Proxy

What Are These Devices? Three different network security devices that control and inspect internet traffic, each operating at different layers and serving different purposes. 1. Network Firewall Physical or virtual device at network perimeter that blocks/allows traffic based on IP, port, and protocol. Key Characteristics Layer: 3-4 (Network/Transport Layer) Location: On-premises, between internal network and internet Type: Physical appliance or virtual machine Purpose: Control which connections are allowed What It Checks ✓ Source IP address ✓ Destination IP address ✓ Port number (80, 443, 22, etc.) ✓ Protocol (TCP, UDP, ICMP) ✗ Cannot see HTTP headers ✗ Cannot see URLs ✗ Cannot see content Example Decision Rule: Allow port 443 (HTTPS) to any destination Request: 192.168.1.100 → 203.0.113.50:443 Decision: ALLOW (port 443 is allowed) Rule: Block port 22 (SSH) to internet Request: 192.168.1.100 → 203.0.113.50:22 Decision: BLOCK (port 22 is blocked) Common Products Palo Alto Networks PA-Series (physical appliance) Cisco ASA (physical appliance) Fortinet FortiGate (physical appliance) AWS Network Firewall (virtual/cloud) pfSense (software firewall) Physical Deployment [Internet] | [Physical Firewall Appliance] ← Rack-mounted in data center | [Internal Network Switch] | [User Devices] 2. Proxy Server Physical or virtual device that forwards HTTP/HTTPS requests, can inspect and modify content. ...

What is Corporate Proxy with SSL Inspection? Corporate proxies intercept HTTPS traffic to inspect content for security and compliance. This is called SSL Inspection or MITM (Man-In-The-Middle). Complete Flow: curl Through Proxy Command: curl -v -x http://proxy.company.com:8080 https://api.example.com/data Step-by-Step Flow: 1. DNS Resolution curl resolves proxy hostname ↓ DNS: proxy.company.com → 192.168.1.100 2. TCP Connection to Proxy curl → proxy:8080 ↓ TCP handshake: SYN, SYN-ACK, ACK ↓ Connection established 3. CONNECT Request (HTTP Tunnel) curl sends: → CONNECT api.example.com:443 HTTP/1.1 → Host: api.example.com → User-Agent: curl/8.0.0 → Proxy-Connection: Keep-Alive Proxy responds: ← HTTP/1.1 200 Connection established Key point: CONNECT doesn’t create new TCP connection - it repurposes existing connection as tunnel. ...