Network Security What Is a Firewall

A firewall is a security system that monitors and controls the flow of network traffic based on a defined set of rules. It sits between a trusted network and an untrusted one — like a security guard at the entrance of a building who checks every person trying to enter and decides who gets in.

The Firewall as a Security Checkpoint

INTERNET (untrusted)
        │
   [ FIREWALL ]  ← checks every packet against rules
        │
  INTERNAL NETWORK (trusted)
  ┌─────────────────────┐
  │  Servers, PCs,      │
  │  Printers, Phones   │
  └─────────────────────┘

Without a firewall, every device on the internal network is directly reachable from the internet. Attackers scan the internet constantly looking for exposed devices. A firewall stops most of this traffic before it reaches any system worth protecting.

How a Firewall Makes Decisions

A firewall examines each packet and compares it to a list of rules. Rules check things like the source IP address, destination IP address, port number, protocol, and direction of traffic. The firewall then takes one of three actions:

ALLOW:  Let the packet through to the destination
DENY:   Silently drop the packet (sender gets no response)
REJECT: Drop the packet and send an error back to sender

Most firewalls default to deny all and then add explicit allow rules for traffic that should pass. This approach is safer than allowing everything and trying to block specific bad traffic.

Stateful vs Stateless Firewalls

Stateless Firewall

A stateless firewall looks at each packet in isolation without remembering previous packets. It is fast but limited. An attacker can craft packets that individually look innocent but together form an attack.

Stateless Firewall checks:
Packet 1: Source=1.2.3.4, Port=80 → ALLOW (rule says allow port 80)
Packet 2: Source=1.2.3.4, Port=80 → ALLOW (same rule, same result)

It does NOT know whether these packets belong to an established session.

Stateful Firewall

A stateful firewall tracks active connections in a table. It knows whether an incoming packet is part of an established, legitimate session or an unsolicited packet arriving out of nowhere.

Connection Table:
Source IP   | Dest IP      | Sport | Dport | State
------------|--------------|-------|-------|-------------
192.168.1.5 | 203.0.113.10 | 51234 | 443   | ESTABLISHED
192.168.1.7 | 8.8.8.8      | 43210 | 53    | ESTABLISHED

New packet from 5.6.7.8 claiming to be a response?
→ Not in table → DROP (unsolicited, suspicious)

What a Firewall Protects Against

Threat                        | How Firewall Helps
------------------------------|----------------------------------------------
Port scans                    | Denies access to closed ports
Unauthorized access attempts  | Blocks traffic to protected systems
Known malicious IP addresses  | IP blocklist rules drop packets
Unencrypted protocols         | Rules can block plain HTTP, Telnet
Outbound data exfiltration    | Egress rules block unusual outbound traffic

What a Firewall Cannot Do Alone

A firewall is not a complete security solution. It has blind spots:

Limitation                     | What Handles It Instead
-------------------------------|-----------------------------------
Encrypted malware in HTTPS     | SSL inspection / web proxy
Attacks from trusted insiders  | DLP, user monitoring, SIEM
Phishing via email             | Email security gateway
Social engineering attacks     | Security awareness training
Zero-day exploits              | IPS, sandboxing, patching
Malware already inside network | Endpoint detection and response

Where Firewalls Sit in a Network

Perimeter Firewall

Sits between the internet and the entire organization. Blocks external attacks. The most common firewall deployment.

Internal Firewall

Sits between different internal segments. Prevents lateral movement — if an attacker compromises one segment, an internal firewall stops them from freely accessing other segments.

Host-Based Firewall

Software running directly on an individual device. Windows and macOS both include built-in host firewalls. A host firewall protects the device even when it is outside the corporate network — on public Wi-Fi, for example.

INTERNET
    │
[Perimeter Firewall]
    │
[DMZ: Web Server, Email Server]
    │
[Internal Firewall]
    │
  ┌─────────────────────────────┐
  │  VLAN 1         VLAN 2      │
  │  HR Systems     IT Systems  │
  │  [PC] [PC]      [Server]    │
  │    │               │        │
  │ [Host FW]       [Host FW]   │
  └─────────────────────────────┘

Using firewalls at multiple layers means an attacker who bypasses one layer still faces additional barriers before reaching critical data. Defense in depth through layered firewall deployment is a core principle of modern network architecture.