Policy-based content filtering

A non-transitory computer-readable storage medium tangibly embodying instructions, which when executed by a firewall device, cause the firewall device to perform a method for processing application-level content, the method comprising:

• receiving an incoming network connection, at a networking subsystem of a firewall device, the incoming network connection being characterized by a source Internet Protocol (IP) address, a destination IP address and a network service protocol;
• determining, by the networking subsystem, the network service protocol of the incoming network connection;
• determining, by the networking subsystem, whether to allow or deny the incoming network connection by identifying a matching firewall policy from among a plurality of predefined firewall policies based on the source IP address, the destination IP address and the network service protocol and applying packet-layer firewall rules associated with the matching firewall policy;
• when the incoming network connection is allowed, then:
• redirecting the incoming network connection, by the networking subsystem, to a proxy module of a plurality of proxy modules within the firewall device that is configured to support the network service protocol;
• retrieving, by the proxy module, a content processing configuration scheme identified by the matching firewall policy, the content processing configuration scheme including a plurality of administrator-configurable content processing configuration settings, specifying whether a particular type of content filtering is to be performed, for each of a plurality of network service protocols;
• and
• processing, by the proxy module, application-level content spanning a plurality of packets of a packet stream associated with the incoming network connection by:
• reconstructing the application-level content, including extracting and buffering content from the plurality of packets;
• and
• filtering the application-level content based on those content processing configuration settings of the plurality of administrator-configurable content processing configuration settings applicable to the determined network service protocol.