16.2 Firewalls

Understanding Firewalls in Networks

Firewalls are one of the most visible and important tools used to enforce network security. Within the broader topic of network security, firewalls focus on controlling which traffic is allowed to enter or leave a network or device, based on a set of rules. They act as a gatekeeper, sitting between different parts of a network and deciding what can pass and what must be blocked.

This chapter concentrates on what makes firewalls unique, how they work at a basic level, and the main types you will encounter. Other security topics such as VPNs, IDS/IPS, or Zero Trust are covered separately, so here we keep the focus on the firewall itself.

The Core Idea of a Firewall

A firewall is a system that inspects network traffic and makes a decision to allow or block it. It does this by comparing each packet or flow to a set of predefined security rules.

You can imagine a firewall as a security guard at a door. Every time someone tries to pass, the guard checks a list: who they are, where they are coming from, and what they want to do. Based on that list, the guard either lets them in, sends them out, or refuses them.

On a network, the “who” and “what” are things like IP addresses, ports, and protocols, and the “list” is the firewall rule set.

Placement and Basic Roles

A firewall is almost always placed at a boundary. That boundary might be between:

At each boundary, a firewall has two main roles. First, it separates “trusted” and “less trusted” zones, for example, an internal LAN and the public internet. Second, it enforces the security policy that defines which traffic is acceptable between those zones.

It is common to see multiple firewalls in a network, for example one at the internet edge, and another between critical servers and the rest of the internal network. Each one enforces a different part of the security policy.

Packet Filtering and Basic ACL Style Rules

The most fundamental behavior of a firewall is packet filtering. In packet filtering, the firewall examines information that appears in packet headers and chooses whether to allow or drop the traffic based on rules. These rules are similar in idea to Access Control Lists, which you will see in a separate chapter, but on a firewall they are usually more central and more extensive.

A simple packet filter might look at:

Rules are checked in order until a match is found, and then the matching rule’s action is taken.

This implicit deny is what makes firewalls good at enforcing a “default deny” security posture. You explicitly open only what you want.

Stateless vs Stateful Firewalls

A key distinction between types of firewalls is whether they track the state of connections.

A stateless firewall only examines each packet independently. It does not remember earlier packets or the context of a connection. It simply applies rules to the packet’s header fields. Stateless filtering is fast and simple, but it cannot easily distinguish between legitimate responses and malicious packets that are disguised.

A stateful firewall keeps track of active connections in a state table. When a client begins a connection to a server, the firewall records this as a session. Subsequent packets that belong to this session are allowed through automatically, even if the rule set only explicitly allows the initial direction.

For example, if a user on the inside network starts a web connection to a site on the internet, a stateful firewall can allow the response packets back in, even though they are coming from the outside to the inside, because they are part of an established session.

This leads to a common rule structure:

Most modern network firewalls used in enterprises are stateful. Stateless filtering is more commonly seen in simpler devices or at extremely high-speed transit points.

Network vs Host-Based Firewalls

Firewalls come in different forms depending on where they run and what they protect. Two of the most important categories are network firewalls and host-based firewalls.

A network firewall is usually a dedicated device or a virtual appliance that sits on the network path between segments. It protects many devices at once by controlling traffic that passes through it. Internet edge firewalls and internal segmentation firewalls belong to this category.

A host-based firewall runs directly on an individual computer or server. It only controls traffic to and from that host. Examples include the built-in firewall on Windows, Linux iptables or nftables, and host security agents provided by antivirus vendors.

These two categories are often used together. A network firewall might enforce broad policies such as “no direct access from the internet to internal databases,” while a host-based firewall on a server might restrict which internal IPs can reach its database port.

Zones, DMZs, and Segmentation

A firewall becomes more powerful when traffic is grouped into different zones. A zone is a collection of interfaces or subnets that share a security level. The firewall defines which zones exist and what traffic is allowed between them.

Common zones include an “inside” zone for internal users, an “outside” zone for the public internet, and sometimes a “DMZ” for public-facing servers such as web and mail servers.

A DMZ, or demilitarized zone, sits between the internal network and the internet. Public services are placed in the DMZ so that internet users can reach them, but these DMZ systems have very limited access to the internal network. The firewall enforces rules such as “internet users can reach the web server in the DMZ on HTTP and HTTPS only” and “the web server in the DMZ can reach the internal database only on a specific port.”

This way, if an attacker compromises a public server in the DMZ, the firewall still limits how far the attacker can move toward critical internal systems. This is a practical example of network segmentation, where the firewall is the main enforcement device.

Application-Aware and Next-Generation Firewalls

Traditional firewalls primarily inspect packet headers and possibly TCP or UDP ports. However, many modern applications share ports, encapsulate other protocols, or use encryption. Because of this, firewalls evolved to become more application aware.

An application-aware or next-generation firewall goes beyond simple header inspection. It can:

Identify applications based on traffic patterns and payload details, not just port numbers.

Apply policies per application, such as “allow web browsing but block file-sharing applications.”

Combine firewall features with intrusion prevention, user identity integration, and URL filtering.

In an application-aware firewall, a rule might say “allow HTTPS for business applications but block HTTPS connections that are classified as social media during work hours.” The firewall inspects the traffic deeply enough to make that distinction, sometimes by analyzing protocol behavior or even decrypting and inspecting encrypted sessions, depending on configuration and policy.

While the underlying concept of permit or deny remains, the decision is now based on much richer information about what the traffic actually represents at the application layer.

Basic Firewall Policies and Rule Design

At a high level, a firewall policy is the set of rules that defines which communication is allowed between which parties, under which conditions. Rule design is critical, because a misconfigured firewall can either block legitimate work or allow dangerous access.

A simple rule statement, in concept, might be:

“Allow internal users in subnet 192.168.10.0/24 to access web servers on the internet over TCP port 80 and 443. Block all other outbound traffic from this subnet.”

In implementation, this is typically broken into ordered rules that specify source, destination, protocol, port, and action. The firewall reads these rules top to bottom and applies the first match.

There are two general strategies:

Permit by exception, where the default is “allow,” and you add “deny” rules for unwanted traffic.

Deny by default, where the default is “deny,” and you explicitly “allow” only the traffic that is required.

For security, deny by default is strongly preferred, and this is where the implicit deny at the end of a rule set becomes important.

In addition, rules are often organized to group similar logic together, such as rules for outbound web traffic, rules for VPN traffic, rules for management access, and so on. This helps with clarity, especially when rule sets grow large.

Logging, Monitoring, and Alerting

Another important function of a firewall is logging. When the firewall allows or blocks traffic, it can record details about the event. These logs can show source and destination addresses, ports, time, and which rule was applied. They are essential for troubleshooting and for detecting suspicious behavior.

Firewall logs are often sent to a central logging system or a security information and event management platform for long term storage and analysis. Administrators can then run queries such as “show all blocked connections from this external IP address” or “find new denied traffic patterns in the last hour.”

Firewalls can also generate alerts when they see events that match predefined conditions. For example, they might raise an alert if they detect many denied connection attempts from a single external IP to many different internal ports, which can indicate a port scan.

While logging does not block attacks on its own, it provides visibility. Without it, a firewall would silently accept or drop traffic and leave administrators blind to what is happening at the network boundary.

Limitations and Misconceptions

Although firewalls are essential, it is important to understand what they cannot do. A firewall cannot fix insecure software on a host. It cannot stop an employee from emailing data if that is allowed traffic. It cannot prevent all attacks that use allowed channels. For example, if outbound HTTPS to the internet is permitted and an attacker controls a remote server, malware might use that channel to communicate.

Firewalls also can be bypassed if traffic does not pass through them, for example in direct wireless access to devices or if a new path is created around the firewall. Good network design ensures that all relevant traffic flows through the appropriate firewalls.

Another limitation lies in encrypted traffic. Without additional configuration, a firewall that only sees encrypted payloads cannot inspect the content. It may still enforce policies based on IPs, ports, and domains, but content level inspection is limited. Some next-generation firewalls include capabilities to decrypt and inspect certain encrypted flows, but this introduces complexity and privacy considerations, and is a separate topic.

Finally, a firewall requires ongoing management. Rules that were correct years ago may no longer be appropriate as business requirements change. If rules are never removed, the rule set can become bloated and confusing, which can introduce mistakes.

The Role of Firewalls in a Security Strategy

Within the broader context of network security, a firewall is one layer of defense. It implements boundary protection and network segmentation, and it reduces the attack surface by closing unnecessary paths between zones.

In combination with access control lists, intrusion detection and prevention systems, VPNs, and host security measures, a firewall helps form a defense in depth strategy. The firewall’s specific strength is in enforcing which paths exist and what kind of traffic can traverse them.

Used correctly, firewalls separate critical assets from less trusted networks, limit the spread of attacks, and provide valuable visibility into attempted and successful connections. They are not a complete solution by themselves, but they are a foundational component of almost every modern network security design.