On which layer of the OSI model does the packet filtering firewalls work?

Packet filtering firewalls operate primarily at the Network Layer (Layer 3) of the OSI model. They inspect the headers of incoming and outgoing packets and make decisions to allow or block traffic based on rules that use information such as source and destination IP addresses. They may also use information from the Transport Layer (Layer 4), such as TCP or UDP port numbers, but their fundamental operation is centered on the network-level addressing and routing information found in Layer 3.

B. Application Layer (Layer 7) is where proxy firewalls and Web Application Firewalls (WAFs) operate, inspecting the content of application traffic.
C. Session Layer (Layer 5) is the domain of circuit-level gateways, which monitor TCP handshakes to validate sessions.
D. Physical Layer (Layer 1) deals with the physical transmission of raw bits and has no concept of packets or addresses for a firewall to inspect.

1. National Institute of Standards and Technology (NIST). (2005). SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy. In Section 3.1, "Packet Filter," it states, "A packet filter is a firewall that operates at the network layer of the OSI model."

2. Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 8, "Security in Computer Networks," describes packet filtering as examining fields in the IP and TCP/UDP headers, corresponding to Layers 3 and 4.

3. Chapman, D. B., & Zwicky, E. D. (1995). Building Internet Firewalls. O'Reilly & Associates. Chapter 6, "Packet Filtering," details how these firewalls work with IP packet headers, which is a Layer 3 function.