The difference between router and firewall

I believe that everyone often hears the terms router and firewall. It is estimated that most people know more about routers and less about firewalls. It can also be said that the knowledge about firewalls is relatively vague. Let’s talk about Let me explain to you the differences between routers and fire protection.

1. The two have different functions and concepts.

Routers are based on network data packets and effectively route different network data packets. We don’t need to know what the above route is, why it needs to be routed, whether problems will occur after routing, etc. What we need to know is whether the router can route different network data packets to achieve communication.

Firewalls are generated because we need to verify the security of data when transmitting data. Whether the data packet can arrive correctly, the time of arrival, the direction, etc. are not the focus of the firewall. The focus is whether the data packet should pass through. Will it cause harm to the network in the future?

2. The functions and purposes of the two are different

The main functional purpose of the router: to maintain the “communication” of the network and data;

The function and purpose of the firewall: to ensure that any non-permitted data packets are “painless”;

3. The core technologies of the two are different.

The router core’s ACL list is based on simple packet filtering;

Firewall is application-level information flow filtering based on stateful packet filtering.

4. The impact of the performance of the two is different.

The original intention of the router is to forward data packets. Because it is not specifically designed as a professional firewall, the amount of calculations required by the router when filtering data packets is very large, and the demand and requirements for the CPU and running memory are very high. Since routers have high hardware costs, high-performance routers are very expensive.

The original intention of the firewall is to filter data packets, and the performance of data packet filtering is very high. At the same time, the hardware configuration requirements are very high, and the firewall software has also been professionally optimized for packet filtering. Firewalls mainly run in the kernel mode of the operating system, and are designed with security issues in mind.

Further reading-Router security:

For routers like Cisco, the ordinary version does not have application layer prevention functions, real-time intrusion detection and other functions. If you need to have such functions, you need to upgrade the IOS to the firewall feature set. At this time, you not only have to bear the burden of software Upgrade costs, and because these functions require a lot of calculations and hardware configuration upgrades, further increase the cost, and many manufacturers’ routers do not have such advanced security functions.

Since the router is a simple packet filter, the increase in the number of packet filter rules and the increase in the number of NAT rules will have a corresponding increase in the impact on the performance of the router. NetEye firewall uses stateful packet filtering, the number of rules, and NAT The impact on performance of the number of rules is close to zero.