Firewalls & VPNs Cheat Sheet

Updated 2026-05-25

Next Topic: Identity and Access Management IAM Cheat Sheet

🧠Study flashcards on this topic106 cards · spaced repetition→

Firewalls and Virtual Private Networks form the foundation of network perimeter security, controlling traffic flow and establishing encrypted communication channels across untrusted networks. Firewalls inspect and filter traffic based on configurable policies, while VPNs create secure tunnels that protect data confidentiality and integrity between remote endpoints. Understanding both packet filtering rules and encryption protocols is critical: a misconfigured firewall rule can expose internal resources, while weak VPN encryption or authentication can compromise entire remote access infrastructures—making proper configuration of both technologies essential for maintaining secure network boundaries in modern distributed environments. In 2026, the perimeter has dissolved: Zero Trust architectures, SASE, and ZTNA are actively replacing legacy VPN-only models, and post-quantum cryptography is entering firewall and VPN products ahead of compliance deadlines.

What This Cheat Sheet Covers

This topic spans 14 focused tables and 116 indexed concepts, 106 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Firewall TypesTable 2: Firewall Rule ComponentsTable 3: Firewall Rule ActionsTable 4: Firewall Policy ConceptsTable 5: Firewall Advanced FeaturesTable 6: VPN Types and ArchitecturesTable 7: VPN ProtocolsTable 8: IPsec ComponentsTable 9: VPN Encryption and AuthenticationTable 10: VPN Tunneling ConceptsTable 11: VPN Advanced FeaturesTable 12: Common Firewall/VPN PortsTable 13: Firewall/VPN Best PracticesTable 14: Common Firewall/VPN Issues and Solutions

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Firewall Types

Choosing the right firewall type determines the depth of inspection and the threats you can realistically detect. The field has expanded well beyond stateless packet filters—modern deployments layer NGFWs, WAFs, and cloud-delivered FWaaS to cover every traffic layer and deployment model.

Type	Example	Description
Stateless (Packet Filtering)	`iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT`	• Examines each packet independently based on header information only (source/destination IP, port, protocol) • no connection tracking • fastest but least secure.
Stateful Inspection	Session tracking TCP 3-way handshake	• Maintains a state table of active connections, tracking session context (SYN/ACK sequences, connection state) • validates packets belong to established sessions.
Next-Generation Firewall (NGFW)	Palo Alto, FortiGate, Check Point Quantum	Combines stateful inspection with application identification, deep packet inspection (DPI), IPS/IDS, user identity integration, and threat intelligence.
AI-Powered Firewall	Check Point Force, FortiGate with FortiAI	• NGFW with embedded ML and adaptive learning • detects zero-day threats without signatures • continuously trains on live traffic to improve anomaly detection.
Web Application Firewall (WAF)	AWS WAF, Cloudflare WAF, F5 BIG-IP	• Operates at Layer 7, inspecting HTTP/HTTPS traffic • protects against OWASP Top 10 (SQL injection, XSS, CSRF) • sits between users and web applications • not a primary network firewall.
Firewall-as-a-Service (FWaaS)	Zscaler Internet Access, Palo Alto Prisma	• NGFW capabilities delivered as a cloud subscription • no on-prem hardware • scales elastically with traffic • enforces consistent policies for distributed users • key component of SASE.
Application Layer Gateway (Proxy Firewall)	HTTP proxy filtering requests	• Operates at Layer 7 (application layer) • acts as intermediary between client and server • can decrypt/inspect SSL/TLS • higher latency than stateful firewalls.
Unified Threat Management (UTM)	FortiGate all-in-one SMB appliance	• Combines firewall, IPS/IDS, antivirus, web filtering, and VPN in a single platform • simplifies SMB management but may introduce performance bottlenecks.
Cloud/Virtual Firewall	AWS Network Firewall, Azure Firewall	• Software-based firewall deployed in cloud or virtualized environments • scales elastically • supports multi-tenant isolation • enforces policy between VMs and cloud workloads.
Circuit-Level Gateway	SOCKS proxy for TCP connections	• Validates TCP handshakes at session layer • establishes circuits between trusted clients and untrusted networks • no deep packet inspection.

Table 2: Firewall Rule Components

Every firewall rule is assembled from a fixed set of match criteria and a resulting action. Understanding each component—and especially how source/destination zones interact with protocol and port—is essential for writing precise, auditable policies.

Component	Example	Description
Source Address	`10.0.0.0/8` or `any`	• Originating IP address or subnet • can be specific host, CIDR block, or wildcard (any).

The rest of this section is part of the full cheat sheet

Table 3: Firewall Rule Actions

The action taken on a matching packet is the most critical part of any rule. The choice between DROP and REJECT, or between LOG and ALERT, has meaningful security and operational implications.

Action	Example	Description
Allow (Accept/Pass)	`iptables -A INPUT -p tcp --dport 80 -j ACCEPT`	• Permits traffic to pass through firewall • packet forwarded to destination • most permissive action.

The rest of this section is part of the full cheat sheet

Table 4: Firewall Policy Concepts

Policy design decisions—default deny, rule ordering, zone architecture—determine whether a firewall actually reduces attack surface or just creates the appearance of security. Getting these concepts right is more important than any individual rule.

Concept	Example	Description
Default Deny (Implicit Deny)	Block all traffic unless explicitly allowed	• Industry best practice: last rule blocks everything • ensures only authorized traffic passes • fail-secure approach.

The rest of this section is part of the full cheat sheet

Table 1: Firewall Types

Type	Example	Description
Stateless (Packet Filtering)	`iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT`	• Examines each packet independently based on header information only (source/destination IP, port, protocol) • no connection tracking • fastest but least secure.
Stateful Inspection	Session tracking TCP 3-way handshake	• Maintains a state table of active connections, tracking session context (SYN/ACK sequences, connection state) • validates packets belong to established sessions.
Next-Generation Firewall (NGFW)	Palo Alto, FortiGate, Check Point Quantum	Combines stateful inspection with application identification, deep packet inspection (DPI), IPS/IDS, user identity integration, and threat intelligence.
AI-Powered Firewall	Check Point Force, FortiGate with FortiAI	• NGFW with embedded ML and adaptive learning • detects zero-day threats without signatures • continuously trains on live traffic to improve anomaly detection.
Web Application Firewall (WAF)	AWS WAF, Cloudflare WAF, F5 BIG-IP	• Operates at Layer 7, inspecting HTTP/HTTPS traffic • protects against OWASP Top 10 (SQL injection, XSS, CSRF) • sits between users and web applications • not a primary network firewall.
Firewall-as-a-Service (FWaaS)	Zscaler Internet Access, Palo Alto Prisma	• NGFW capabilities delivered as a cloud subscription • no on-prem hardware • scales elastically with traffic • enforces consistent policies for distributed users • key component of SASE.
Application Layer Gateway (Proxy Firewall)	HTTP proxy filtering requests	• Operates at Layer 7 (application layer) • acts as intermediary between client and server • can decrypt/inspect SSL/TLS • higher latency than stateful firewalls.
Unified Threat Management (UTM)	FortiGate all-in-one SMB appliance	• Combines firewall, IPS/IDS, antivirus, web filtering, and VPN in a single platform • simplifies SMB management but may introduce performance bottlenecks.
Cloud/Virtual Firewall	AWS Network Firewall, Azure Firewall	• Software-based firewall deployed in cloud or virtualized environments • scales elastically • supports multi-tenant isolation • enforces policy between VMs and cloud workloads.
Circuit-Level Gateway	SOCKS proxy for TCP connections	• Validates TCP handshakes at session layer • establishes circuits between trusted clients and untrusted networks • no deep packet inspection.

Table 2: Firewall Rule Components

Component	Example	Description
Source Address	`10.0.0.0/8` or `any`	• Originating IP address or subnet • can be specific host, CIDR block, or wildcard (any).

Table 3: Firewall Rule Actions

The action taken on a matching packet is the most critical part of any rule. The choice between DROP and REJECT, or between LOG and ALERT, has meaningful security and operational implications.

Action	Example	Description
Allow (Accept/Pass)	`iptables -A INPUT -p tcp --dport 80 -j ACCEPT`	• Permits traffic to pass through firewall • packet forwarded to destination • most permissive action.

Table 4: Firewall Policy Concepts

Concept	Example	Description
Default Deny (Implicit Deny)	Block all traffic unless explicitly allowed	• Industry best practice: last rule blocks everything • ensures only authorized traffic passes • fail-secure approach.