A packet filtering firewall allows or blocks each packet based on header fields such as address, port and protocol. A proxy firewall stands between client and server, ends the connection and opens a new one, so it can inspect the application content. Packet filters are fast and simple. Proxies see more but cost more.
How does a packet filter decide?
The simplest firewall looks at each packet alone. Rules match source and destination address, port and protocol, and the action is allow or deny. A rule such as "allow TCP to 203.0.113.20 port 443" is typical.
It is fast because it does little work. It is also blind to context. A stateless filter cannot tell whether a packet belongs to a conversation the inside host started, so return traffic often needs its own rule, which tends to be broad.
Stateful inspection, covered in NIST SP 800-41, improves on this. The firewall tracks connections in a table, so a reply is allowed because it matches a request that went out, and unsolicited inbound packets are dropped. Most modern network firewalls work this way, and many call the older stateless kind simply "packet filtering".
How does a proxy firewall work differently?
An application proxy acts as the server to the client and as the client to the server. The client's connection ends at the proxy. The proxy reads the application protocol, applies policy, and if allowed, opens its own separate connection onward.
Because it understands the protocol, it can make decisions that headers cannot support. It can allow web browsing but block uploads to a file sharing site, enforce that an email protocol is used correctly, strip dangerous content, require user authentication, and keep detailed logs of commands. It also hides internal hosts, since outside servers only see the proxy.
NIST SP 800-41 lists the trade-off. Proxies provide a high level of control, but consume more resources, may need a specific proxy per protocol, and can slow traffic.
How do they compare in one example?
A constructed example. A company wants staff to browse the web but not post files to personal storage sites.
A packet filter can allow outbound port 443 to anywhere. It cannot tell a news site from a storage upload, because the header looks the same.
A proxy that terminates the secure connection, with the company's trust, can see the destination and the method. It allows reads, blocks uploads to the storage category, and logs the attempt. The cost is deploying the proxy certificate to devices, handling privacy and legal questions about inspecting traffic, and extra processing.
Which one should you use?
Most networks use both layers. A stateful filter at the edge and between internal zones handles bulk traffic cheaply. A proxy, often in front of web access or in front of a published application, handles the traffic where content matters.
Choose a packet filter when speed, simplicity and low cost matter, and rules by address and port are enough: segmenting data center zones, restricting administrative access, isolating guest networks.
Choose a proxy when you need to understand or change the content: controlling web use, scanning downloads, protecting a web application, or enforcing authentication per user rather than per address.
What are the common mistakes?
Treating a firewall as a one-time install. Rule sets grow, owners leave and nobody knows what rules do. NIST SP 800-41 recommends policy that is reviewed regularly. Another mistake is assuming encryption does not matter: a proxy can only inspect encrypted traffic if it decrypts it, and that decision needs care. A third is leaving a broad "allow all" rule from the testing phase.
How to check or apply this
- List each firewall and note whether it is stateless, stateful or proxy based.
- Export the rule set and mark rules with no owner or no recent hits.
- Replace broad rules with specific ones where traffic patterns are known.
- Decide which traffic needs content inspection, and put proxies only there.
- If you decrypt traffic, write the policy on what is excluded, such as health and banking sites, with legal input.
- Schedule a rule review every quarter.
Quick check
Is a stateful firewall a proxy?
No. It tracks connections but forwards packets itself. A proxy terminates the connection and creates a new one.
Does a proxy firewall make a network faster?
No. It adds processing. Caching proxies can speed up repeated requests, but a security proxy usually adds some delay.
Sources
Last reviewed: 18 October 2026.
