Editing Application firewall (section)

=== Network-based application firewalls ===
{{see also|Web application firewall}}

Network-based application firewalls operate at the application layer of a [[protocol stack| TCP/IP stack]]<ref>{{cite book|title=The Weakest Security Link Series|edition=1st|url=https://books.google.com/books?id=Yz34zXV7VB8C&q=application+layer+firewall&pg=PA54|author=Luis F. Medina|year=2003|page=54|isbn=978-0-595-26494-0|publisher=IUniverse}}</ref> and can understand certain applications and protocols such as [[File Transfer Protocol]] (FTP), [[Domain Name System]] (DNS), or [[Hypertext Transfer Protocol]] (HTTP). This allows it to identify unwanted applications or services using a non standard port or detect if an allowed protocol is being abused.<ref>{{Cite web|title=What is Layer 7? How Layer 7 of the Internet Works| url=https://www.cloudflare.com/learning/ddos/what-is-layer-7/ | access-date=Aug 29, 2020| website=Cloudflare}}</ref>

Modern versions of network-based application firewalls can include the following technologies:
*[[TLS acceleration| Encryption offloading ]]
*[[Intrusion prevention system]]
*[[Data loss prevention]]

Web application firewalls (WAF) are a specialized version of a network-based appliance that acts as a [[reverse proxy]], inspecting traffic before being forwarded to an associated server.