A firewall is a network security device or program that monitors incoming and outgoing traffic and allows or blocks it according to a set of security rules.
How a firewall works
A firewall sits between networks of different trust levels – for example the internet and a company LAN – or runs on a single computer. Generations of the technology:
- packet filters (late 1980s) check addresses, ports and protocols of each packet;
- stateful firewalls (introduced commercially by Check Point in the 1990s) track connections and allow only responses to legitimate requests;
- next-generation firewalls (NGFW) identify applications and users, decrypt TLS and include an intrusion prevention system;
- web application firewalls (WAF) filter HTTP requests to websites and APIs.
Operating systems have built-in host firewalls, such as Windows Defender Firewall and nftables/iptables on Linux.
Why firewalls matter for security
Firewalls reduce the attack surface by hiding services that should not be reachable and segmenting internal networks to slow down lateral movement. But firewalls cannot stop attacks that come through allowed channels, like phishing emails or a legitimate VPN login with stolen credentials. Moreover, firewalls and VPN gateways are themselves prime targets: critical flaws in Fortinet, Palo Alto Networks, Cisco and Ivanti devices have repeatedly been exploited as zero-days by ransomware gangs and APT groups.
Best practices
- Use a default-deny policy and allow only what is needed; review rules regularly.
- Never expose the management interface to the internet; patch firmware promptly.
- Filter outbound traffic too, not only inbound.
- Send firewall logs to a SIEM for monitoring.
