What is Firewall?

A firewall is a network security system that enforces access control policies by examining packets and deciding whether to forward or drop them. It sits at the boundary between internal networks (trusted) and external networks (untrusted, such as the internet). Firewalls can be implemented as hardware appliances, software running on general-purpose servers, or virtual instances in cloud environments.

The most common type is the stateful firewall, which tracks the state of active connections. When a packet arrives, the firewall checks not only its source and destination addresses and ports (stateless filtering) but also whether it belongs to an established session. This prevents attackers from injecting unsolicited packets that mimic legitimate traffic. Stateless firewalls, also known as packet filters, inspect each packet in isolation without session awareness. Next-generation firewalls (NGFWs) add application-layer inspection, intrusion prevention, and identity-based rules. Firewalls operate at Layers 3 and 4 of the OSI model, and NGFWs also operate at Layer 7.

Firewalls are fundamental to network security architecture, often deployed at network perimeters, between internal segments (east-west traffic), and on individual hosts (personal firewalls). They are complementary to other security controls like intrusion detection systems and VPNs. Configuration requires careful rule ordering to avoid accidental bypass or performance degradation. Common examples include iptables/nftables (Linux), Windows Defender Firewall, pfSense, Cisco ASA, and cloud security groups (AWS, Azure, GCP).