Firewall Definition
Intermediate – Computing
What Is a Firewall? Definition, Types, and How It Works
A firewall is a network security component designed to protect computer networks from unauthorized access. It acts as a safety barrier between a trusted private network and the untrusted public Internet, controlling what traffic is allowed to pass in either direction.
What Is the Purpose of a Firewall
The purpose of a firewall is to safeguard your computer. A firewall blocks unauthorized access and unwanted Internet traffic by filtering the information that comes through the Internet and permitting only the desired traffic into the private network.
It protects your network from hackers and malicious traffic that may try to penetrate your private network to cause harm such as spreading computer viruses and stealing your data.
What a firewall protects against:
- Unauthorized remote access attempts
- Malware and virus-laden traffic
- Port scanning and network reconnaissance
- Data exfiltration from inside the network
- Denial-of-service (DoS) attacks
How Does a Firewall Work?
Now that you know the firewall definition, let’s see how it works. It starts by filtering the incoming and outgoing network data based on a predefined set of rules which is called an access control list.
The Firewall Filtering Process
- Traffic arrives at the firewall from the Internet or internal network.
- The firewall checks the traffic against the access control list.
- Rules are applied based on criteria such as IP address, port number, protocol, or destination.
- The firewall either permits the traffic through or drops it entirely.
Firewall vs Antivirus
Firewalls and antivirus software are equally important complementary security tools. Practically, a firewall acts as a network barrier that blocks unauthorized traffic, while the antivirus software scans for and removes malicious software what gets through via other vectors.Together, they provide both external perimeter defense and internal endpoint protection.
| Firewall | Antivirus | |
| Primary function | Controls network traffic | Detects and removes malware |
| Where it operates | Network perimeter | Inside the OS |
| What it blocks | Unauthorized connections | Malicious files and processes |
| Limitation | Cannot scan files on the device | Cannot block network intrusions |
Types of Firewalls
Firewalls can be classified based on their deployment model and filtering method.
Types of Firewalls By Deployment Model
- Host-Based Firewall: Software installed on a single device. Protects only that machine. Windows Defender Firewall is a common example.
- Network-Based Firewall: Hardware and software deployed at the network perimeter. Protects every device on the network. The standard for business environments.
Types of Firewalls By Filtering Method
- Packet Filtering Firewall: Inspects packet headers (IP, port, protocol) against the ACL. Fast and lightweight, but no awareness of connection state or content.
- Stateful Inspection Firewall: Tracks the state of active connections. Knows whether a packet belongs to an established session or is a suspicious new request – significantly more secure than packet filtering alone.
- Proxy Firewall (Application-Level Gateway): Acts as an intermediary between user and destination. Traffic is fully inspected at the application layer. External networks never connect directly to internal systems.
- Circuit-Level Gateway: Validates TCP handshakes without inspecting packet content. Confirms a connection is legitimate before allowing it, but offers minimal protection against threats inside the payload.
- Next-Generation Firewall (NGFW): The current enterprise standard. Combines deep packet inspection (DPI), intrusion prevention (IPS), malware filtering, application awareness, and cloud threat intelligence. Can inspect encrypted traffic.
- Cloud Firewall (Firewall-as-a-Service) : Deployed in the cloud. Scalable, easy to update, and ideal for hybrid or fully cloud-based infrastructure.
What a Firewall Cannot Do
A firewall is your network gatekeeper, but there are threats that bypass the network perimeter, such as:
- Insider threats: A firewall monitors external traffic. Employees operating inside the network bypass it entirely.
- Social engineering: Phishing targets users, not ports. A firewall cannot stop someone from clicking a malicious link.
- Zero-day exploits: Firewalls counter known threats. A new, unrecognized vulnerability passes through undetected.
- Encrypted malicious traffic: Basic firewalls cannot inspect HTTPS traffic. Only NGFWs with DPI can address this.
- Misconfiguration: Overly permissive rules or outdated policies create exploitable gaps.
