A firewall controls which network connections are allowed, based on addresses, ports, protocols and, in newer forms, applications. A secure web gateway (SWG) filters what users reach on the web and what comes back, using URL categories, content inspection and user identity. Many organizations use both.
What does a firewall do?
NIST SP 800-41 Rev. 1 describes firewalls as devices or programs that control the flow of network traffic between networks or hosts with differing security postures. Basic filtering looks at addresses and ports. Stateful inspection tracks connections. A next-generation firewall, as NIST's guide to the enterprise network landscape (SP 800-215) puts it, is distinguished by application awareness: it looks beyond layers 3 and 4 up to the application level, and adds features such as deep packet inspection, TLS decryption and intrusion prevention.
The same document notes next-generation firewalls can be deployed as an appliance in a data centre, as software in a virtual machine in a cloud, or as a cloud service.
What does a secure web gateway do?
SP 800-215 describes an SWG as providing policy-based access to cloud applications and governance of access to the open web for users in any location: headquarters, branch offices, home and remote sites. It is fundamentally a web filter that protects outbound user traffic through HTTP and HTTPS inspection, and it protects endpoints from threats that arrive when users click malicious links or visit infected sites. It centralizes control, visibility and reporting across many locations and user types. The guide adds that SWGs are not a replacement for web application firewalls.
What are the main differences?
| Aspect | Firewall | Secure web gateway |
|---|---|---|
| Primary question | Should this connection be allowed? | Should this user reach this web destination, and is the content safe? |
| Main traffic | All network protocols | Web traffic over HTTP and HTTPS |
| Policy basis | Address, port, protocol, application | URL category, reputation, content, user and group |
| Typical placement | Network boundaries and segments | Between users and the internet, often cloud delivered |
| Protects | Networks and hosts | Users and their web activity |
Where do they overlap?
Next-generation firewalls include web filtering features, and SWGs inspect more than basic proxies. At the edges the products blur. A small site with modest needs may meet web filtering requirements with a firewall feature. A large, distributed workforce often wants consistent policy for remote users, which is what an SWG delivered as a service provides.
A constructed example
A company with an office and 200 remote staff has a firewall at the office. Staff at the office browse through it and get web filtering. Remote staff connect straight to the internet, so no filter applies, and one of them follows a link to a malicious download. The company adds an SWG delivered as a cloud service and sends all user web traffic through it, whether at the office or at home. The firewall continues to guard server networks and inbound connections, which an SWG does not handle.
What are the limits?
- Encrypted traffic. Inspecting HTTPS needs TLS decryption, with privacy, legal and certificate handling to consider.
- Non-web traffic. An SWG does not control other protocols, which still need firewall rules.
- Bypass. Users can sidestep either control with personal devices or tunnels unless endpoint policy and network rules close the gap.
- Performance. Inspection adds delay, so capacity and placement matter.
How to check or apply this
- List where your users work and which of their traffic is filtered today.
- Separate needs: network segmentation and inbound control (firewall) versus web access policy and content safety (SWG).
- Check whether your existing firewall already provides the web filtering you need, and for which users.
- Decide your approach to TLS inspection, with legal and privacy review and a list of exempted categories such as banking.
- Test with a safe test page for each category and confirm policy applies at the office and at home.
- Review logs together, so a block at one layer is visible at the other.
Quick check
Can a firewall replace a secure web gateway?
For some small sites, a firewall's web filtering may be enough. For distributed users and richer web policy, an SWG gives consistent coverage.
Does an SWG protect web servers?
No. It protects users browsing out. Protecting your own web applications is the job of controls such as a web application firewall.
Sources
- NIST SP 800-215, Guide to a Secure Enterprise Network
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- NIST SP 800-207, Zero Trust Architecture
Last reviewed: 18 October 2026.
