A firewall is a security control that enforces an access policy on network traffic, allowing or blocking each connection between network zones or hosts according to an ordered rule set. It can be a dedicated appliance, software on a host, a virtual instance or a cloud service, and its purpose is to ensure that only explicitly permitted communication crosses a boundary.
In infrastructure defense, the firewall is the oldest and still the most fundamental layer of network segmentation. It decides who may talk to whom and over which protocol, while neighboring controls such as IDS, IPS, WAF and EDR inspect what happens inside the permitted traffic or on the endpoints themselves.
How a firewall evaluates traffic
A firewall compares each packet or connection against its rules, normally top to bottom with first match wins, and applies the action of the first matching rule. A classic rule matches the 5-tuple: source address, destination address, source port, destination port and protocol. If no rule matches, a final implicit default deny drops the traffic.
Modern firewalls are stateful. When a permitted connection opens, the firewall records it in a connection table with addresses, ports, protocol state and an idle timeout, and it then admits return packets that belong to that entry without a separate rule. Packets that claim to belong to a nonexistent session, such as an unsolicited TCP ACK, are dropped, which defeats many scanning and spoofing techniques that fool stateless filters.
Beyond allow and deny, firewalls commonly perform network address translation (NAT), log decisions for later analysis and terminate VPN tunnels. Logging every denied and permitted connection at the boundary is one of the most valuable data sources for a SIEM.
Types of firewalls
Firewall technology has evolved from simple packet filters to devices that understand applications and users. The generations still coexist, because each fits a different placement and performance budget.
| Type | Inspection depth | Strength | Main limitation |
|---|---|---|---|
| Stateless packet filter | Layer 3 and 4 headers per packet | Very fast, simple router ACLs | No session awareness; easy to bypass |
| Stateful firewall | Headers plus connection state | Blocks out-of-state packets | Cannot tell applications on the same port apart |
| Application proxy | Full protocol at layer 7 | Breaks the direct connection; deep control | Per-protocol support and higher latency |
| Next-generation firewall (NGFW) | Application, user identity and threat signatures | Policy by application and user | Throughput drops with full inspection enabled |
| Host-based firewall | Traffic of one operating system | Controls lateral movement per host | Disabled if the host is compromised |
| Cloud firewall | Virtual network traffic | Scales with cloud workloads | Rules spread across many accounts and services |
Cloud platforms often provide two layers at once: stateful security groups attached to instances and stateless network ACLs on subnets. Confusing the two is a frequent cause of broken return traffic, because a stateless ACL needs explicit rules for ephemeral response ports.
Firewall compared with related defenses
A firewall controls whether a connection is allowed, while most neighboring controls examine the content or behavior of traffic and systems. The table shows how the responsibilities divide.
| Control | Primary question | Position | Typical action |
|---|---|---|---|
| Firewall | Is this connection permitted? | Between zones or on a host | Allow, deny, log, translate |
| WAF | Is this HTTP request malicious? | In front of web applications | Block injection and abuse patterns |
| IDS | Does this traffic match an attack? | Passive copy of traffic | Alert only |
| IPS | Does this traffic match an attack? | Inline in the traffic path | Drop or reset the session |
| EDR | Is this process behaving maliciously? | On endpoints | Kill, isolate, collect telemetry |
| SIEM | What do all logs reveal together? | Central log platform | Correlate and raise incidents |
| DDoS mitigation | Is this traffic volume an attack? | Upstream or at the edge | Absorb and scrub floods |
An NGFW often bundles IPS and URL filtering, which blurs the lines in product terms, but the functions remain distinct. A firewall in particular is not a DDoS defense: a volumetric attack can saturate the uplink, or exhaust the connection table, before the firewall makes any decision.
Designing a firewall rule set
Good rule design follows least privilege: begin from default deny, permit only documented business flows, and make every rule as specific as possible in source, destination and service. Each rule should carry an owner, a justification and a review date.
The example policy below protects a small DMZ web tier and shows the typical order from specific permits to a logged final deny.
| Rule | Source | Destination | Service | Action |
|---|---|---|---|---|
| 1 | Any internet address | Web servers in DMZ | TCP 443 | Allow |
| 2 | Web servers in DMZ | Database server | TCP 5432 | Allow |
| 3 | Admin jump host | DMZ servers | TCP 22 | Allow and log |
| 4 | DMZ servers | Internal network | Any | Deny and log |
| 5 | Any | Any | Any | Deny and log |
Egress filtering is as important as inbound control. A server that may only reach its update repository and its database cannot easily download attack tools or send stolen data to an attacker’s server, which turns many intrusions into contained incidents.
Common firewall mistakes and their fixes
Firewall failures are rarely caused by the product itself. They come from policy drift, overly broad rules and unmonitored exceptions that accumulate over years of change requests.
| Mistake | Consequence | Fix |
|---|---|---|
| Any-any rules | Segmentation exists only on paper | Replace with specific source, destination and port |
| Shadowed rules | A broad earlier rule hides later ones | Run rule analysis and reorder or remove |
| No egress control | Free outbound access for malware | Restrict outbound traffic to required destinations |
| Exposed management interface | Firewall itself becomes the target | Limit administration to a management network |
| Unpatched firmware | Edge device exploited directly | Patch edge devices as critical systems |
| Rules without owners | Nobody dares to delete stale access | Require owner and expiry on every rule |
Internet-facing firewalls and VPN gateways have become high-value targets in their own right, so their vulnerabilities deserve the shortest patch deadlines in the organization.
Put simply
A firewall is a guarded gate between networks. Every connection that tries to pass is compared with a list of who is allowed to go where, and anything not on the list is turned away.
A modern firewall also remembers who left through the gate, so replies to those visitors are let back in automatically. It does not check what visitors carry in their bags, which is the job of other security tools, but without the gate everything else is wide open.
In practice
A mid-sized manufacturer runs its office computers and its production machines on separate network zones. An internal firewall between them permits only one flow: a data historian server in the office zone may collect machine data from the production zone over OPC UA on TCP port 4840. Everything else, including Windows file sharing on port 445 and remote desktop on port 3389, is denied and logged.
When a phishing email infects an office laptop with ransomware, the malware spreads through file shares across the office zone and encrypts dozens of workstations. Its attempts to reach production systems hit the deny rule, and the firewall logs give the response team an exact timeline of the scanning.
Office work stops for two days while the IT team restores systems from backup, but production lines keep running throughout, because the firewall rule set had made the factory floor unreachable from the infected zone.