Network Security

Packet Filtering

Simple ruleset that discards iffy packets. These filter live in layer 3-4.

Execution Order: Rules are evaluated top-to-bottom; the first matching rule wins and subsequent rules are skipped.
Filter Parameter: Packet header fields — source/destination IP, source/destination port, protocol (TCP/UDP/ICMP), and interface.
Decision Rules: ACCEPT or DROP packets matching specific criteria (e.g. drop packets from a blocked source IP, drop TCP to port 23).
Default Rule: The chain policy, applied when no rule matches. Typically, POLICY DROP to deny all unmatched traffic (allowlist model).

Collects and decodes data, runs an antivirus on it and then forwards the message if everything is ok. These sit on layer 5-7.