What are the benefits of a firewall, and where do they stop?

A firewall gives you a place to enforce which traffic is allowed, a choke point where you can log it, and a way to split networks into zones. Those benefits are real and cheap compared with their cost. Its limits are equally real: it cannot inspect what it cannot read.

What does NIST say a firewall is for?

NIST SP 800-41 defines firewalls as devices or programs that control the flow of network traffic between networks or hosts with differing security postures. Its recommendation for policy is deny by default: allow only the traffic the organization needs, because that decreases the risk of attack and reduces the volume of traffic carried on the network.

That one idea contains most of the benefit. A written allow list forces you to know what your systems actually need to talk to.

What are the concrete benefits?

1. Enforced policy. The rule set is the executable form of your network policy. Rules can use addresses, ports and protocols, and in some products applications and user identity. NIST's firewall policy chapters cover each basis in turn.
2. Reduced exposure. Services that should not be reachable from the internet are not, even when a misconfigured host would otherwise answer.
3. Segmentation. Put databases, user laptops and guest Wi-Fi in different zones and permit only needed flows between them. When one zone is compromised, the others are harder to reach.
4. Logging. A firewall sees every allowed and denied connection crossing it. Denied traffic logs are a cheap source of early warning, and the records help in an investigation.
5. Added functions. NIST notes many firewalls also provide content filtering, NAT, VPN termination and intrusion prevention, so one device may serve several purposes.

Constructed example: a clinic puts medical devices on their own network segment. The firewall allows those devices to talk to one imaging server and nothing else. When a reception PC is infected by commodity malware, the malware scans for neighbors and finds nothing to talk to, because the firewall denies it.

What are the limits?

NIST states that firewalls can work effectively only on traffic they can inspect. Encryption with IPsec, TLS, SSH and similar protocols hides content, and a firewall cannot read encrypted application data. Tunneled traffic that the firewall does not understand cannot be interpreted either. In such cases the rule set decides, so NIST recommends a policy for how to treat that traffic.

Other limits follow from placement. A firewall at the edge does not see traffic between two hosts inside the same segment. It does not know whether a laptop was patched. And it cannot stop an authorized user from sending data out over an allowed channel.

So treat a firewall as one control. Pair it with patching, authentication, endpoint protection and monitoring.

How do you tell whether yours is delivering value?

• Rule hygiene: how many rules have no owner, no comment or no hits in 90 days.
• Exposure: which services are reachable from the internet, checked by an external scan.
• Segmentation tests: from a test host in each zone, try to reach zones that should be off limits.
• Logging: how long it takes to find all connections from a given address last week.
• Change control: how many changes were reviewed before they went in.

How to check or apply this

1. Export the current rule set and sort by rules with the widest sources and ports.
2. Turn the policy into a written allow list per zone.
3. Remove or restrict anything that allows any source to any destination.
4. Confirm denied traffic is logged and sent to a system with longer retention than the device.
5. Run a segmentation test quarterly.
6. Plan for encrypted traffic: decide where, if anywhere, inspection will happen.
7. Keep the firewall software patched. A firewall is itself an internet facing system.

Quick check

Sources

• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy

Last reviewed: 18 October 2026.