Network Transparency - Firewalls

Firewalls

Transparency in firewall technology can be defined at the networking (IP or Internet layer) or at the application layer.

Transparency at the IP layer means the client targets the real IP address of the server. If a connection is non-transparent, then the client targets an intermediate host (address), which could be a proxy or a caching server. IP layer transparency could be also defined from the point of server's view. If the connection is transparent, the server sees the real client IP. If it is non-transparent, the server sees the IP of the intermediate host.

Transparency at the application layer means the client application uses the protocol in a different way. An example of a transparent HTTP request for a server:

GET / HTTP/1.1
Host: example.org
Connection: Keep-Alive

An example non-transparent HTTP request for a proxy (cache):

GET http://foo.bar/ HTTP/1.1
Proxy-Connection: Keep-Alive

Application layer transparency is symmetric when the same working mode is used on both the sides. The transparency is asymmetric when the firewall (usually a proxy) converts server type requests to proxy type or vice versa.

Transparency at the IP layer does not mean automatically application layer transparency.