Firewalls and Proxies Explained — How Networks Stay Safe and Fast

# Simulating a basic stateless packet-filtering firewall in Python.
# In production, this logic lives in kernel space (iptables, nftables, Windows Firewall).
# Here we model it in userspace so you can SEE the decision process.

from dataclasses import dataclass
from typing import List

@dataclass
class NetworkPacket:
    source_ip: str
    destination_ip: str
    destination_port: int
    protocol: str  # 'TCP', 'UDP', 'ICMP'

@dataclass
class FirewallRule:
    """
    A single firewall rule. Rules are evaluated top-to-bottom.
    The first matching rule wins — just like real iptables chains.
    """
    source_ip: str        # '*' means any
    destination_port: int # -1 means any
    protocol: str         # '*' means any
    action: str           # 'ALLOW' or 'DENY'

class PacketFilterFirewall:
    def __init__(self, default_policy: str = 'DENY'):
        """
        Default policy is 'DENY' — this is the secure default.
        'Allow all, deny specific' is the WRONG approach (allowlist vs denylist).
        """
        self.rules: List[FirewallRule] = []
        self.default_policy = default_policy

    def add_rule(self, rule: FirewallRule):
        # Rules are ordered — first match wins, so order matters enormously
        self.rules.append(rule)

    def inspect(self, packet: NetworkPacket) -> str:
        for rule in self.rules:
            # Check each condition — '*' is a wildcard that matches anything
            ip_match = (rule.source_ip == '*' or rule.source_ip == packet.source_ip)
            port_match = (rule.destination_port == -1 or rule.destination_port == packet.destination_port)
            proto_match = (rule.protocol == '*' or rule.protocol == packet.protocol)

            if ip_match and port_match and proto_match:
                # Found the first matching rule — enforce it immediately
                return rule.action

        # No rule matched — fall back to the default policy
        return self.default_policy

# --- Setting up the firewall ---
firewall = PacketFilterFirewall(default_policy='DENY')

# Rule 1: Allow all HTTP traffic from anywhere
firewall.add_rule(FirewallRule(source_ip='*', destination_port=80, protocol='TCP', action='ALLOW'))

# Rule 2: Allow HTTPS from anywhere
firewall.add_rule(FirewallRule(source_ip='*', destination_port=443, protocol='TCP', action='ALLOW'))

# Rule 3: Allow SSH only from the trusted admin IP
firewall.add_rule(FirewallRule(source_ip='10.0.0.5', destination_port=22, protocol='TCP', action='ALLOW'))

# Rule 4: Explicitly block a known malicious IP on any port
firewall.add_rule(FirewallRule(source_ip='185.220.101.9', destination_port=-1, protocol='*', action='DENY'))

# --- Testing packets against the firewall ---
test_packets = [
    NetworkPacket('203.0.113.42', '192.168.1.1', 80,  'TCP'),  # Regular web request
    NetworkPacket('203.0.113.42', '192.168.1.1', 443, 'TCP'),  # HTTPS request
    NetworkPacket('198.51.100.7', '192.168.1.1', 22,  'TCP'),  # SSH from unknown IP
    NetworkPacket('10.0.0.5',     '192.168.1.1', 22,  'TCP'),  # SSH from trusted admin
    NetworkPacket('185.220.101.9','192.168.1.1', 443, 'TCP'),  # Known bad actor on HTTPS
    NetworkPacket('203.0.113.42', '192.168.1.1', 8080,'TCP'),  # Non-standard port — no rule
]

print(f"{'Source IP':<20} {'Port':<6} {'Result'}")
print('-' * 40)
for pkt in test_packets:
    result = firewall.inspect(pkt)
    print(f"{pkt.source_ip:<20} {pkt.destination_port:<6} {result}")

# This demo simulates the REQUEST FLOW through both a forward and reverse proxy.
# We use Python's http.server and threading to run real local HTTP servers.
# Run this script and watch the printed logs to see who talks to whom.

import threading
import time
from http.server import HTTPServer, BaseHTTPRequestHandler
from urllib.request import urlopen, Request
from urllib.error import URLError

# ─────────────────────────────────────────────────
# 1. THE ORIGIN SERVER — represents your backend API
# ─────────────────────────────────────────────────
class OriginServerHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        # Log who is connecting — in a reverse proxy setup, this will be
        # the proxy's IP, NOT the original client's IP
        print(f"[ORIGIN SERVER] Received request from: {self.client_address[0]}")
        print(f"[ORIGIN SERVER] Path requested: {self.path}")

        response_body = b"Hello from the Origin Server! Path: " + self.path.encode()
        self.send_response(200)
        self.send_header('Content-Type', 'text/plain')
        self.send_header('Content-Length', len(response_body))
        self.end_headers()
        self.wfile.write(response_body)

    # Suppress default request logging to keep output clean
    def log_message(self, format, *args): pass

# ─────────────────────────────────────────────────
# 2. THE REVERSE PROXY — sits in front of origin
# ─────────────────────────────────────────────────
class ReverseProxyHandler(BaseHTTPRequestHandler):
    ORIGIN_SERVER_URL = 'http://127.0.0.1:9001'
    BLOCKED_PATHS = ['/admin', '/internal']

    def do_GET(self):
        print(f"\n[REVERSE PROXY] Client {self.client_address[0]} wants: {self.path}")

        # Block sensitive internal paths — client never knows these exist
        if self.path in self.BLOCKED_PATHS:
            print(f"[REVERSE PROXY] BLOCKING sensitive path: {self.path}")
            self.send_response(403)
            self.end_headers()
            self.wfile.write(b"403 Forbidden")
            return

        # Forward the request to the origin server on the client's behalf
        # The origin server will see 127.0.0.1, not the real client IP
        target_url = self.ORIGIN_SERVER_URL + self.path
        print(f"[REVERSE PROXY] Forwarding to origin: {target_url}")

        try:
            with urlopen(Request(target_url), timeout=5) as origin_response:
                body = origin_response.read()

            # Pass the origin's response back to the original client
            self.send_response(200)
            self.send_header('Content-Type', 'text/plain')
            self.send_header('X-Served-By', 'TheCodeForge-ReverseProxy')  # Custom header
            self.end_headers()
            self.wfile.write(body)
            print(f"[REVERSE PROXY] Successfully relayed {len(body)} bytes back to client")

        except URLError as network_error:
            print(f"[REVERSE PROXY] Origin server unreachable: {network_error}")
            self.send_response(502)  # 502 Bad Gateway — classic reverse proxy error
            self.end_headers()
            self.wfile.write(b"502 Bad Gateway")

    def log_message(self, format, *args): pass

# ─────────────────────────────────────────────────
# 3. SPIN UP BOTH SERVERS IN BACKGROUND THREADS
# ─────────────────────────────────────────────────
def start_server(handler_class, port):
    server = HTTPServer(('127.0.0.1', port), handler_class)
    server.serve_forever()

origin_thread = threading.Thread(target=start_server, args=(OriginServerHandler, 9001), daemon=True)
proxy_thread  = threading.Thread(target=start_server, args=(ReverseProxyHandler,  9000), daemon=True)

origin_thread.start()
proxy_thread.start()
time.sleep(0.5)  # Give servers a moment to bind their ports

# ─────────────────────────────────────────────────
# 4. SIMULATE CLIENT REQUESTS (client talks to PROXY only)
# ─────────────────────────────────────────────────
print("=" * 55)
print("CLIENT: Requesting /api/users through the reverse proxy")
print("=" * 55)
with urlopen('http://127.0.0.1:9000/api/users', timeout=5) as resp:
    print(f"CLIENT received: {resp.read().decode()}")

time.sleep(0.2)

print("\n" + "=" * 55)
print("CLIENT: Attempting to access /admin (should be blocked)")
print("=" * 55)
try:
    urlopen('http://127.0.0.1:9000/admin', timeout=5)
except Exception as e:
    print(f"CLIENT received error (expected): HTTP 403")

time.sleep(0.2)
print("\nDemo complete.")

# Production-grade Nginx config that acts as both a reverse proxy AND
# an application-layer access control layer.
# This sits in front of a Node.js app running on port 3000 internally.

# --- Rate limiting zone: track clients by IP, 10MB memory, max 30 req/min ---
limit_req_zone $binary_remote_addr zone=api_rate_limit:10m rate=30r/m;

server {
    listen 443 ssl http2;
    server_name api.yourcorp.com;

    # TLS termination happens HERE — backend never handles raw TLS
    ssl_certificate     /etc/ssl/certs/yourcorp.crt;
    ssl_certificate_key /etc/ssl/private/yourcorp.key;
    ssl_protocols       TLSv1.2 TLSv1.3;  # Reject weak TLS 1.0 and 1.1

    # ── Block internal/admin paths from public internet ──────────────────────
    location ~ ^/(internal|metrics|health/debug) {
        # Only allow requests from the internal VPC CIDR range
        allow 10.0.0.0/8;
        deny  all;  # Everyone else gets 403 — firewall at the HTTP layer
    }

    # ── Public API — apply rate limiting ─────────────────────────────────────
    location /api/ {
        # Apply rate limit — burst of 10 requests allowed before throttling
        limit_req zone=api_rate_limit burst=10 nodelay;

        # THE CORE PROXY ACTION: forward to backend, hide backend's identity
        proxy_pass http://127.0.0.1:3000;

        # Tell the backend the REAL client IP (not Nginx's loopback address)
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Strip headers the backend might leak to clients
        proxy_hide_header X-Powered-By;  # Don't expose 'Express' or 'Node'
        proxy_hide_header Server;        # Don't expose backend server version

        # Timeout settings — don't let slow backends hold connections forever
        proxy_connect_timeout 5s;
        proxy_read_timeout    30s;
    }

    # ── Static assets — serve directly, never hit the backend ────────────────
    location /static/ {
        root /var/www/yourcorp;
        expires 30d;       # Cache for 30 days — no need to hit backend
        add_header Cache-Control "public, immutable";
    }

    # ── Redirect all HTTP to HTTPS at the server level ───────────────────────
    # (The firewall allows port 80 inbound only for this redirect)
}

server {
    listen 80;
    server_name api.yourcorp.com;
    return 301 https://$host$request_uri;  # Permanent redirect to HTTPS
}