An internal firewall filters traffic between segments inside your own network, such as between user laptops and servers, or between a payment system and the rest of production. It limits how far an intruder can move after getting past the edge. Use one wherever security needs differ between two internal networks.
What does an internal firewall do?
The perimeter firewall decides what enters from outside. An internal firewall decides what can pass between zones that already sit behind it. NIST SP 800-41 Revision 1 says organizations should use firewalls wherever their internal networks and systems interface with external networks and systems, and where security requirements vary among their internal networks. That second clause is the case for internal firewalls.
Without them, one compromised laptop may be able to open connections to every database in the company, because everything inside is treated as trusted.
Why does the edge alone fall short?
MITRE ATT&CK lists Lateral Movement as its own tactic: the adversary is trying to move through your environment. An attacker who steals one set of credentials rarely wants that one machine. They want the file server, the domain controller or the backup system.
A flat network gives them a short walk. Segmentation with filtering between zones turns each hop into a request that must match a rule, and rules produce logs.
NIST SP 800-207, on zero trust, makes the broader point. It describes moving defences from static network perimeters toward users, assets and resources, and assumes no implicit trust based on network location. An internal firewall puts that principle into practice at the network level.
Where should you place them?
Start with zones that differ in value or exposure:
- User devices from servers.
- Production from development and test.
- Systems handling payment or health data from everything else.
- Management networks from the data they manage.
- Guest and IoT networks from corporate resources.
- The database tier from the web tier of the same application.
NIST also describes host-based firewalls, software on each server that controls traffic for a single host. Configured to allow only necessary traffic, they protect against malicious activity from all hosts, including those on the same subnet or on other internal subnets not separated by a network firewall. That is the finest grained internal firewall you can run, and it works where physical segmentation is impractical, such as in cloud environments.
What should the rules say?
Default deny. The NIST guideline says that denying everything not explicitly permitted is a more secure approach than allowing everything not explicitly forbidden. Write rules from the application's real traffic flows: this web tier talks to that application tier on this port, and nothing else.
Limit outbound traffic from servers as well. NIST notes that doing so can help prevent malware from spreading from an infected host to others.
A constructed example
A company's finance application runs on four servers: web, application, database and a reporting job. Today every office laptop can reach all four on any port.
The team introduces three rules: laptops reach the web server on 443 only, the web server reaches the application server on its service port, and only the application server and the reporting job reach the database. A phishing victim's laptop can no longer probe the database. When the reporting job's credentials leak later, the intruder finds the database reachable only from two named hosts and logs show the unusual attempt.
What goes wrong?
Rules pile up with no owner and no expiry. Teams add temporary allow rules during an outage and never remove them. Firewalls get bypassed by dual homed servers or by management interfaces on the wrong network. And some teams segment the network but leave a shared service account with access to everything.
Review rules on a schedule, attach an owner to each, and test segmentation by trying connections that should fail.
How to check or apply this
- Draw the zones and mark the data and function in each.
- List the real traffic flows between zones from logs, not memory.
- Write default deny rules that allow only those flows.
- Add host-based rules on servers holding sensitive data.
- Restrict outbound traffic from servers to what they need.
- Test by attempting connections that should be blocked.
- Review rules quarterly, with an owner and expiry on each exception.
Quick check
Is a VLAN the same as an internal firewall?
No. A VLAN separates broadcast domains. Traffic between them is only controlled if something filters it, such as a firewall or access control lists.
Do internal firewalls replace zero trust?
They are one tool within it. Zero trust also relies on strong identity and device checks, not just network rules.
Sources
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- NIST SP 800-207, Zero Trust Architecture
- MITRE ATT&CK, Enterprise tactics
Last reviewed: 18 October 2026.
