First Generation Firewall-Packet Filtering Firewall

Packet filtering is a method to check each packet at the network layer, and then to forward or discard packets based on security policies.

The basic principle of a packet filtering firewall is that it filters packets by configuring access control list (ACL), based on the source and destination IP addresses, the source and destination port numbers, IP identifiers and packet delivery direction.

With moderate cost and simple design, the first-generation firewall can be implemented easily.

However, it has obvious disadvantages:

• As the complexity and length of ACL increases, its filtering performance will degrade greatly.

• Static ACL rules are difficult to meet dynamic security requirements.

• Packet filtering neither checks session states nor analyzes data, that is, it cannot filter data at user levels to prevent hackers from spoofing. For example, an attacker can configure the host IP address to a legal host IP address to pass packet filtering.