Firewall Types for Software Developers Explained
As a developer, you’ll encounter firewalls in several contexts. On your Linux machine, a host firewall protects open services. In a corporate network, a gateway firewall controls traffic between network segments. A Web Application Firewall, on the other hand, protects web applications specifically. These systems all go by the name “firewall,” but they serve different purposes. Comparing UFW, OPNsense, and Cloudflare WAF directly wouldn’t make much sense.
This article gives you a quick breakdown of the differences. If you want deeper coverage, IRC-Security.de has detailed explanations of all firewall types.
As a software developer, you should know the basics and key concepts of firewall categories. Whether you’re preparing for an exam, or studying for AP1 or AP2 exams for IT-Berufe certifications (Application Development FIAE / System Integration FiSi or Data and Process Analysis FIDP), this knowledge matters.
For application development specialists, AP1 and AP2 exams focus mainly on firewall fundamentals. Specific products like OPNsense, pfSense, or FortiGate are typically not exam material.
What Is a Firewall?
Simply put: a firewall controls network traffic based on defined rules. It decides whether to allow or block data traffic based on criteria such as IP address, port, protocol, connection status, or application.
Essential terminology:
- IP address: A numeric identifier for a device or network interface.
- Port: A logical endpoint for a network service, for example port 443 for HTTPS.
- Protocol: A ruleset governing data transmission, such as TCP, UDP, HTTP, or DNS.
- TCP: A connection-oriented transport protocol with acknowledgment and error control.
- UDP: A connectionless transport protocol without guaranteed delivery.
- Rule: A condition that specifies whether network traffic is allowed, denied, or logged.
- Policy: A general directive governing how network traffic is handled.
- Default Deny: Everything is forbidden unless explicitly permitted.
- Default Allow: Everything is allowed unless explicitly blocked.
- Logging: Recording of firewall events for monitoring and troubleshooting.
How Firewall Systems Work (AP1/AP2 Exam Scope)
For your IHK AP1 and AP2 exam, you need to understand how firewalls function at a basic level. The concepts below are exam-relevant: packet filtering, whitelisting, blacklisting, and related terminology.
Packet Filtering
A firewall examines each network packet against defined criteria, typically including:
- Source and destination IP address
- Source and destination port
- Protocol (TCP, UDP, ICMP)
- Connection status (for stateful firewalls)
- Direction of traffic (inbound or outbound)
Firewall Placement
Firewalls are deployed at different points in the network:
- Host firewall: Runs directly on an endpoint device or server.
- Network firewall: Sits between two or more network segments.
- Gateway firewall: Controls the boundary between an internal network and the internet.
Security Zones
Firewalls divide networks into zones with different trust levels:
- Trust: A trusted internal network.
- Untrust: An untrusted network, typically the internet.
- DMZ: A network for publicly accessible servers.
Rule Processing
Firewall rules are evaluated in a fixed order. The first matching rule determines what happens to a packet. This is why rule order matters.
Default Policy
The default policy specifies what happens when no rule matches:
- Default Deny: Traffic not explicitly permitted is blocked. This is the more secure option.
- Default Allow: Traffic not explicitly blocked is allowed.
NAT (Network Address Translation)
NAT translates private IP addresses into public ones. This allows multiple devices on an internal network to communicate via a single public address. NAT isn’t a security feature in the strict sense, but it’s often used alongside firewalls.
Typical AP1/AP2 Questions and Answers
Question: What is the difference between a stateful and a stateless firewall?
A stateless firewall examines each packet in isolation without tracking connection state. A stateful firewall maintains a record of active connections and can automatically recognize response packets belonging to an established connection.
Question: What is a DMZ?
A DMZ (Demilitarized Zone) is a separate network for servers that need to be reachable from the internet. It sits between the trusted internal network and the internet, so an attack on a public-facing server cannot directly penetrate the internal network.
Question: What is the purpose of a default policy?
The default policy determines what happens when no firewall rule applies to a packet. With Default Deny, traffic not explicitly allowed is blocked — this is the more secure approach. With Default Allow, traffic not explicitly blocked is allowed.
Question: What does the Defense in Depth principle describe?
Defense in Depth means combining multiple independent security measures. A single firewall doesn’t cover all security aspects. Only by combining a host firewall, network firewall, DNS filtering, WAF, and monitoring do you achieve comprehensive protection.
Question: What is the difference between a host firewall and a network firewall?
A host firewall runs directly on an endpoint or server and protects its network access points. A network firewall sits between two or more network segments and controls traffic between them.
Stateful and Stateless Firewalls
-
A stateless firewall inspects each packet individually. It doesn’t automatically account for whether the packet belongs to an existing connection.
-
A stateful firewall maintains a record of active connections. Response packets from an established connection can be automatically recognized.
The stored connection state is called connection tracking. Modern operating system and router firewalls typically operate statelessly.
Host Firewalls on Linux
A host firewall runs directly on a machine and protects its network access points. It controls whether a web server, database, or SSH service is reachable from the network.
On Linux, the Netfilter kernel subsystem handles packet processing and filtering.
nftables
You’ve likely encountered nftables, possibly alongside iptables.
nftables is the modern Linux system for configuring packet filtering, NAT, and other network rules. It organizes rules into tables and chains.
- Table: A container for related firewall rules.
- Chain: An ordered list of rules for a specific processing point.
- Hook: A location in the network stack where a chain is executed.
- NAT: Network Address Translation, the conversion of network addresses.
- Masquerading: A form of source NAT where internal devices communicate through the router’s public address.
nftables is suitable for servers, container hosts, routers, and custom firewall configurations.
When to Use nftables
- System administrators and DevOps engineers who need precise control over packet filtering
- Developers running their own Linux servers or container hosts
- Network engineers configuring NAT, masquerading, or complex routing scenarios
- Less suitable for beginners without Linux experience
iptables
iptables is the older management tool for Linux firewall rules. Many existing scripts and tutorials still use it. For new projects, nftables is generally preferred, but you should know how to work with iptables.
iptables and nftables are not complete firewall programs with their own management interface. They configure the Linux kernel’s packet filtering.
They’re invaluable when you need to stop unwanted packets from reaching your system.
UFW
UFW, short for Uncomplicated Firewall, simplifies Linux firewall configuration.
A rule like:
sudo ufw allow 22/tcpallows incoming TCP connections on port 22, typically used for SSH.
SSH, or Secure Shell, provides encrypted remote access to a machine.
UFW works well for individual Linux machines and smaller servers. For complex routing rules, multiple zones, or extensive network segmentation, it becomes less convenient.
When to use UFW?
- Beginners and developers who need a basic firewall on a Linux machine quickly
- Homelab users running single servers like Raspberry Pi or VPS instances
- Students getting hands-on with Linux firewalls
- Less suitable for enterprise networks with multiple zones
firewalld
firewalld is a firewall manager commonly used on Fedora, Red Hat Enterprise Linux, and related distributions. It uses zones to assign network interfaces or sources to different trust levels.
Common zones include:
- public: Untrusted public network.
- home: Relatively trusted home network.
- internal: Internal corporate or server network.
- trusted: Network traffic is largely accepted.
- drop: Any traffic not explicitly allowed is dropped.
firewalld uses nftables as its backend on current installations. Older distributions may still use iptables as the backend.
A backend is the technical component that enforces the actual rules.
When to use firewalld?
- Enterprise administrators on Fedora, RHEL, CentOS, or Rocky Linux
- Server administrators in corporate environments needing zone-based management
- Developers on Red Hat-based distributions
- Less suitable for Ubuntu/Debian systems (UFW is more common there)
Network and Gateway Firewalls
A network firewall protects more than a single machine. It controls traffic between entire networks.
A gateway is a system that routes data between different networks. In home networks, the router typically serves this role.
Typical use cases include:
- Separating LAN, WLAN, servers, and IoT devices
- Controlling internet access
- Port forwarding
- Setting up VPN connections
- Managing multiple internet connections
- Logging network traffic
LAN refers to a local area network. IoT stands for Internet of Things and includes connected devices like cameras, sensors, or smart plugs. I mention these because they often appear in exams, so you should know them.
Complete Firewall and Router Distributions
A firewall distribution is a complete operating system purpose-built as a router and firewall. It’s installed on a dedicated machine, appliance, or virtual machine.
An appliance is a device whose hardware and software are assembled for a specific task.
OPNsense
OPNsense is a FreeBSD-based firewall and router distribution with a web interface. It’s seeing growing attention in technical forums and social media.
It supports:
- Stateful firewall
- NAT
- VLANs
- DHCP
- DNS
- VPN
- Multi-WAN
- Traffic shaping
- IDS and IPS
- Plugins
FreeBSD is a Unix-like operating system, not Linux. VLAN, or Virtual Local Area Network, separates multiple logical networks on the same physical infrastructure. DHCP automatically distributes IP addresses and network settings. DNS translates domain names like irc-coding.de into IP addresses. VPN, or Virtual Private Network, creates an encrypted connection to a remote network. Multi-WAN enables multiple internet connections. Traffic shaping prioritizes or limits network traffic.
OPNsense uses PF, the packet filter from the BSD world. Its integrated DNS resolver, Unbound, can recursively resolve domains and block them using block lists.
When to use OPNsense?
- Homelab users and developers running custom networks with VLANs and VPN
- Small to medium businesses seeking a powerful open-source firewall without licensing costs
- Security enthusiasts wanting IDS/IPS and DNS filtering in one interface
- Less suitable for beginners without networking fundamentals
pfSense
pfSense is another FreeBSD-based firewall and router distribution. It’s heavily recommended in technical forums and is equally powerful.
It’s offered as pfSense Community Edition and as a commercially supported pfSense Plus variant.
Its feature set includes:
- Firewall and NAT
- VLANs
- VPN
- Multi-WAN
- Captive portal
- Traffic shaping
- High availability
- Extension packages
A captive portal is a login page like those used in guest WiFi networks. High availability means a second system can take over if the primary firewall fails. The pfBlockerNG package extends pfSense with IP and DNS-based block lists.
When to use pfSense?
- Enterprises needing commercial support and a Plus variant with certifications
- Homelab users looking for a proven solution with a large community
- Educational institutions and MSPs requiring high availability and captive portal functionality
- Less suitable for those wanting a purely open-source solution without commercial aspects
IPFire
IPFire is a standalone Linux-based firewall distribution aimed at small and medium networks.
IPFire uses color-coded network zones:
- RED: Untrusted network, typically the internet.
- GREEN: Internal trusted network.
- BLUE: Separate WiFi network.
- ORANGE: Demilitarized zone for publicly accessible services.
A DMZ, or Demilitarized Zone (exam-relevant!), is a separate network for servers that must be reachable from the internet.
When to use IPFire?
- Small networks and homelabs wanting simple zone separation (RED/GREEN/BLUE/ORANGE)
- Educational institutions teaching clear firewall concepts
- Beginners who want to understand zone concepts hands-on
- Less suitable for large enterprise networks or complex routing scenarios
OpenWrt
OpenWrt is a Linux distribution for routers and embedded devices. It replaces the manufacturer firmware on supported hardware.
OpenWrt works well for:
- Routers
- Access Points
- VLANs
- VPN
- Firewall rules
- Additional network packages
How would you describe firmware in an oral exam without reading the next sentence (difficulty: very easy)?
Firmware is the low-level software that runs directly on hardware. An Access Point provides WLAN connections and bridges them to wired networks.
Recommendation: When to use OpenWrt?
- Hobbyists and homelab users with compatible router hardware
- Developers looking to replace manufacturer firmware with an open-source alternative
- Community projects like Freifunk that operate open networks
- Less suitable for enterprise environments without hardware control
VyOS
VyOS is a Linux-based network operating system focused on routing, VPN, and automation. You configure it primarily through a structured command-line interface.
VyOS supports:
- Static and dynamic routing
- Firewall rules
- NAT
- VPN
- DHCP and DNS
- BGP and OSPF
- Configuration automation
Dynamic routing lets routers exchange network paths automatically. BGP is used for route exchange between large networks and internet service providers. OSPF distributes routing information within an administratively independent network.
VyOS appeals to network labs, virtual routers, and automated infrastructure. For beginners, it’s less user-friendly than OPNsense or pfSense.
Recommendation: When to use VyOS?
- Network engineers and ISPs configuring dynamic routing with BGP and OSPF
- Developers automating virtual routers in labs or CI/CD pipelines
- Cloud infrastructure teams running routing-as-code
- Less suitable for beginners or simple home networks
Integrated Router and Network Platforms
Network platforms combine gateways, firewalls, switches, WLAN, and centralized management. They tie more closely to specific vendors and their hardware.
Ubiquiti UniFi
UniFi is a network platform from Ubiquiti. It includes gateways, switches, Access Points, cameras, and centralized management software.
UniFi offers:
- Zone-based firewall rules
- VLAN management
- VPN
- DNS and content filtering
- Switch and WLAN management
- Network statistics
The advantage lies in a unified interface. Configuration flexibility is lower than with a self-built Linux or OPNsense solution.
Recommendation: When to use UniFi?
- SMBs and larger homelabs wanting a unified network across gateways, switches, and WLAN
- Organizations valuing centralized management without deep networking knowledge
- Developers with smart home or IoT setups who want to manage VLANs visually
- Less suitable for users needing maximum configuration freedom
MikroTik RouterOS
RouterOS is the Linux-based network operating system from MikroTik. It runs primarily on MikroTik devices but is also available for PCs and virtual machines.
RouterOS supports:
- Routing
- Stateful Firewall
- NAT
- VLANs
- VPN
- WLAN
- Hotspots
- Bandwidth management
- Dynamic routing protocols
The configuration is comprehensive but requires more networking knowledge than typical home routers.
Recommendation: When to use MikroTik RouterOS?
- ISPs and networking professionals needing powerful hardware at low cost
- Budget-conscious enterprises and homelab users wanting features like BGP and OSPF
- Developers in regions where MikroTik hardware is widespread
- Less suitable for users preferring a simple web interface without CLI experience
TP-Link Omada
Omada is a centrally managed network platform from TP-Link. It includes gateways, switches, Access Points, and controllers.
A controller is a central management instance for multiple network devices.
Omada targets small businesses, offices, and larger home networks. The focus is on centralized management and a coordinated hardware ecosystem.
Recommendation: When to use TP-Link Omada?
- Small businesses and offices seeking easy-to-manage networks
- Larger home networks wanting more than a standard router
- Installers needing a cost-effective ecosystem
- Less suitable for advanced users with specialized routing requirements
Next-Generation Firewalls
This term often appears in exams and discussions—you should understand what it means at a basic level.
A Next-Generation Firewall, or NGFW, combines traditional packet filtering with additional security features.
These include:
- Application detection
- IDS and IPS
- Web filtering
- Malware detection
- User identification
- TLS inspection
- Centralized policy management
IDS, or Intrusion Detection System, identifies suspicious network traffic and alerts you. IPS, or Intrusion Prevention System, can also block detected malicious traffic. TLS inspection decrypts encrypted traffic under controlled conditions, inspects it, and re-encrypts it. This requires endpoint devices to trust the firewall’s certificate authority. Deployment must be planned carefully from technical, legal, and privacy perspectives.
Major NGFW vendors include Fortinet, Palo Alto Networks, Sophos, Check Point, and Cisco.
Web Application Firewalls
A Web Application Firewall, or WAF, protects web applications and APIs specifically. It analyzes HTTP and HTTPS requests.
A WAF can detect or block attacks such as:
SQL injection: Inserting malicious SQL commands into database queries. Cross-Site Scripting: Injecting JavaScript into web pages. Path Traversal: Accessing files outside the intended directory. Bot traffic: Automated requests from programs. HTTP flood: Overwhelming an application with many HTTP requests.
HTTP is the web’s transfer protocol. HTTPS adds TLS encryption to HTTP. API stands for Application Programming Interface and refers to an interface through which programs exchange data and functions.
All these terms should be familiar. If not, learn them now. These are standard IT concepts and typical exam material (AP1/AP2 and computer science exams).
Well-known WAF solutions include ModSecurity, Coraza, Cloudflare WAF, AWS WAF, and Azure Web Application Firewall.
A WAF does not replace a network or host firewall.
Cloud Firewalls
Cloud platforms provide their own mechanisms for filtering virtual networks.
Examples include:
- AWS Security Groups
- AWS Network ACLs
- Azure Network Security Groups
- Azure Firewall
- Google Cloud Firewall Policies
A Security Group controls allowed network traffic for a cloud resource. A Network ACL is a rule-based access list for a virtual network or subnet. ACL stands for Access Control List and describes a list of permitted or denied access. Cloud rules protect only the assigned cloud resources. A misconfigured application or publicly accessible storage won’t automatically become secure.
Container and Kubernetes Firewalls
Containers typically share their host’s kernel but run in isolated environments. Docker is a platform for building and running containers. Kubernetes manages containerized applications across multiple systems. A Kubernetes NetworkPolicy defines which pods can communicate with each other. A pod is the smallest executable unit in Kubernetes and can contain one or more containers.
Tools like Cilium and Calico enforce these network rules.
Cilium uses eBPF among other technologies. eBPF enables controlled execution of small programs within the Linux kernel and is used for network processing, security, and monitoring.
Container rules complement the host firewall. They don’t replace it.
DNS Filtering
See the article Pi-hole vs. AdGuard Home vs. NextDNS for a comprehensive overview.
DNS filters aren’t full firewalls
DNS filters like Pi-hole, AdGuard Home, NextDNS, Unbound blocklists, or pfBlockerNG prevent resolution of blocked domains.
They can block ads, tracking servers, and known malware domains. However, they typically don’t inspect the full network traffic.
A client can potentially bypass DNS filters in several ways:
- using an external DNS server
- DNS over HTTPS
- directly accessing an IP address
- tunneling through a VPN
DNS over HTTPS, or DoH, transmits DNS queries encrypted over HTTPS.
DNS filters are therefore an additional protective layer, not a complete firewall replacement.
Which Firewall Do You Need as a Developer?
| Use Case | Suitable Technology |
|---|---|
| Linux desktop | UFW or firewalld |
| Linux server | nftables, UFW, or firewalld |
| Docker host | Host firewall plus controlled container rules |
| Homelab gateway | OPNsense, pfSense, IPFire, or OpenWrt |
| Virtual network lab | VyOS, OPNsense, or RouterOS |
| Unified network with WLAN and switches | UniFi, Omada, or MikroTik |
| Web application | Host firewall plus WAF |
| Kubernetes | NetworkPolicies with Cilium or Calico |
| Cloud application | Cloud firewall rules plus host and application protection |
| Domain and ad blocking | Pi-hole, AdGuard Home, or integrated DNS filter |
Combining Multiple Security Layers
No single firewall covers all security concerns. A well-secured development network might be structured like this:
- OPNsense controls transitions between the internet, LAN, server network, and IoT network.
- VLANs separate devices with different security requirements.
- firewalld or UFW protects each Linux server additionally.
- A DNS filter blocks unwanted domains.
- A WAF protects publicly accessible web applications.
- IDS or IPS detects suspicious network traffic.
- Logging and monitoring make attacks and misconfigurations visible.
This principle is called Defense in Depth. It combines multiple independent protective measures.
UFW, firewalld, iptables, and nftables protect or control individual Linux systems. OPNsense, pfSense, IPFire, OpenWrt, and VyOS act as central firewalls and routers. UniFi, MikroTik, and Omada combine firewall, routing, WLAN, and network management. A WAF protects web applications, while cloud and container firewalls secure virtual infrastructure.
DNS filters, IDS, and IPS supplement these systems but serve different purposes.
For developers, what matters isn’t just which product you use. What matters is where in the network control is enforced and which attack surface is actually covered.
FAQ Firewall Types for Software Developers - Questions and Answers
Try reading just the question first, then formulate your own answer before looking at the response.