1. Firewall (Traditional Firewall)

What it is:
A basic security device or software that monitors and controls network traffic based on predefined rules.

What it protects:

• Entire networks or individual computers
• Protects against unauthorized access

How it works:

• Filters traffic using IP addresses, ports, and protocols
• Operates mainly at Layer 3 & 4 (Network & Transport layers)

Example:

• Allow traffic on port 80 (HTTP)
• Block traffic from a suspicious IP address

Strengths:

• Simple and fast
• Good for basic network protection

Limitations:

• Cannot inspect application-level data
• Cannot detect advanced attacks or malware

---

2. Next-Generation Firewall (NGFW)

What it is:
An advanced firewall that combines traditional firewall functions with deeper inspection and threat prevention.

What it protects:

• Networks from modern cyber threats
• Users, applications, and data

How it works:

• Uses Deep Packet Inspection (DPI)
• Understands applications (not just ports)
• Often includes:
  • Intrusion Prevention System (IPS)
  • Malware protection
  • SSL/TLS inspection
  • User identity awareness

Layer:

• Operates up to Layer 7 (Application layer)

Example:

• Allow Facebook but block Facebook games
• Detect and block ransomware traffic

Strengths:

• Strong protection against advanced attacks
• Better visibility and control over applications

Limitations:

• More expensive
• More complex to manage

---

3. Web Application Firewall (WAF)

What it is:
A specialized firewall designed specifically to protect web applications.

What it protects:

• Websites and web applications (HTTP/HTTPS traffic only)

How it works:

• Filters and monitors web requests
• Protects against application-level attacks

Common attacks blocked:

• SQL Injection
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• File inclusion attacks

Layer:

• Operates strictly at Layer 7 (Application layer)

Example:

• Blocks malicious input in a login form
• Prevents attackers from injecting SQL commands

Strengths:

• Excellent for web security
• Essential for public-facing websites

Limitations:

• Does not protect non-web traffic
• Must be tuned to avoid false positives

---

Quick Comparison Table

Feature	Firewall	NGFW	WAF
Scope	Network traffic	Network + applications	Web applications only
OSI Layer	L3–L4	L3–L7	L7
Deep Packet Inspection	❌	✅	✅
Protects Against Web Attacks	❌	⚠️ Limited	✅
Complexity	Low	High	Medium
Use Case	Basic security	Enterprise security	Website security

---

Simple Analogy