What Is a Firewall and How Does It Protect Your Network?

What Is a Firewall?

A firewall is a Network Security) system — hardware, software, or a combination of both — that monitors and controls network traffic based on a set of predefined security rules. It acts as a barrier between trusted internal networks (like your corporate LAN) and untrusted external networks (like the internet).

The term comes from the physical concept of a firewall in construction — a barrier designed to stop a fire from spreading from one area to another. In networking, the "fire" is malicious traffic, and the firewall prevents it from reaching your systems.

What Firewalls Do

At a fundamental level, every firewall performs the same core function:

> Allow legitimate traffic through. Block everything that shouldn't be there.

To do this, firewalls examine packets and apply rules:

• "Allow traffic from the internal network to the internet on ports 80 and 443 (HTTP/HTTPS)."
• "Block all incoming traffic on port-the-internets-core-protocol)-and-UDP-ports-explained) 23 (Telnet) from external sources."
• "Allow SSH ([port-the-internets-core-protocol)-and-UDP-ports-explained) 22](/learning-center/what-is-a-port-tcp-and-udp-ports-explained)) only from specific trusted IP addresses."
• "Drop all traffic that doesn't match any allowed rule."

Types of Firewalls

1. Packet-Filtering Firewall (Stateless)

The simplest type. It inspects each packet-the-internets-core-protocol)-ip-the-internets-core-protocol) in isolation — checking source IP, destination IP, [port-ports-explained) numbers](/learning-center/what-is-tcp-ip-the-internets-core-protocol), and protocol (TCP/UDP). It has no memory of previous packets.

Advantages: Fast, low overhead. Disadvantages: Cannot detect attacks spread across multiple packets; vulnerable to IP spoofing.

2. Stateful Inspection Firewall

Tracks the state of active connections. It remembers which connections were initiated from inside the network and only allows return traffic for established sessions.

Advantages: Much more secure than stateless filtering; understands TCP-the-internets-core-protocol) handshake states. Disadvantages: Higher memory and processing requirements.

3. Next-Generation Firewall (NGFW)

The modern standard. An NGFW combines stateful inspection with:

• Deep packet-the-internets-core-protocol)-ip-the-internets-core-protocol) Inspection (DPI) — inspects payload content, not just headers
• Application awareness — identifies specific apps (YouTube, Skype, Tor) regardless of port-the-internets-core-protocol)-and-UDP-ports-explained)
• [intrusion prevention-intrusion-detection-and-prevention-explained)-and-ips-intrusion-detection-and-prevention-explained) system](/learning-center/what-is-ids-and-ips-intrusion-detection-and-prevention-explained) (IPS) — detects and blocks known attack signatures
• SSL-how-https-keeps-your-data-safe)/TLS inspection — decrypts encrypted traffic for inspection
• User identity tracking — applies policies per user, not just per IP

Popular NGFW vendors: Palo Alto Networks, Fortinet FortiGate, Cisco Firepower, Check Point.

4. Web Application Firewall (WAF)

A WAF specifically protects web applications by filtering HTTP/HTTPS traffic. It defends against:

• SQL injection — malicious SQL in web form inputs
• cross-site scripting-cross-site-scripting-explained) (XSS) — injected JavaScript in web pages
• CSRF attacks — tricking users into unwanted actions
• Path traversal — accessing unauthorized files on the web server

Firewall Placement

DMZ (Demilitarized Zone)

For organizations hosting public-facing servers, a DMZ places those servers in a separate network segment:

Internet → [Firewall 1] → DMZ (public servers) → [Firewall 2] → Internal LAN

The DMZ allows external users to reach public servers while keeping the internal network isolated.

Writing Effective Firewall Rules

Firewall rules are evaluated top-to-bottom. Best practices:

1. Default deny — start with a rule that blocks everything, then explicitly allow what is needed.
2. least privilege — allow only the specific ports and IPS required.
3. Be specific — avoid overly broad rules like "allow all traffic from the internet."
4. Log denied traffic — helps detect attacks and misconfigurations.
5. Review rules regularly — stale rules create unnecessary attack surface-cves-exploits-and-patch-management).

# iptables example — default deny with explicit allows
iptables -P INPUT DROP        # Default: drop all incoming
iptables -P FORWARD DROP      # Default: drop all forwarded
iptables -P OUTPUT ACCEPT     # Default: allow all outgoing

# Allow established connections back in
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow HTTPS from anywhere
iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow SSH only from trusted IP
iptables -A INPUT -p tcp --dport 22 -s 203.0.113.10 -j ACCEPT

Common Firewall Evasion Techniques

Understanding how attackers bypass firewalls is essential for defenders:

• port-the-internets-core-protocol)-and-UDP-ports-explained) hopping — switching between ports to avoid port-specific blocks
• Tunneling — wrapping blocked traffic inside allowed protocols (e.g., DNS tunneling, HTTP tunneling)
• Fragmentation attacks — breaking malicious packets into fragments that appear harmless individually
• SSL-how-https-keeps-your-data-safe)/TLS evasion — hiding attacks inside encrypted traffic (countered by SSL inspection)

Quick Recap

• A firewall filters network traffic based on rules to allow legitimate traffic and block threats.
• Types range from simple packet-the-internets-core-protocol)-ip-the-internets-core-protocol)-filtering to advanced NGFWs with DPI, IPS, and application awareness.
• WAFs specifically protect web applications from Layer 7 attacks like SQL injection and XSS.
• Proper firewall placement — including a DMZ for public servers — is critical to network architecture.
• Always apply a default-deny policy and grant least-privilege access.