Technical Tip: Difference between network-based and host-based firewalls

[epinheiro]

Description	This article describes briefly how network-based and host-based firewalls work, specifically regarding FortiGate.
Scope	FortiGate.
Solution	Network-based firewalls are typically positioned at the network's perimeter, such as between the internet and an organization's internal network. They examine network traffic as it enters and exits the network, filtering packets based on predefined rules preventing unauthorized access from external sources, but do not inspect traffic originating from within the network (hosts in the same subnet). Host-based firewalls are software applications installed directly on the hosts to monitor and control network traffic to and from the specific host on which they are installed to protect against attacks originating within the network, filtering traffic based on applications, users, and ports. FortiGate is a network-based firewall. So, with or without a firewall policy, or even if the FortiGate is powered off, the users will communicate successfully with other hosts for traffic across the same LAN/VLAN. When performing a sniffer capture on the FortiGate, no packets will be observed, indicating that the traffic between the hosts doesn't need to reach the firewall to continue working properly. Note: FortiGate must not be investigated for any issues related to the host's inability to reach services on other hosts/servers within the same subnet, except for VIP traffic (Hairpin NAT), because the host needs to reach the gateway of the host (FortiGate interface IP) and then FortiGate will redirect the traffic. Related article: Troubleshooting Tip: Hairpin NAT when the server is located behind the same LAN interface and the ex...