What Is a Firewall? Network Security Explained

A firewall is a system that inspects network traffic crossing a boundary — between a private network and the internet, or between two segments of the same network — and allows or blocks each connection based on a set of rules. It’s the oldest and still most fundamental layer of network security: before anything else can happen to a packet, a firewall decides whether it’s allowed to arrive at all.

The core idea: default deny

Nearly every firewall configuration starts from the same principle: default deny. Rather than trying to enumerate every bad thing and block it, a well-run firewall blocks everything by default and explicitly allows only the traffic that’s expected — specific ports, specific source ranges, specific protocols. Anything not explicitly permitted is dropped.

This is the opposite of how most software defaults work, and it’s deliberate. An allowlist of “traffic we expect” is much shorter and more auditable than a blocklist of “traffic we’ve thought to forbid,” and it fails safe: a rule you forgot to write results in a blocked connection, not an open one.

How filtering has evolved

Firewalls aren’t one technology — the term covers several generations of increasingly sophisticated filtering, often layered together.

Packet filtering is the earliest and simplest approach. Each packet is evaluated in isolation against rules based on source and destination IP address, port number, and protocol. It’s fast and cheap but has no memory — it can’t tell whether a packet is part of an established, legitimate conversation or an unsolicited one.

Stateful inspection fixed that blind spot. A stateful firewall tracks the state of active connections — which hosts have an open TCP handshake, which UDP flows are expected replies — and uses that connection table to make decisions. A reply packet is allowed because it matches an outbound request already in the table; an unsolicited inbound packet claiming to be a reply is dropped because no such connection exists. This is the model most firewalls, including the ones built into operating systems and cloud security groups, use today.

Next-generation firewalls (NGFWs) add awareness above the network layer: they can identify the application generating traffic regardless of port, inspect payloads for known attack signatures, and integrate intrusion prevention. This overlaps with — and often absorbs — the functionality described in our IDS vs. IPS comparison.

Network firewalls vs. web application firewalls

A common point of confusion is the difference between a network firewall and a web application firewall (WAF). They operate at different layers and answer different questions.

	Network firewall	Web application firewall
Layer	Network/transport (IP, port, protocol)	Application (HTTP request content)
Decides	Should this connection reach this host/port	Does this HTTP request look like an attack
Blocks	Unauthorized ports, unexpected sources	SQL injection, XSS payloads, bad input patterns
Typical placement	Network perimeter, host, cloud security group	In front of a specific web app
Blind to	Content of allowed traffic	Traffic outside HTTP/HTTPS

They’re complementary, not competing: a network firewall keeps unauthorized protocols and ports from reaching a server at all, while a WAF inspects the HTTP traffic that the network firewall let through.

Where firewalls run today

Firewalls used to mean a dedicated appliance sitting at the network edge. That’s still common, but the concept has spread into several other places:

• Host-based firewalls run on individual machines — Windows Firewall, iptables/nftables on Linux — filtering traffic to and from that one host regardless of where it sits on the network.
• Cloud security groups and network ACLs are firewalls-as-configuration: rules attached to a VPC or individual cloud resource, enforced by the cloud provider’s infrastructure rather than a box you manage.
• Firewalls at the edge of a service mesh or Kubernetes cluster filter traffic between pods and namespaces, extending the same default-deny principle down to individual workloads.

This shift reflects a broader move away from a single hardened perimeter and toward layered controls closer to each resource — the same logic behind zero trust security and micro-segmentation: assume any given network boundary might be crossed, and put a filter at every layer rather than relying on one at the edge.

What a firewall doesn’t do

It’s worth being precise about the limits. A firewall controls which connections are permitted to happen — it doesn’t inspect the legitimacy of the data inside a permitted connection (that’s a WAF’s or IDS/IPS’s job), it doesn’t stop credential stuffing or phishing that rides over an allowed HTTPS connection, and it doesn’t protect against a compromised host making outbound connections on ports you’ve already allowed. It’s necessary, foundational infrastructure — not a substitute for authentication, input validation, or monitoring.

The takeaway

A firewall filters network traffic against a ruleset, and the sane default for that ruleset is deny-by-default with narrow, explicit allowances. Stateful inspection made firewalls aware of connection context rather than just individual packets, and next-generation firewalls added application awareness on top. Pair a network firewall with a WAF for anything serving HTTP, and don’t mistake “the firewall allows it” for “the traffic is safe” — that’s a separate, ongoing job.