1

I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow.

The Question:

  • What would the use case scenario be for firewall outside vs. inside?
  • What would the benefits be for firewall outside vs. inside?
  • What issues can arise from having a firewall outside vs. inside?
  • What are other things to consider?

enter image description here

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Nov 19, 2022 at 22:40

4 Answers 4

Reset to default
1

In any case, both firewall and router are parts of your network, so the difference you're asking about is the firewall in front of the WAN router or the firewall behind the WAN router.

The common scenario is that your network uses private IPv4 addresses and requires NAT on the WAN router.

Firewall in front of router

  • firewall protects router
  • firewall cannot identify users/devices behind NAT router

Firewall behind router

  • router needs to protect itself
  • firewall sees untranslated private IP addresses from inside the private network

So, it's basically a design choice.

Improve this answer
1

No matter where you place the firewall it's purpose is to filter traffic based on various parameters.

However, the idea of a protected inside network, while still widely implemented, is a legacy approach to networked systems. Google led the implementation of the Zero Trust Model as defined in their BeyondCorp whitepaper(s).

BeyondCorp is Google's implementation of the zero trust model. It builds upon a decade of experience at Google, combined with ideas and best practices from the community. By shifting access controls from the network perimeter to individual users, BeyondCorp enables secure work from virtually any location without the need for a traditional VPN.

In other words, there is no inside, or trusted network.

Note that modern firewalls have evolved to become application layer gateways, or next generation firewalls (NGF's). In modern cloud architectures applications are made up of microservices where application functionality is broken down into several services running on virtual computers called containers which are often physically implemented across the globe, or distributed.

Google's What is microservices architecture? says

To serve a single user request, a microservices-based application can call on many internal microservices to compose its response.

In other words, security is implemented by application architects, not by the network team.

Improve this answer
3
  • While Zero Trust may be a good model to design a network from, that doesn't mean that there's only a single security zone - the open Internet. You still put firewalls between zones and on top of that you don't inherently trust anything you haven't explicitly checked. So, it's not either ... or but as well as.
    – Zac67 ♦
    May 21, 2022 at 17:31
  • @Zac67, in GCP zone is a keyword referring to a general physical location made up of clusters of compute systems. "firewall rules" are implemented on a global basis, not zonal. Google's VPC network overview VPC networks, including their associated routes and firewall rules, are global resources. They are not associated with any particular region or zone. In any case, the network itself is virtual and allows no traffic whatsoever by default. The term firewall is used for clarity but it's a very basic feature set.
    – Ronnie Royston
    May 21, 2022 at 17:45
  • Ronnie, I wasn't referring to any specific cloud environment but to the general concept.
    – Zac67 ♦
    May 22, 2022 at 11:49
1

Deployment of firewalls is purely depends upon network design and according to business requirements . But basically firewalls deployed on perimeter level where firewall is exposed to internet traffic should be much cautious allowing all security parameters enabled for better inspection and visibility of traffic flowing from outside to inside and inside to outside .

Improve this answer
0

Quite often, the decision is based on other factors. What are the interface requirements? What is the budget? What are the routing requirements? The answers may drive the decision.

Many modern firewalls have significant routing capabilities, so you may end up using a single device for both functions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.