Firewall Functions in Network Security

Quick Answer

Performing Network Address Translation is a legitimate function of many network firewalls because modern firewall appliances have evolved well beyond simple packet filtering into multi-purpose network edge devices, and NAT is one of the most common additional capabilities bundled into that role. NAT allows a firewall to translate between private internal IP addresses and a smaller set of public addresses, which serves both a connectivity purpose, letting many internal hosts share a limited number of public IPs, and a security purpose, hiding internal network topology from the outside world since external parties only ever see the translated address. This sits alongside the firewall's core, defining job of enforcing access control by inspecting traffic at Layer 3 and Layer 4, filtering based on IP addresses and ports, and permitting or denying packets according to configured rules, such as allowing HTTP traffic on port 80 from a specific source while blocking everything else. NAT and access-control filtering are complementary rather than competing functions: filtering decides what traffic is allowed through, while NAT decides how addresses are translated as that traffic passes. When a question asks which functions a firewall performs, remember that firewalls today are rarely single-purpose; besides packet filtering, look for functions like NAT, and be ready to distinguish those from services a firewall does NOT typically provide, such as content authoring unrelated to traffic control.