Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I am trying to better understand the firewall's placement for a secure & nominal operation with efficient traffic flow.
The Question:
In any case, both firewall and router are parts of your network, so the difference you're asking about is the firewall in front of the WAN router or the firewall behind the WAN router.
The common scenario is that your network uses private IPv4 addresses and requires NAT on the WAN router.
Firewall in front of router
Firewall behind router
So, it's basically a design choice.
No matter where you place the firewall it's purpose is to filter traffic based on various parameters.
However, the idea of a protected inside network, while still widely implemented, is a legacy approach to networked systems. Google led the implementation of the Zero Trust Model as defined in their BeyondCorp whitepaper(s).
BeyondCorp is Google's implementation of the zero trust model. It builds upon a decade of experience at Google, combined with ideas and best practices from the community. By shifting access controls from the network perimeter to individual users, BeyondCorp enables secure work from virtually any location without the need for a traditional VPN.
In other words, there is no inside, or trusted network.
Note that modern firewalls have evolved to become application layer gateways, or next generation firewalls (NGF's). In modern cloud architectures applications are made up of microservices where application functionality is broken down into several services running on virtual computers called containers which are often physically implemented across the globe, or distributed.
Google's What is microservices architecture? says
To serve a single user request, a microservices-based application can call on many internal microservices to compose its response.
In other words, security is implemented by application architects, not by the network team.
zone is a keyword referring to a general physical location made up of clusters of compute systems. "firewall rules" are implemented on a global basis, not zonal. Google's VPC network overview VPC networks, including their associated routes and firewall rules, are global resources. They are not associated with any particular region or zone. In any case, the network itself is virtual and allows no traffic whatsoever by default. The term firewall is used for clarity but it's a very basic feature set.
May 21, 2022 at 17:45
Deployment of firewalls is purely depends upon network design and according to business requirements . But basically firewalls deployed on perimeter level where firewall is exposed to internet traffic should be much cautious allowing all security parameters enabled for better inspection and visibility of traffic flowing from outside to inside and inside to outside .
Quite often, the decision is based on other factors. What are the interface requirements? What is the budget? What are the routing requirements? The answers may drive the decision.
Many modern firewalls have significant routing capabilities, so you may end up using a single device for both functions.
