Short answer: A firewall is a network security device or software that monitors incoming and outgoing traffic and allows or blocks it based on a set of security rules. It acts as a barrier between a trusted internal network and untrusted external networks like the internet, filtering out malicious or unauthorized connections.
Firewalls are one of the oldest and most essential controls in cyber security. Whether it is the built-in firewall on your laptop or a rack-mounted appliance guarding a corporate data centre, the goal is the same: decide what traffic is permitted and stop everything else. This guide explains what a firewall is, how it works, the main types, and where firewalls fall short.
What is a firewall?
A firewall inspects data packets travelling between networks and compares them against a rule set (an access control list). If a packet matches an allow rule it passes; if it matches a deny rule, or matches nothing, it is dropped. Firewalls filter based on attributes such as source and destination IP address, port number, and protocol - and modern firewalls also inspect the application and content.
How a firewall works
Firewalls have evolved through several generations, each inspecting traffic more deeply than the last.
1. Packet filtering
The earliest firewalls check each packet's header - source/destination IP, port and protocol - against static rules. They are fast but stateless: they do not remember previous packets, so they cannot tell a legitimate reply from a crafted one.
2. Stateful inspection
Stateful firewalls track the state of active connections in a table. They understand that a returning packet belongs to a session your machine started, making filtering far more accurate and secure than simple packet filtering.
3. Proxy firewalls (application gateways)
A proxy firewall sits between client and server and makes the connection on the client's behalf. Because it terminates and rebuilds the traffic, it can inspect the full application-layer content and hide internal addresses, at the cost of some speed.
4. Next-generation firewalls (NGFW)
NGFWs combine stateful inspection with deep packet inspection, intrusion prevention (IPS), application awareness, TLS inspection and threat-intelligence feeds. They can block traffic based on the actual application (for example, blocking a specific app rather than just a port).
Types of firewalls compared
| Firewall type | Inspects | Strength | Best for |
|---|---|---|---|
| Packet filtering | Packet headers only | Very fast, low cost | Basic routing/edge filtering |
| Stateful inspection | Connection state + headers | Accurate session tracking | General business networks |
| Proxy / application gateway | Full application content | Deep content control, address hiding | High-security web/email gateways |
| Next-generation (NGFW) | App, user, content + IPS | Advanced threat prevention | Modern enterprises |
| Cloud / FWaaS | Distributed cloud traffic | Scalable, managed | Cloud and hybrid environments |
Hardware vs software firewalls
A hardware firewall is a physical appliance placed at the network perimeter that protects every device behind it - ideal for offices and data centres. A software firewall (also called a host-based firewall) runs on an individual computer or server, such as Windows Defender Firewall or Linux iptables/nftables, and protects only that host. Most organisations use both together in a layered defence.
Uses at home and in business
- Home: your Wi-Fi router includes a firewall that blocks unsolicited inbound connections and hides your devices behind NAT.
- Business: firewalls segment networks, enforce policy, block known-malicious IPs, filter web content, and log traffic for compliance.
- Cloud: security groups and firewall-as-a-service protect virtual machines and containers.
- Compliance: standards like PCI-DSS and ISO 27001 require documented firewall controls.
The DMZ and firewall placement
In business networks, firewalls do more than sit at the edge. A common design uses a DMZ (demilitarised zone) - a separate network segment for public-facing servers such as web and email servers. The firewall allows the internet to reach the DMZ but tightly restricts what the DMZ can reach on the internal network. If a public server is compromised, the attacker is still walled off from sensitive internal systems.
Modern architectures also use internal segmentation, placing firewalls between departments or between user and server zones. This limits lateral movement - the technique attackers use to spread from one compromised machine to the rest of the network - and is a cornerstone of zero-trust design.
Common ports firewalls manage
Firewall rules frequently reference port numbers, so it helps to know the common ones.
| Port | Service | Typical policy |
|---|---|---|
| 80 / 443 | HTTP / HTTPS (web) | Usually allowed outbound |
| 22 | SSH (remote admin) | Restricted to known IPs |
| 25 / 587 | SMTP (email) | Controlled to stop spam |
| 53 | DNS | Allowed to trusted resolvers |
| 3389 | RDP (remote desktop) | Blocked from internet, VPN only |
A well-known best practice is default deny: block everything, then explicitly allow only the traffic the business needs. This is far safer than allowing everything and blocking known-bad, because it protects against threats you have not thought of yet.
Firewall rule best practices
- Follow the principle of least privilege - open only the ports and destinations that are genuinely required.
- Never expose remote-desktop or database ports directly to the internet; put them behind a VPN.
- Review and clean up rules regularly - old, forgotten rules are a common weakness.
- Enable and monitor logging so you can detect and investigate suspicious activity.
- Keep firmware and firewall software patched to close known vulnerabilities.
Limitations of firewalls
A firewall is essential but not a complete solution. It cannot:
- Stop threats that arrive through allowed channels, such as phishing emails or malicious downloads over permitted HTTPS.
- Protect against insider threats or stolen credentials.
- Detect malware already inside the network without extra tools.
- Replace endpoint protection, patching, and user awareness training.
That is why firewalls work best as one layer in defence-in-depth, alongside a VPN for secure remote access and encryption to protect the data itself. A modern security stack pairs the firewall with endpoint detection and response, email filtering, regular patching, multi-factor authentication and, crucially, user awareness training - because attackers increasingly target people rather than ports. Thinking of the firewall as one wall in a much larger castle, rather than the whole castle, is the mindset that keeps organisations safe.
Checking the firewall you already have
Most people already run a software firewall without realising it. On Windows, the built-in Windows Defender Firewall is enabled by default and can be managed from Settings; you can create rules to allow or block specific apps. On macOS, the application firewall is found under System Settings, Network. On Linux, tools like ufw (uncomplicated firewall), iptables or the newer nftables control the host firewall - for example sudo ufw enable turns it on and sudo ufw status shows the current rules. Keeping these enabled is a free, effective baseline for every device.
Firewall vs IDS vs IPS
Firewalls are often confused with intrusion detection and prevention systems, but they play different roles. A firewall decides whether traffic is allowed based on rules. An IDS (Intrusion Detection System) passively watches traffic and raises an alert when it spots suspicious patterns. An IPS (Intrusion Prevention System) goes further and actively blocks the malicious traffic it detects. Next-generation firewalls typically bundle IPS capability, which is why they can stop attacks that a basic firewall would wave through as long as the port was open.
A brief history of firewalls
The concept dates to the late 1980s, when the first packet-filtering firewalls simply checked addresses and ports. Stateful inspection arrived in the early 1990s, adding awareness of connections. Application-layer proxies followed, and in the late 2000s next-generation firewalls merged deep inspection, application control and intrusion prevention. Today, cloud-delivered firewall-as-a-service and identity-aware controls extend the same core idea - allow the good, block the rest - to distributed, cloud-first environments.
How to choose a firewall
- For home users: the firewall built into your router and operating system is usually enough - just keep them enabled and updated.
- For small businesses: a dedicated stateful or entry-level NGFW appliance provides logging, content filtering and VPN support.
- For enterprises: a full NGFW or cloud firewall with IPS, application control and centralised management is appropriate.
- Consider throughput (can it handle your bandwidth), management ease, logging, and vendor support before buying.
Learn network security properly
Configuring firewalls, reading logs and building secure network architectures are core skills in any security career. Our cyber security courses at Cyber Defence, Hisar cover firewalls, network defence and hands-on labs, and complement our foundational guide on what is cyber security.
Cyber Defence is ISO-certified and GeM-registered, founded by Amit Kumar (CEH, CRTA). The cyber security course is Rs 15,000 (3-4 months) and the full ethical hacking program is Rs 60,000 (6 months).
FAQ
What is a firewall in simple words?
A firewall is a security guard for your network. It checks all traffic coming in and going out and only lets through what your rules allow, blocking everything suspicious.
Is a firewall hardware or software?
It can be either. Hardware firewalls are physical appliances protecting a whole network, while software firewalls run on a single device. Many setups use both.
Do I still need antivirus if I have a firewall?
Yes. A firewall controls network traffic, but antivirus and endpoint protection detect malware on the device itself. They protect against different threats.
What is the difference between a firewall and a VPN?
A firewall filters and blocks traffic based on rules, while a VPN encrypts your connection and routes it through a secure tunnel. They serve different, complementary purposes.
What is a next-generation firewall (NGFW)?
An NGFW adds application awareness, intrusion prevention and deep packet inspection to traditional stateful filtering, allowing far more granular threat control.
Can a firewall stop all cyber attacks?
No. Firewalls cannot stop phishing, insider threats or malware that arrives through allowed channels. They are one important layer among many.
Want to master network defence and firewall configuration? Call Cyber Defence, Hisar at +91-75175-72000 to join our next batch.