A firewall controls the flow of network traffic between networks or hosts with different security postures. It compares each packet or connection to an ordered list of rules and then allows, drops or logs it. Stronger designs track connection state or inspect application content. The safest policy is default deny.
What does a firewall look at?
NIST SP 800-41 Rev. 1 defines firewalls as devices or programs that control traffic between networks or hosts with differing security postures, and walks through the main technologies.
Packet filtering. The simplest kind looks at each packet on its own: source and destination address, protocol and port, and sometimes direction. A rule might say allow TCP to port 443 on the web server and drop everything else. It is fast, but it has no memory. It cannot tell a reply to a request you made from an unsolicited packet pretending to be one.
Stateful inspection. The firewall keeps a table of connections. When an internal host opens a connection out, the table records it, and the matching replies are allowed back in. Unsolicited inbound packets that match no entry are dropped. This is how most network firewalls work today.
Application layer filtering and proxies. These understand the protocol itself. A web proxy can terminate the connection, inspect the request and open a separate connection to the server, so it can block specific methods or content types. A web application firewall applies this idea to HTTP traffic in front of an application. The cost is more processing and more places for parsing bugs.
How are rules evaluated?
Rules are read in order, and the first match decides. That makes order critical. A broad allow placed above a narrow deny quietly cancels the deny. Most firewalls end with an implicit or explicit deny for anything unmatched, and that final rule is the one to protect.
Constructed example: a small office
The office has laptops, a file server and a guest Wi-Fi. The rules, from top to bottom: allow laptops to reach the file server on its sharing port, allow laptops outbound web traffic on port 443 and DNS, allow guests outbound web traffic only, deny guests to every internal address, and deny everything else.
A guest tries to open the file server's address. The packet matches the guest deny rule and is dropped and logged. If someone had accidentally put "allow any to any" at the top, none of the later rules would ever apply.
What can a firewall not do?
It cannot see inside encrypted traffic without special arrangements, and it cannot stop a user from running a malicious file received over an allowed channel. It does not fix vulnerable software behind an allowed port. If your web server has an exploitable flaw, a rule allowing port 443 lets the exploit through. Firewalls reduce exposure. They do not remove vulnerabilities, so patching and secure code still matter. A firewall also protects only the traffic that passes through it, so a flat network with one perimeter device leaves internal movement unchecked.
How do you make a firewall policy good?
NIST recommends that policy follow from an assessment of risk and that rules be documented, reviewed and tested. Start with default deny. Allow only what a business need justifies, for specific sources, destinations and ports. Log denied traffic and review it. Remove stale rules, because forgotten allows are how exposure accumulates. Segment the network, so internal firewalls limit what a compromised machine can reach.
How to check or apply this
- Draw the zones: internet, DMZ, user, server, guest and management.
- Write the allowed flows between zones in plain words before writing rules.
- Implement default deny at the end of each rule set.
- Put specific rules above general ones, and test with a scanner from each zone.
- Log denies and unusual allows, and review them regularly.
- Review rules every quarter and delete anything without an owner or reason.
- Keep firmware current, and restrict management access to a dedicated network.
Quick check
What is the difference between stateless and stateful filtering?
Stateless filtering judges each packet alone. Stateful filtering tracks connections and allows replies only to traffic that was initiated from inside.
Does a firewall protect against vulnerable software?
Only partly. It can block ports you do not use, but a flaw in a service on an allowed port is still exploitable.
Sources
Last reviewed: 18 October 2026.
