A hardware firewall is a dedicated network appliance that sits between your network and another, usually the internet, and allows or blocks traffic by rule. It protects every device behind it at once. You still need one where you run on premises systems, an office network or segments that must be isolated.
What does a firewall do?
NIST SP 800-41 Rev. 1 describes firewalls as devices or programs that control the flow of network traffic between networks or hosts with differing security postures. The guide covers several firewall technologies, their capabilities and trade offs, and gives recommendations on policy, selection, configuration, testing, deployment and management.
That definition covers hardware and software alike. What distinguishes a hardware firewall is where it runs: on purpose built equipment with its own processors and network ports, usually mounted in a rack or on a shelf.
How does it differ from a software firewall?
A software firewall runs on a computer or virtual machine and protects that host, or sometimes a network if the host is placed inline. A hardware firewall protects the network segment behind it and keeps working when individual endpoints are not managed.
Practical differences:
- Placement: the appliance sits at the boundary, so unmanaged devices such as printers and cameras are covered.
- Performance: dedicated hardware can handle high throughput with specialised processing.
- Management: one device and one policy to maintain, which is also one thing that can fail.
- Granularity: host firewalls can apply rules per application on each machine, which a boundary device cannot.
Most sound designs use both. The boundary appliance limits what enters and leaves, and host firewalls limit movement between machines.
What kinds of filtering can it do?
SP 800-41 describes technologies of increasing depth. Basic packet filtering decides by address, port and protocol. Stateful inspection tracks connections, so replies to allowed outbound requests are let in and unsolicited inbound traffic is dropped. Application layer firewalls and proxies understand specific protocols and can inspect content. Many modern appliances combine these with extras such as intrusion prevention and VPN termination, so check what is switched on.
Do you still need one?
If everything you run is in cloud services and staff work from anywhere, a boundary appliance protects little. Cloud network controls and device protections matter more. If you have an office with wired devices, on premises servers, industrial or point of sale equipment, or a requirement to segment networks, a hardware firewall is still a standard control.
A constructed example
A twenty person office has a router supplied by the internet provider, a file server, several printers and a door access controller. All sit on one flat network. A laptop infected with malware scans the network and reaches the file server and the controller.
The office adds a firewall appliance with three zones: staff devices, servers and a restricted segment for the door controller and printers. Rules allow staff to reach the file server on the file sharing port, and the printers and controller to talk only to their management hosts. The infected laptop can no longer reach the controller, and logs record the scan attempts.
How to check or apply this
- Draw your network and note where it meets the internet and where segments should be separated.
- Choose a device with throughput for your busiest link with the features you intend to use switched on.
- Define zones and write rules as allow lists, with default deny for inbound traffic.
- Block outbound traffic you do not need, such as direct mail sending from workstations.
- Change default credentials, restrict management access and enable multifactor authentication.
- Keep firmware patched and subscribe to the vendor's security notices.
- Back up the configuration and test restoring it.
- Send logs somewhere central and review rule hits and denied traffic regularly.
- Review the rule set twice a year and delete stale rules.
Quick check
Is a router with a built in firewall the same as a hardware firewall?
It does basic filtering, usually stateful. Dedicated appliances add segmentation, richer rules, logging and sometimes content inspection.
Can the firewall itself be attacked?
Yes. It is an internet facing device with software, so patch it quickly, restrict management access and monitor its logs.
Sources
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
