🔥 Firewalls · Proxies · ACLs

Interactive Network Security Demo — CS 423/623/723

🔥 How It Works

A firewall inspects packets at Layer 3/4 (IP & TCP/UDP headers) and decides whether to allow or deny traffic based on a sequential rule set. Rules are matched top-down — the first matching rule wins. An implicit deny all is typically the last rule.

Stateful Packet Filter Layer 3/4 Default Deny

📋 Firewall Rules

#	Src IP	Dst Port	Proto	Action
1	10.0.0.*	80	TCP	ALLOW
2	10.0.0.*	443	TCP	ALLOW
3	192.168.1.*	22	TCP	ALLOW
4	*	22	TCP	DENY
5	*	*	*	DENY

🧪 Simulate a Packet

💻

Client

🔥

Firewall

🖥️

Server

Src IP

Dst Port

Protocol

Configure a packet and click "Send Packet" to see how the firewall processes it.

🌐 How It Works

A proxy acts as an intermediary at Layer 7 (Application). Clients connect to the proxy, which opens a separate connection to the destination. The proxy can inspect, filter, cache, and modify application-layer content — including URLs, HTTP headers, and payloads. The destination only sees the proxy's IP, hiding the client.

Layer 7 Content Inspection IP Masking Caching

📋 Proxy Policy

#	URL Pattern	Method	Content	Action
1	.edu/	*	*	ALLOW
2	.google.com/	GET	*	ALLOW
3	.malware.xyz/	*	*	BLOCK
4	*	POST	SSN/CC#	BLOCK
5	*	GET	*	ALLOW

🧪 Simulate a Request

💻

Client

🌐

Proxy

🖥️

Web Server

URL

Method

Body

Configure a request and click "Send Request" to see how the proxy processes it.

🔐 How It Works

An Access Control List (ACL) is a set of permit/deny rules applied to a router interface. ACLs filter traffic as it enters (inbound) or exits (outbound) an interface. Standard ACLs (1-99) filter by source IP only. Extended ACLs (100-199) can match source/dest IP, ports, and protocols. Like firewalls, rules are checked top-down with an implicit deny.

Router-Level Standard vs Extended Interface-Bound Implicit Deny

📋 Extended ACL 101 (Inbound on Gi0/0)

#	Src IP	Dst IP	Port	Action
10	10.0.1.*	172.16.0.10	80	PERMIT
20	10.0.1.*	172.16.0.10	443	PERMIT
30	10.0.2.*	172.16.0.20	22	PERMIT
40	*	172.16.0.20	*	DENY
--	*	*	*	DENY

🧪 Simulate a Packet

💻

Host

🔐

Router ACL

🖥️

Server

Src IP

Dst IP

Dst Port

Configure a packet and click "Send Packet" to see how the ACL processes it.

📊 Side-by-Side Comparison

Feature	🔥 Firewall	🌐 Proxy	🔐 ACL
OSI Layer	Layer 3/4 (Network/Transport)	Layer 7 (Application)	Layer 3/4 (Network/Transport)
Inspects	IP headers, ports, protocol flags	URLs, HTTP headers, content body, cookies	Source/Dest IP, ports, protocol
Deployment	Network perimeter (dedicated device or software)	Inline or explicit config on clients	On router interfaces (inbound/outbound)
Statefulness	Stateful — tracks connection state	Fully application-aware; can cache & modify	Typically stateless (checks each packet independently)
Client Visibility	Transparent — clients don't know it's there	Client IP hidden from server; proxy IP exposed	Transparent — applied by router
Granularity	Medium — IP + port + protocol rules	High — can filter by URL path, content type, payload	Low-Medium — IP + port (extended) or IP only (standard)
Use Cases	Perimeter defense, zone segmentation, DMZ	Web filtering, caching, anonymization, DLP	Inter-VLAN filtering, router-level access control
Example	Block all inbound SSH except from admin subnet	Block uploads containing SSNs to non-.edu sites	Permit VLAN 10 → Web Server on port 80 only