugins

FreeBSD is a Unix-like operating system, not Linux. VLAN, short for Virtual Local Area Network, separates multiple logical networks on the same physical infrastructure. DHCP automatically distributes IP addresses and other network settings. DNS translates domain names like irc-coding.de into IP addresses. VPN, or Virtual Private Network, creates an encrypted connection to a remote network. Multi-WAN allows using multiple internet connections. Traffic shaping prioritizes or limits network traffic.

OPNsense uses PF, the packet filter from the BSD world. The integrated DNS resolver Unbound can recursively resolve domains and block them via blocklists.

When to use OPNsense: recommendation

• Homelab users and developers running their own networks with VLANs and VPN
• Small to medium businesses looking for a powerful open-source firewall without licensing costs
• Security enthusiasts wanting IDS/IPS and DNS filtering in one interface
• Less suitable for beginners without networking fundamentals

pfSense

pfSense is also a FreeBSD-based firewall and router distribution. It’s heavily recommended and discussed in forums and is likewise considered powerful.

It’s offered as pfSense Community Edition and a commercially supported pfSense Plus variant.

Its feature set includes:

• Firewall and NAT
• VLANs
• VPN
• Multi-WAN
• Captive portal
• Traffic shaping
• High availability
• Extension packages

A captive portal is a login page shown first, like those in guest WiFi networks. High availability means a second system can take over if the primary firewall fails. The pfBlockerNG extension package adds IP and DNS-based blocklists to pfSense.

When to use pfSense: recommendation

• Enterprises needing commercial support and a Plus variant with certifications
• Homelab users seeking a proven solution with a large community
• Educational institutions and MSPs using high availability and captive portals
• Less suitable for those wanting a purely open-source solution without commercial aspects

IPFire

IPFire is a standalone Linux-based firewall distribution. It targets small and medium networks.

IPFire uses color-coded network zones:

• RED: Untrusted network, usually the internet.
• GREEN: Internal trusted network.
• BLUE: Separate WiFi.
• ORANGE: Demilitarized zone for publicly accessible services.

A DMZ, short for Demilitarized Zone (exam-relevant!), is a separate network for servers that must be reachable from the internet.

When to use IPFire: recommendation

• Small networks and homelabs wanting straightforward zone separation (RED/GREEN/BLUE/ORANGE)
• Educational institutions teaching a clear firewall concept
• Beginners wanting to understand the zone concept practically
• Less suitable for large enterprise networks or complex routing scenarios

OpenWrt

OpenWrt is a Linux distribution for routers and embedded devices. It replaces the manufacturer firmware on supported hardware.

OpenWrt works well for:

• Routers
• Access Points
• VLANs
• VPN
• Firewall rules
• Additional network packages

How would you describe firmware in an oral exam without reading the next sentence (difficulty: very easy)?

Firmware is the hardware-level software of a device. An Access Point provides wireless connections and bridges them to the wired network.

When to use OpenWrt

• Hobbyists and homelab enthusiasts with compatible router hardware
• Developers who want to replace manufacturer firmware with an open-source alternative
• Community projects like Freifunk that operate open networks
• Less suitable for enterprise environments without hardware control

VyOS

VyOS is a Linux-based network operating system focused on routing, VPN, and automation. It’s configured primarily through a structured command line.

VyOS supports:

• Static and dynamic routing
• Firewall rules
• NAT
• VPN
• DHCP and DNS
• BGP and OSPF
• Configuration automation

Dynamic routing allows routers to automatically exchange network paths with each other. BGP is used for route exchange between large networks and internet service providers. OSPF distributes routing information within an organizationally cohesive network.

VyOS appeals to network labs, virtual routers, and automated infrastructure. It’s less beginner-friendly than OPNsense or pfSense.

When to use VyOS

• Network engineers and ISPs configuring dynamic routing with BGP and OSPF
• Developers automating virtual routers in labs or CI/CD pipelines
• Cloud infrastructure teams running routing-as-code
• Less suitable for beginners or simple home networks

Integrated Router and Network Platforms

Network platforms combine gateways, firewalls, switches, wireless, and centralized management. They’re more tightly bound to a specific vendor and their hardware.

Ubiquiti UniFi

UniFi is a network platform from Ubiquiti. It includes gateways, switches, access points, cameras, and centralized management software.

UniFi offers:

• Zone-based firewall rules
• VLAN management
• VPN
• DNS and content filtering
• Switch and wireless management
• Network statistics

The advantage is a unified interface. You have less configuration freedom compared to a self-built Linux or OPNsense solution.

When to use UniFi

• SMBs and larger homelabs that want a unified network with gateway, switches, and wireless
• Organizations that value centralized management without deep networking knowledge
• Developers with smart home or IoT setups who want visual VLAN management
• Less suitable for users who need maximum configuration flexibility

MikroTik RouterOS

RouterOS is MikroTik’s Linux-based network operating system. It runs primarily on MikroTik hardware but is also available for PCs and virtual machines.

RouterOS supports:

• Routing
• Stateful firewall
• NAT
• VLANs
• VPN
• Wireless
• Hotspots
• Bandwidth management
• Dynamic routing protocols

Configuration is extensive but requires more networking knowledge than typical home routers.

When to use MikroTik RouterOS

• ISPs and networking professionals needing powerful hardware at low cost
• Budget-conscious enterprises and homelab users wanting features like BGP and OSPF
• Developers in regions where MikroTik hardware is widely available
• Less suitable for users who want a simple web interface without CLI experience

TP-Link Omada

Omada is a centrally managed network platform from TP-Link. It includes gateways, switches, access points, and a controller.

A controller is a centralized management instance for multiple network devices.

Omada targets small businesses, offices, and larger home networks. The focus is on centralized management and a coordinated hardware ecosystem.

When to use TP-Link Omada

• Small businesses and offices looking for an easily managed network
• Larger home networks that need more than a standard router offers
• Installers who need a cost-effective ecosystem
• Less suitable for advanced users with specialized routing requirements

Next-Generation Firewalls

This term is worth knowing for exams and appears frequently. You should understand what it means.

A Next-Generation Firewall, or NGFW, combines classical packet filtering with additional security features.

These include:

• Application detection
• IDS and IPS
• Web filtering
• Malware detection
• User identification
• TLS inspection
• Centralized policy management

IDS (Intrusion Detection System) detects suspicious network traffic and reports it. IPS (Intrusion Prevention System) can additionally block detected malicious traffic. TLS inspection decrypts encrypted traffic in a controlled manner, inspects it, and re-encrypts it. End devices must trust the firewall’s certificate authority. Deployment requires careful planning from technical, legal, and privacy perspectives.

Well-known NGFW vendors include Fortinet, Palo Alto Networks, Sophos, Check Point, and Cisco.

Web Application Firewalls

A Web Application Firewall, or WAF, specifically protects web applications and APIs. It analyzes HTTP and HTTPS requests.

A WAF can detect or block attacks such as:

SQL injection: Inserting manipulated SQL commands into database queries. Cross-Site Scripting: Injecting JavaScript into web pages. Path Traversal: Accessing files outside the intended directory. Bot traffic: Automated requests from programs. HTTP flood: Overwhelming an application with high volumes of HTTP requests.

HTTP is the web’s transfer protocol. HTTPS adds TLS encryption to HTTP. API stands for Application Programming Interface and refers to an interface through which programs exchange data and functions.

You should already know all these terms. If not, learn them. These are standard IT concepts and typical exam material (AP1/AP2 and computer science exams).

Well-known WAF solutions include ModSecurity, Coraza, Cloudflare WAF, AWS WAF, and Azure Web Application Firewall.

A WAF does not replace a network or host firewall.

Cloud Firewalls

Cloud platforms provide their own mechanisms for filtering virtual networks.

Examples include:

• AWS Security Groups
• AWS Network ACLs
• Azure Network Security Groups
• Azure Firewall
• Google Cloud Firewall Policies

A Security Group controls the allowed network traffic for a cloud resource. A Network ACL is a rule-based access list for a virtual network or subnet. ACL stands for Access Control List and refers to a list of permitted or denied access rules. Cloud rules protect only the assigned cloud resources. A misconfigured application or publicly accessible storage won’t automatically become secure because of them.

Container and Kubernetes Firewalls

Containers typically share the kernel of their host but run in isolated environments. Docker is a platform for building and running containers. Kubernetes manages containerized applications across multiple systems. A Kubernetes NetworkPolicy defines which pods are allowed to communicate with each other. A pod is the smallest deployable unit in Kubernetes and can contain one or more containers.

Tools like Cilium and Calico enforce these network rules.

Cilium uses eBPF among other technologies. eBPF allows controlled execution of small programs within the Linux kernel and is used for network processing, security, and monitoring.

Container rules complement the host firewall—they don’t replace it.

DNS Filtering

See the article Pi-hole vs. AdGuard Home vs. NextDNS for a comprehensive overview.

DNS filters are not complete firewalls

DNS filters like Pi-hole, AdGuard Home, NextDNS, Unbound blocklists, or pfBlockerNG prevent resolution of blocked domains.

They can block ads, tracking servers, and known malware domains. However, they typically don’t inspect the full network traffic.

A client can potentially bypass DNS filters in several ways:

• using an external DNS server
• DNS over HTTPS
• directly accessing an IP address
• tunneling through a VPN

DNS over HTTPS, or DoH, encrypts DNS queries and transmits them over HTTPS.

DNS filters are therefore an additional protective layer, not a complete replacement for a firewall.

Which Firewall Do You Need as a Developer?

Use Case	Suitable Technology
Linux desktop	UFW or firewalld
Linux server	nftables, UFW, or firewalld
Docker host	Host firewall plus controlled container rules
Homelab gateway	OPNsense, pfSense, IPFire, or OpenWrt
Virtual networking lab	VyOS, OPNsense, or RouterOS
Unified network with WLAN and switches	UniFi, Omada, or MikroTik
Web application	Host firewall plus WAF
Kubernetes	NetworkPolicies with Cilium or Calico
Cloud application	Cloud firewall rules plus host and application protection
Domain and ad blocking	Pi-hole, AdGuard Home, or integrated DNS filter

Combining Multiple Layers of Protection

No single firewall covers all security aspects. A well-secured development network might look like this:

• OPNsense controls traffic between the internet, LAN, server network, and IoT network.
• VLANs separate devices with different security requirements.
• firewalld or UFW protects each Linux server as an additional layer.
• A DNS filter blocks unwanted domains.
• A WAF protects publicly accessible web applications.
• IDS or IPS detects suspicious network traffic.
• Logging and monitoring make attacks and misconfigurations visible.

This approach is called Defense in Depth: combining multiple independent protective measures.

UFW, firewalld, iptables, and nftables protect or control individual Linux systems. OPNsense, pfSense, IPFire, OpenWrt, and VyOS serve as central firewalls and routers. UniFi, MikroTik, and Omada combine firewall, routing, WLAN, and network management. A WAF protects web applications, while cloud and container firewalls secure virtual infrastructures.

DNS filters, IDS, and IPS complement these systems but serve different purposes.

For developers, what matters isn’t just which product you use. What matters is where control happens in your network and which attack surface it actually covers.

FAQ: Firewall Types for Software Developers

Try to read only the question and formulate the answer yourself first.