A firewall is a control that allows or blocks network traffic according to rules about its source, destination, protocol and, in modern forms, its content and the application it belongs to.
Our take. A firewall is a necessary control and a poor security strategy. Most breaches now arrive through traffic the firewall was told to allow, a legitimate web request or an authenticated user, and a rule set that has only ever grown is a list of things somebody once needed rather than a policy. Review the rules as seriously as the appliance.
The first firewalls compared each packet against a list: this source address to that destination port, allow or deny. Stateful inspection improved on that by remembering connections, so that a reply to a request the inside had made was recognised as a reply rather than judged as a fresh inbound packet, which is what lets a rule set be short and still correct. Application-aware firewalls go further and identify what protocol or application a flow belongs to regardless of the port it uses, since a great deal of traffic now travels over the same web ports. Each generation reads more of the packet; none of them reads intent.
Kind
Decides on
Good at
Blind to
Packet filter
Addresses, ports, protocol
Simple, fast, everywhere
Anything past the header
Stateful firewall
The above plus connection state
Allowing replies without opening inbound holes
Content, and abuse of an allowed connection
Application-aware firewall
The application or protocol in the flow
Traffic that hides on standard ports
Legitimate use of a legitimate application
Web application firewall
The content of HTTP requests
Known attack patterns against a web application
A novel attack, and a valid request that does harm
Host firewall
Traffic to and from one machine
Limiting what a compromised neighbour can reach
Whatever the machine itself initiates
Rule sets only grow. Every project adds an allow; nobody removes one when the project ends. Review them on a schedule and delete what has no owner.
Default deny, then allow. A firewall that allows everything except a block list is a list of yesterday's problems.
Segment inside, not only at the edge. A firewall between the user network and the servers, and between servers of different sensitivity, limits how far a compromise travels.
Log the denies and read them. A denied connection from an internal host to somewhere it has never gone is often the first visible sign of a compromise.
Host firewalls count. The firewall on each server is the one control that still works after the network firewall has been passed.
In practice
A company's perimeter firewall has eleven hundred rules accumulated over nine years. A review finds rules allowing inbound access to servers decommissioned in the previous decade, a rule opening a database port to the whole internet added for a supplier's one-week engagement, and three rules nobody can explain. None of it caused an incident, and the database rule is exactly what an automated scanner would have found first. The cleanup halves the rule set, assigns an owner and an expiry to every remaining exception, and adds an internal firewall between the office network and the servers so that a compromised laptop cannot reach the database at all. The appliance did not change; the policy did.
A firewall decides whether traffic passes; intrusion detection watches the traffic that passed for signs of attack. One is a gate, the other is a camera, and a network needs both.
A VPN carries traffic through an encrypted tunnel; a firewall filters it. Traffic inside a tunnel is invisible to a firewall it passes through until it emerges at the other end.
Zero trust moves the access decision from network position to identity and policy, which demotes the firewall from gatekeeper to one filter among several. It does not remove it.
Key takeaways
→Stateful inspection lets rule sets be short; application awareness sees past the port; neither sees intent.
→Rule sets decay; review, delete and give every exception an owner and an expiry.
→Segment internally, log denies, and keep host firewalls on.
Certifications that test this
Vendor exams whose syllabus covers this concept — facts, cost and a preparation path on each page.
A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.
Get certified with Salesforce Data Cloud Consultant certification by practicing actual exam type questions. This Course…
Udemy
FAQ
Do I still need a firewall if I have moved to the cloud?
Yes, and it is called something else: security groups, network access control lists and cloud firewalls are the same idea applied to virtual networks. The default-deny and rule-review habits transfer directly, and the cloud makes the review easier because the rules are code.
What does a web application firewall protect against?
Known patterns of attack in web requests: injection strings, malformed input, requests that match published exploit signatures. It reduces noise and buys time. It does not protect against a logic flaw in the application or a valid request that does harm, and it does not replace fixing the code.
Is a firewall enough for a small business?
No, but it is a good start. Add multi-factor authentication on email and remote access, keep systems patched, and back up somewhere the network cannot reach. Those four controls stop most of what a small business actually faces; the firewall alone stops the least of it.
Sources
The primary text this definition rests on. Read it before you trust ours.
