What is a firewall?

What does a firewall do and how does it work?

A firewall's core job is to control network traffic. It sits at a boundary, typically the network edge or a data center, and inspects every data packet trying to cross it. Using predefined rules, the firewall compares each packet against criteria such as source and destination IP address, port number, and protocol type. If the packet matches an allow rule, it passes; if it violates the rules, the firewall blocks or drops it and can log a security event. In enterprise environments, individual rules are grouped into access control lists (ACLs) and evaluated in order until a match is found.

More advanced firewalls do not judge each packet in isolation. Using stateful inspection, they track the full state and context of a connection, so they can tell whether a packet is a legitimate part of an established session or something unexpected. Deep packet inspection (DPI) goes further still, examining the actual contents of a packet, not just its header, which lets the firewall spot malware or prohibited content hidden inside otherwise normal-looking traffic. Modern firewalls also compare traffic against threat intelligence feeds of known malicious signatures, and they treat direction differently: north-south traffic entering from outside is inspected closely, while east-west traffic moving between internal systems is watched to catch attackers moving laterally once inside.

Firewall generations: a short history

Firewalls have been around since the late 1980s and have evolved through four broad generations, each answering the threats of its era:

• Packet filtering (1989): The first generation examined individual packets by header (IP, port, protocol) but could not see inside them to detect malicious code.
• Stateful inspection (1990s to early 2000s): The second generation, pioneered commercially by Check Point's FireWall-1 in 1993, tracked the state of active connections and used context to spot suspicious behavior.
• Proxy / application-level gateways (early 2000s): The third generation acted as an intermediary at Layer 7 of the Open Systems Interconnection (OSI) model, fully separating client and server and inspecting application-level traffic.
• Next-generation firewalls (around 2010 onward): The fourth generation combined traditional filtering with deep packet inspection, intrusion prevention, application awareness, and threat intelligence. Today this is extending into AI-powered and cloud-delivered firewalls.

Earlier generations are still in use today. Many networks run a mix, applying the right type of firewall to the right place.

Types of firewalls

Firewalls are commonly categorized by how they inspect traffic, but they can also be grouped by what they protect (an entire network or a single host), their form factor (hardware, software, or cloud), and where they sit in the network (perimeter, internal, distributed, or hybrid mesh). The main types by inspection method are:

Packet filtering firewall

The simplest and fastest type. It checks each packet's header against rules for source and destination IP, port, and protocol, then allows or blocks it. Cost-effective but limited, since it cannot see packet contents or connection context.

Stateless vs. stateful firewalls

A stateless firewall inspects each packet independently at the transport layer, with no memory of previous packets, so it cannot tell whether a packet belongs to an existing connection. A stateful firewall tracks the state and context of active connections, making more informed allow or block decisions. Stateful inspection offers stronger protection but uses more processing power.

Proxy firewall (application-level gateway)

Operating at Layer 7 of the OSI model, a proxy firewall acts as an intermediary that terminates the client connection, inspects the request, then opens a separate connection to the server. This prevents a direct client-to-server link and allows deep application-level inspection, at the cost of some added latency.

Next-generation firewall (NGFW)

An NGFW blends traditional stateful filtering with advanced capabilities: DPI, intrusion prevention system (IPS), application awareness and control, URL filtering, Data Loss Prevention (DLP), sandboxing, Internet of Things (IoT) security, and zero-trust network access. NGFWs can be deployed as hardware, software, virtual, or cloud, and often integrate Software-Defined Wide Area Network (SD-WAN), Zero Trust Network Access (ZTNA), and Secure Access Service Edge (SASE).

Web application firewall (WAF)

A WAF is a reverse proxy that sits in front of web applications and filters HTTP traffic, blocking attacks such as SQL injection, cross-site scripting (XSS), and cross-site request forgery. It protects the application from malicious users, complementing network firewalls that protect the network from malicious traffic.

UTM, virtual, cloud-native, and firewall-as-a-service

Unified Threat Management (UTM) devices bundle firewalling with antivirus and intrusion prevention for simplicity. Virtual firewalls run as software on hypervisors or in the cloud and support network segmentation and multi-tenancy. Cloud-native firewalls are built for specific cloud platforms like AWS, Azure, and Google Cloud. Firewall-as-a-Service (FWaaS) delivers firewall capability from the cloud on a subscription basis, which scales easily and suits distributed, multi-cloud environments. Some organizations also opt for a managed firewall, outsourcing continuous tuning and monitoring to a provider.

Firewall types compared

Choosing the right firewall means matching its inspection depth, performance, and best-fit use case to your environment.

Hardware, software, and cloud firewalls

Beyond inspection method, firewalls differ in form factor. A hardware firewall is a physical appliance placed between networks, favored on large networks where software alone would consume too much processing power. A software firewall runs on a server, virtual machine, or individual device (a host-based or personal firewall), controlling traffic for that system. A cloud firewall or FWaaS is hosted in the cloud and is far better suited to protecting cloud and multi-cloud assets than a physical appliance. Originally almost all firewalls were hardware; today many are software-based or cloud-delivered, and large environments typically combine all three, ideally managed through a single console to avoid gaps.

Firewall features: NAT and VPN

Firewalls often provide two network functions worth calling out. Network Address Translation (NAT) rewrites the source or destination IP addresses of packets as they pass through, letting many devices share one public IP address and hiding internal addresses from the internet, which doubles as a defense against reconnaissance. A Virtual Private Network (VPN) extends a private network across a public one through an encrypted tunnel, so remote users can securely access corporate resources as if directly connected. This is especially valuable for hybrid and remote work.

Firewall vs. antivirus vs. WAF

Firewalls are frequently confused with other security tools. A firewall controls network traffic and blocks unauthorized access at the network level. Antivirus works at the device level, scanning files and memory to detect and remove malware that is already present. A WAF is a specialized firewall focused on the application layer, protecting web apps from attacks like SQL injection and XSS. These are complementary, not interchangeable: most organizations run a network firewall and antivirus together, and add a WAF when they host web applications. A firewall also differs from an intrusion detection system (IDS), which only monitors and alerts, and an IPS, which blocks known attacks inline. It is not a router, which simply directs traffic, or a plain ACL, which is packet-level filtering with no deep inspection.

Why firewalls matter

A firewall is widely considered the first line of defense in network security. It blocks unauthorized access and common threats such as viruses, backdoors, phishing traffic, and denial-of-service attempts, and it can restrict outbound traffic to limit data exfiltration by insiders or compromised hosts. Firewalls also help organizations meet compliance requirements, since many regulatory frameworks mandate their use to protect sensitive data, and they support access control through the principle of least privilege, granting users and systems only the access they need. A firewall shrinks the attack surface and enforces a clear boundary around what is allowed on the network.

Firewall best practices and challenges

A firewall requires ongoing management and tuning. Effective firewall management follows a few core practices:

• Apply least privilege to rules: Replace overly permissive "any/any" rules with explicit allow and deny statements.
• Document everything: Keep clear, current documentation of every rule and its purpose.
• Patch and update regularly: Apply updates and patches on a consistent schedule.
• Protect the firewall itself: Disable insecure management protocols and back up configurations.
• Group and segment rules: Organize rules for clarity and oversight.
• Monitor and audit continuously: Review logs for suspicious activity and remove stale rules.

The common challenges mirror these practices:

• Misconfiguration: Overly permissive rules or missed updates are among the most dangerous and frequent issues.
• Rule set bloat: New policies accumulate over time while old ones linger, creating conflicting configurations that hurt performance and can generate false positives.
• Performance overhead: Deep inspection, encrypted-traffic analysis, and advanced features all demand processing power, so an undersized firewall becomes a bottleneck.
• Update risk: Even routine updates carry risk if poorly timed or tested.

Expert insight: a firewall is a control point, not a detection engine

A firewall is fundamentally a preventive control: it enforces who and what may cross a boundary. That is essential, but modern attackers increasingly operate with valid credentials and legitimate tools, and a growing share of intrusions are malware-free, so plenty of malicious activity looks like allowed traffic to a firewall. Once something is past the perimeter, the firewall was never designed to hunt it down. Detection and response is a separate discipline, and it is where a firewall stops and a Security Operations Center (SOC) platform begins.

Sekoia treats the firewall as one high-value telemetry source among many rather than the whole defense. Firewall logs are one of the more than 300 integrations that feed the Sekoia unified SOC platform, where the Sekoia Defend Security Information and Event Management (SIEM) correlates them with endpoint, identity, and cloud data, and where roughly 1,000 detection rules mapped to MITRE ATT&CK turn raw firewall events into high-confidence detections. Those detections are enriched by native Sekoia Intelligence Cyber Threat Intelligence (CTI), produced by an in-house Threat Detection & Research (TDR) team, which keeps false positives low and helps analysts see the east-west movement a firewall alone would miss. As a European vendor, Sekoia also offers a data sovereignty posture that large US-based providers rarely match, paired with automated incident response so that a signal from the firewall can trigger containment in minutes. Keep the firewall as your first line, but do not mistake prevention for detection.

‍

Frequently asked questions