5

I understand that Firewalls may operate on different OSI layers depends on the firewall itself. but how can I know if I install specific firewall at what OSI Layer(s) it does operate ?

  • iptables works at layers 2-4 of the OSI model – user25583 May 23 '16 at 7:09
  • Related Q&A (but not duplicate). – Eddie May 23 '16 at 15:20
  • iptables has some application layer knowlage to facilitate connection tracking and NAT. – Peter Green Apr 5 '17 at 13:34
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:44
13

Since firewalls essentially filter data, the answer depends on what kind of filtering you do.

If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3. If you filter specific ports, you can say you're filtering at layer 4. If your firewall inspects specific protocol states or data, you can say it operates at layer 7.

The truth is that most firewalls do all these things in combination. So practically speaking there really is no useful answer to your question.

May I suggest you also read this question about the OSI model.

| improve this answer | |
1

Unless your firewall uses the OSI model, it is of little value to speak about it in these terms. You should bear in mind that the TCP/IP model only has five layers.

That being said, it largely depends on if your firewall is capable of doing Deep Packet Inspection. If it is, it operates at L3/L4 and at the Application Layer. Otherwise, it only filters at the IP and Transport layers.

On the other hand, it "Operates" at all layers except for the application layer. It must have a physical connection, provide a data link/Network connection and enforce NAT policies and firewall rules at the IP layer and Transport layer. If it didn't it would not be a functioning firewall.

| improve this answer | |
0

It depends on what kind of firewall. There are three basic types: Generation 1 Packet Filter runs at layer 3, Generation 2 Stateful Filter runs at layer 5, and Generation 3 Application Firewall (also known as NGFW: Next Generation Fire-Wall.)

| improve this answer | |
  • "...runs at Layer 7" – user1016274 Nov 30 '18 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.