The big idea: A firewall sits where the network meets the outside world and inspects every packet crossing it.
Each one is checked against the rules and then either allowed through or dropped.
It works both ways: Incoming — stop outsiders reaching services that should not be exposed.
Outgoing — stop an already-infected machine sending data out, or contacting whoever controls it. Most answers forget the second.
Free preview
This is the free notes preview
You're reading the free notes. Aimnova Pro unlocks the full study experience — and you can try it with your first topic free to keep:
- FlashcardsLock in vocabulary and key terms with spaced repetition.
- Practice questionsAnswer exam-style questions and get instant AI marking.
- Mock exams & past-paper vaultSit full mocks and see exactly how examiners award marks.
- Personalised study planA daily plan built around your exam date and weak areas.
Start Studying Free Full access to Aimnova Pro · cancel anytime
Whitelist
- Allow only what is listed; block everything else
- Safest, because anything unknown is refused by default
- Restrictive — new legitimate traffic must be added first
- Used where security matters more than convenience
Blacklist
- Block what is listed; allow everything else
- Convenient — nothing legitimate is accidentally blocked
- Weaker: anything not yet known about gets through
- Always one step behind new threats
Rules
- Conditions on address, port, protocol and direction
- "Allow incoming traffic to the web server on port 443"
- Checked in order, so a broad rule early can hide later ones
- Rules are what turn either list into something usable
The choice in one line: A whitelist is safe by default and inconvenient. A blacklist is convenient by default and unsafe.
Which is right depends on how much an unknown connection would cost you.
Study smarter, not longer
Most students waste 40% of study time on topics they already know. Our AI tracks your progress and optimizes every minute.
Try Smart Study FreeYour first topic is free to keep • No credit card required
What a firewall does well
- Blocks connections to services that should not be exposed
- Enforces one policy at one place, for the whole network
- Stops an infected machine calling out, if outgoing rules exist
- Logs what was blocked, which is how attacks get noticed
What it cannot do
- Nothing about traffic that never crosses it — a USB stick, or machine-to-machine inside the network
- It cannot read encrypted contents, only who is talking to whom
- It allows anything the rules permit, including an attack over an allowed port
- A wrong or forgotten rule silently leaves a gap
Where NAT helps: Because internal machines have private addresses, nothing on the internet can address them directly — only reply to a conversation they started.
That blocks a whole class of unsolicited connections before the firewall rules are even consulted.
But NAT is not a firewall: NAT stops unsolicited incoming connections. It does nothing about outgoing traffic, nothing about what an allowed connection carries, and nothing inside the network.
It is a useful side effect, not a security policy.
How this is tested — you must DISCUSS — give the protection and the limitation, then judge. It comes up two ways:
Paper 1 Section A
- Discuss the effectiveness of firewalls, 4-6 marks
- Distinguish whitelisting from blacklisting
- Explain how NAT contributes to security
Paper 1 Section B — case study
- Evaluate the case study's protection
- Recommend what else they need alongside it
The classic trap: Describing what a firewall does and calling that a discussion. "Discuss" wants the limitations too — traffic that never crosses it, encrypted contents it cannot read, and attacks over ports the rules allow.
IB-style questionDiscuss[6 marks]
A school has installed a firewall at its internet connection and considers its network secure. Discuss how effective this is.
Model answer plan
See the mark-by-mark plan — for / against / judgement, with marking guidance — in study mode.