Cyber Security Firewalls

A firewall controls what traffic is allowed to cross the boundary between networks, using techniques ranging from simple packet filtering to context-aware stateful inspection.

What Is a Firewall?

A firewall is a control point — hardware, software, or both — that sits at the boundary between networks (such as an internal network and the internet, or between two segments of the same network) and decides which traffic is allowed through based on a set of rules. It's one of the oldest and most fundamental network security controls, and modern networks typically use several firewalls at different points rather than just one at the perimeter.

Packet Filtering

Packet filtering is the simplest and oldest approach: the firewall examines each packet in isolation against a static list of rules — typically source and destination IP address, port number, and protocol — and allows or blocks it accordingly. Because it looks at each packet independently, a packet-filtering firewall has no memory of whether a packet is part of a conversation it already approved; it simply checks the current packet against the rule list every single time.

Example: Packet-Filtering Rules

# Conceptual packet-filtering rule set, evaluated top to bottom
ALLOW  IN   TCP  DEST_PORT=443  FROM=ANY        # allow inbound HTTPS
ALLOW  IN   TCP  DEST_PORT=80   FROM=ANY        # allow inbound HTTP
ALLOW  OUT  TCP  DEST_PORT=ANY  FROM=INTERNAL   # allow internal hosts to reach the internet
DENY   IN   TCP  DEST_PORT=23   FROM=ANY        # block inbound Telnet, an old insecure protocol
DENY   IN   ALL  FROM=ANY                       # default rule: deny anything not explicitly allowed above

Stateful Inspection

Stateful inspection improves on plain packet filtering by tracking the state of active connections rather than judging each packet alone. When an internal device starts a connection — completing the TCP handshake, for example — the firewall records that this is now an established session. Return traffic that matches an existing, legitimate session is allowed through automatically, while unsolicited packets that don't belong to any known session are dropped by default, even if they technically match an IP-and-port rule. This context awareness makes stateful firewalls considerably better at rejecting spoofed or unsolicited traffic, at the cost of more processing and memory to track every active connection.

FeaturePacket FilteringStateful Inspection
Awareness of connection stateNone — evaluates each packet aloneTracks active sessions and expects matching return traffic
Resource usageLowHigher — must maintain a state table of connections
Blocking unsolicited/spoofed repliesLimited, relies only on static rulesStronger, since traffic must match a real, tracked session
Typical use caseSimple, high-speed filtering at a basic boundaryMost modern network firewalls, including home routers and enterprise appliances

Beyond the Basics

  • Next-generation firewalls (NGFW): add deep packet inspection and application awareness, able to distinguish, say, one web application from another over the same port.
  • Application-layer (proxy) firewalls: fully process traffic for a specific protocol (like HTTP) before forwarding it, allowing much finer-grained rules than IP and port alone.
  • Web Application Firewalls (WAF): sit in front of a specific web application and filter for attack patterns such as SQL Injection or Cross-Site Scripting attempts.
  • Host-based vs. network-based: a host-based firewall runs on an individual device and protects just that machine, while a network-based firewall protects everything behind it.
Note: A firewall controls what traffic is allowed to cross a boundary — it doesn't inspect the contents of allowed traffic for hidden threats by itself, and it can't stop an attack that comes in through a channel it's configured to allow (like a malicious email attachment arriving over permitted port 443 traffic). It's an essential layer, not a complete solution, which is why it's always paired with other defenses like endpoint protection and email filtering.

Firewalls today are placed at multiple points, not just the internet-facing perimeter: between departments or environments within the same organization, in front of specific sensitive servers, and on individual laptops and phones, so that even if one boundary is crossed, further movement still has to get through another.

Keep Going

Cyber Security Interview QuestionsPractice real questions asked for Cyber SecurityCybersecurity Analyst SalarySee what Cybersecurity Analyst roles pay in the marketAuto Apply for JobsApply to open roles related to Cyber Security and tweak your resume