A firewall filters network traffic. It sits between networks and decides what gets through. Rules define allowed and denied traffic based on IP addresses, ports, protocols, and application signatures. A basic packet filter looks at headers. A stateful firewall tracks connections and understands context. A next-generation firewall inspects application-layer data, identifies users, and blocks threats. Each generation adds capability and complexity.

Firewalls are not enough on their own. They stop known bad traffic and enforce segmentation. They do not stop phishing emails that trick a user into clicking a link. They do not stop an attacker who has valid credentials and connects over an allowed port. They do not inspect encrypted traffic unless they are configured to decrypt it, which raises privacy and performance concerns. Firewalls work best as part of a layered defense. Network segmentation limits lateral movement. Intrusion detection catches what the firewall misses. Endpoint security handles threats that get through. A firewall with permissive rules is worse than useless. It creates a false sense of security. Review rules regularly. Remove the ones nobody remembers adding. The default should be deny.

Firewall types

• Packet filter — inspects headers, fast and simple
• Stateful — tracks connection state, more context
• Application-layer — inspects payloads, slower but deeper
• Next-generation — combines firewall, IPS, and application control

A firewall is a fence. It keeps honest traffic in and casual attackers out. It does not stop someone with a key.