Firewall
Also known as: network firewall
A gatekeeper that checks network traffic against rules and lets through only what is allowed.
Draft - this entry has not been reviewed yet.
Formal
A device or program placed between networks that inspects each packet - its IP addresses, ports and protocol - and allows or blocks it according to a set of rules. Most firewalls also track open connections, so replies to allowed traffic are let back in.
In plain English
Like a guard at the gate of a building with a list of who may come in and which doors they may use; anyone not on the list is turned away.
In practice
At a local water utility, the IT operations manager sets the firewall so the system that controls the pumps can be reached only from two computers in the control room; all traffic from the office network is blocked.
Why it matters
It is one of the oldest and most basic network controls, shrinking what an outsider can reach - but it cannot stop threats that come through allowed doors.
How to put it into practice
The usual steps, in order. Adapt them to your organisation.
- Draw a simple network map with the zones you have, such as internet, DMZ, office, servers, management and OT, and name an owner for the firewalls between them.
- Write a firewall policy that says traffic is denied by default in both directions, and that every allowed flow needs a business reason, an owner and an approval.
- Build the rule base from that policy, allowing only the specific source, destination, port and protocol each system needs, and add a clear deny-all rule at the end that logs what it blocks.
- Limit outbound traffic too, so servers can reach only the update and service addresses they need, and route web traffic from users through a filtering proxy or DNS filter.
- Turn on the host firewall on every laptop and server through central policy, blocking inbound traffic except the few services the device must offer.
- Put the firewall's own management interface on a separate management network with MFA, never on the internet, and patch the firewall as soon as security updates are released.
- Send firewall logs to central logging or a SIEM, and alert on blocked traffic from inside to known bad addresses and on changes to the rule base.
- Handle every rule change through change management with a ticket, and review the whole rule base at least once a year, removing rules that are unused, too broad or have no owner.
Common pitfalls
- Adding a "temporary" any-any rule to solve an urgent problem and never removing it again.
- Filtering only inbound traffic, so malware on the inside can freely call home and send data out.
- Exposing the firewall's VPN or management portal to the internet without patching it quickly, although such edge devices are a favourite target.
Good guides
- NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy(opens in a new tab) · NIST
- CIS Critical Security Control 4 - Secure Configuration of Enterprise Assets and Software(opens in a new tab) · Center for Internet Security
- Windows Firewall Overview(opens in a new tab) · Microsoft
- Køb antivirus og firewall(opens in a new tab) · Styrelsen for Samfundssikkerhed (in Danish)
Technical deep dive
Firewalls evolved in generations. The first were stateless packet filters in the late 1980s, typically access control lists on routers that judge each packet in isolation by its 5-tuple (protocol, source and destination address, source and destination port) and flags. Because they have no memory, letting replies back in requires broad rules such as "allow TCP with ACK set to high ports", which attackers can abuse. Stateful inspection, popularised by Check Point FireWall-1 in the mid-1990s, keeps a connection table: an outbound SYN creates an entry, and only packets matching a tracked flow in a valid TCP state are allowed back, while UDP and ICMP get pseudo-connections with idle timeouts. Linux implements this in netfilter's conntrack, configured through nftables or iptables. Application-level gateways (proxies) go further by terminating the connection and parsing the protocol, and next-generation firewalls (NGFW) add application identification, user identity, TLS inspection and IPS signatures.
A rule base is normally evaluated top-down with first-match semantics and an implicit deny at the end. Good practice, reflected in NIST SP 800-41 Rev. 1, is default deny with explicit, documented exceptions, and it applies to egress as much as ingress: unrestricted outbound traffic is what lets malware reach command-and-control servers and exfiltrate data. Anti-spoofing filters drop packets whose source addresses cannot legitimately arrive on an interface, such as private RFC 1918 addresses arriving from the internet (compare BCP 38). Common mistakes are shadowed rules that never match because a broader rule above them does, "temporary" any-any rules that become permanent, rules nobody can explain, and exposed management interfaces.
Network firewalls sit between zones and enforce network segmentation, whereas host-based firewalls (Windows Defender Firewall, nftables on a server) protect the individual machine and limit lateral movement even on a flat network; CIS Controls v8 Safeguards 4.4 and 4.5 require firewalls on servers and end-user devices respectively. In the cloud, the same ideas reappear as security groups (stateful, attached to instances) and network ACLs (stateless, attached to subnets) in AWS.
A firewall only decides whether a flow may exist; it does not judge what travels inside an allowed flow. Everything tunnelled over TCP 443 looks alike without TLS inspection, and a web application firewall or IPS is needed to catch SQL injection or exploit payloads on an open port. Firewalls are also targets themselves: edge devices from several major vendors have had critical, actively exploited vulnerabilities in their VPN and management components, for example CVE-2024-3400 in Palo Alto Networks PAN-OS in 2024. Auditing therefore covers the rule base (periodic recertification, rule-hit counts), the configuration against a hardening benchmark, and the patch level of the firewall's own software.
What to learn first
Everything this builds on, foundations first.
- Network
- →IP address
- →Protocol
- →Packet
- →Port
- →Firewall
Relationships
- A kind of
- Security control
- Requires
- PacketPortIP address
- Don't confuse with
- Intrusion prevention system (IPS)Human firewall
- Mitigates
- Data breach
Sources & further reading
Standards & official texts
- NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy
Textbooks
- Kurose & Ross, Computer Networking: A Top-Down Approach
Where this data comes from
This entry was drafted by an AI from the sources above and has not yet been checked by a person. Treat it as a starting point, and check anything important against the sources.
See the review queueSuggest a correction on GitHubThis term as JSON
Mentioned in
Check yourself
Loading…