First exams 2027 · SL & HL 2027 年首次开考 · SL 与 HL

A2.4.1 · Network security

A2.4.1 · 网络安全

Firewalls

防火墙

A firewall doesn't block everything, and it doesn't inspect everything either. Understanding exactly what it does check is the whole answer to how effective it actually is.

防火墙并不会拦截一切,它也并不会检查一切。准确理解它究竟检查了什么,正是它到底有多有效这个问题的全部答案所在。

Core for SL & HL SL 与 HL 核心内容 Typically 4–6 marks · AO3 通常 4–6 分 · AO3 Command term: discuss 命令词:discuss(讨论)

Explainer

讲解

The word "firewall" is borrowed from construction: a real firewall is a physical wall built into a building specifically to slow the spread of fire from one section to another. It's not there to stop fire completely, and it's certainly not there to stop everything else, water, noise, people, it has one specific job. A network firewall works the same way: it has one specific job too, and knowing exactly what that job is (and isn't) is the whole key to answering how effective it really is.

"firewall"(防火墙)这个词借自建筑领域:真正的防火墙是建筑物内一道实体墙,专门用来延缓火势从一个区域蔓延到另一个区域。它不是为了彻底阻止火,更不是为了阻止其他一切东西,水、噪音、人,它只有一项具体的职责。网络防火墙的原理相同:它同样只有一项具体的职责,而准确知道这项职责是什么(以及不是什么),正是回答它究竟有多有效这一问题的全部关键。

Df

A firewall sits at the boundary of a network and checks every packet trying to cross it, in either direction, against a configured list of rules, deciding whether that specific packet is let through or dropped.

防火墙位于网络的边界处,对每一个试图跨越该边界(无论方向)的数据包,依据一份已配置的规则列表进行检查,决定该数据包是被放行还是被丢弃。

Not a literal wall 并非字面意义上的墙

A firewall doesn't physically stop data the way a wall stops a person. It inspects each unit of data (a packet) as it tries to pass through, and makes an allow-or-deny decision based on rules, exactly like a security guard checking IDs against a list, not a locked door that's simply closed to everyone.

防火墙不会像墙阻挡人那样在物理上阻挡数据。它检查每一个试图通过的数据单元(即数据包),并依据规则做出放行或拒绝的判断,这就好比保安对照名单核查身份,而不是一道对所有人一律关闭的锁门。

Explainer

讲解

How a firewall actually decides

防火墙究竟如何做出判断

A firewall inspects the header of each packet, mainly its source and destination IP address and port, and checks it against an ordered list of rules. The first rule that matches decides the packet's fate: allowed through, or dropped.

防火墙检查每个数据包的首部,主要是其源与目的 IP 地址及端口,并将其与一份有序的规则列表进行比对。第一条匹配上的规则决定该数据包的命运:放行,或是被丢弃。

Term术语 What it means含义
Whitelist白名单 A list of addresses (or ports, or applications) that are explicitly allowed. Anything matching a whitelist entry passes through.一份明确被允许的地址(或端口、或应用程序)列表。凡是匹配白名单条目的都会被放行。
Blacklist黑名单 A list of addresses that are explicitly denied. Anything matching a blacklist entry is dropped, even if it would otherwise look harmless.一份明确被拒绝的地址列表。凡是匹配黑名单条目的都会被丢弃,即便它原本看起来无害。

Most real firewalls combine both: a short whitelist for known, trusted traffic, and a default rule at the very end that denies anything nothing else matched.

大多数真实的防火墙会将两者结合使用:一份简短的白名单用于已知、受信任的流量,并在最末尾设置一条默认规则,拒绝所有未匹配到其他规则的流量。

!

Stateful inspection goes one step further: instead of judging every packet in total isolation, the firewall remembers which connections it has already allowed. Once a connection is open, the packets flowing back and forth as part of it are recognised and allowed to continue, without needing to individually re-match every rule from scratch.

状态检测更进一步:防火墙不再孤立地判断每一个数据包,而是记住自己已经放行过哪些连接。一旦某个连接建立,属于该连接来回传输的数据包便会被识别出来并允许继续通行,而无需每次都重新逐条匹配所有规则。

Worked example

Tracing packets through a rule list

Bec manages the network for her school's library computer lab. She sets up the lab's firewall with two rules, checked in order, then a default that denies anything neither rule matched.

OrderRuleAction
1Source starts with 10.20.30. (the lab's own subnet)Allow
2Source is exactly 198.51.100.7 (the school's backup server)Allow
defaultAnything elseBlock
Checking three arriving packets against Bec's rules Step 1 of 3

Packet from 10.20.30.15 (a laptop inside the lab). Checked against Rule 1 first: does the source start with 10.20.30.? Yes.

10.20.30.15 vs Rule 1 (10.20.30.*) → match ALLOW, no further rules checked

Packet from 198.51.100.7 (the backup server). Checked against Rule 1: does it start with 10.20.30.? No. Checked against Rule 2: is it exactly 198.51.100.7? Yes.

198.51.100.7 vs Rule 1 (10.20.30.*) → no match 198.51.100.7 vs Rule 2 (198.51.100.7) → match ALLOW

Packet from 91.203.44.10 (an unknown address on the open internet). Doesn't match Rule 1, doesn't match Rule 2. Falls through to the default rule.

91.203.44.10 vs Rule 1 → no match 91.203.44.10 vs Rule 2 → no match No rule matched → BLOCK (the default)

Try it yourself

Run the same rules as code

The exact ordered-rule-matching logic from the trace above, written as a function. Try adding your own rule, or your own test address, and see which one it matches.

main.py
Loading Python engine…
Output
Press Run to see the output here.

Running in offline fallback mode. The full Python engine couldn't load (blocked school network, or no internet), so this console switched automatically to a small hand-written engine. It supports this page's functions and loops, but it isn't full Python.

ip.find(prefix) == 0 checks whether ip starts with prefix, since this console's string support doesn't include a dedicated startswith(). find() returns the position of the first match, and a match right at position 0 means the string begins with it.

Explainer

How effective are firewalls, really?

This is the actual question the statement asks: not "what is a firewall" but "how well does it work." A good discussion needs genuine strengths AND genuine limitations, not just a list of good things.

Strengths

Real example: a school blocking every external IP address except its own approved cloud services, exactly the rule shape traced above.

  • Real access control (a well-configured rule list genuinely stops unauthorized addresses and ports from reaching the network at all)
  • Traffic logging (every checked packet can be logged, which is often how a suspicious pattern or an actual breach gets noticed and investigated)
  • Runs continuously, at network speed (unlike a human reviewing traffic manually, a firewall checks every single packet, all the time, without getting tired or distracted)
Limitations

Real example: a staff member's own laptop, already inside the network, deliberately or accidentally leaking data.

  • Weak against threats already inside (a firewall mainly controls what crosses the boundary between the internal network and the outside; a malicious insider, or a device already compromised via infected WiFi, never has to cross that boundary at all)
  • Can be fooled by traffic that looks legitimate (a basic firewall checks addresses and ports, not the actual content being sent, so harmful data addressed to a permitted destination on a permitted port can still get through)
  • Only as good as its own configuration (a rule list that's gone stale, or firmware that's gone unpatched, opens exactly the gaps the firewall exists to close)
!

A defensible verdict, not a one-word answer: firewalls are genuinely effective at controlling which addresses and ports may cross a network's boundary, and that alone stops a large share of unwanted traffic before it ever gets a chance. They are not, on their own, a complete security solution: they do little against a threat that's already inside the network, and a basic firewall can't see inside a packet addressed to somewhere it's already permitted to go. A well-reasoned "discuss" answer says exactly this: strong at boundary control, limited against insider threats and disguised content, which is precisely why real networks pair a firewall with other measures (A2.4.3's countermeasures) rather than relying on it alone.

Explainer

NAT's role in security

Network address translation (NAT) lets many devices on a private network share one public IP address for anything they send to the internet. Its original purpose has nothing to do with security, it exists because the world ran out of IPv4 addresses to give every device its own public one.

!

NAT still ends up helping security anyway, as a side effect. Because every device behind it appears to the outside world as the router's single public address, an external attacker can't see or directly target any specific device's real internal address. This is sometimes called security by obscurity: NAT wasn't designed as a security feature, but hiding the internal network's real structure genuinely does make it harder to attack directly.

Check your understanding

A company's firewall is correctly configured, fully up to date, and has never let in a single unauthorized external connection. An employee still leaks confidential files by emailing them to a personal account from their own already-authorized work laptop. What does this best illustrate?

Common mistake

Markers reported this pattern repeatedly when asked to describe a firewall

RecurringA very common, genuinely documented wrong answer describes a firewall as if the name were literal, "a wall" that blocks things, with no mention of what it actually inspects or how it decides.

✕

Too literal: "A firewall is a wall that stops hackers and viruses from getting into a network." Names the right general purpose (protection) but nothing about the actual mechanism, this could describe almost any security measure at all, not specifically a firewall.

✓

Names the mechanism: "A firewall checks each packet entering or leaving a network against a configured list of rules, comparing details like the source address and port, then allows or drops that packet depending on which rule it matches." States what it actually inspects (packets, addresses, ports) and what it actually does (checks against rules), which is what earns the mark.

Revision questions

Past-paper style. Write an answer, then reveal the marking points and mark yourself.

Question 1 · 2 marks

[2]Describe the role of a firewall in protecting a network.

Question 2 · 3 marks

[3]Explain the difference between a whitelist and a blacklist in the context of firewall rules.

Question 3 · 6 marks

[6]Discuss the effectiveness of firewalls at protecting a network, referring to both their strengths and their limitations.

Flashcards

Active recall for this statement’s key terms.