A virtual firewall is firewall software that filters traffic between virtual machines, subnets or cloud networks instead of running on a dedicated box. In the cloud, built in security groups and network access lists already do much of this. Add a dedicated virtual appliance when you need deeper inspection or central policy.
What does a firewall do, in NIST's terms?
NIST SP 800-41 Rev. 1 describes firewalls as devices or programs that control the flow of network traffic between networks or hosts with differing security postures. The same guide covers several technology types and their advantages and disadvantages, and recommends how to write policy, select, configure, test, deploy and manage them.
Nothing in that definition requires hardware. A firewall is defined by what it decides, not what it runs on.
Why does virtual traffic need its own firewall?
On a physical network, traffic between two servers crosses a switch you can put a firewall beside. In virtualised environments, two machines on the same host may talk without leaving it. A perimeter device never sees that conversation.
NIST SP 800-125B, on secure virtual network configuration, names four areas: network segmentation, network path redundancy, traffic control using firewalls, and VM traffic monitoring. The guide's concern is that a virtual machine is an end node of a virtual network, so that network's setup is part of the machine's security.
What are the types in the cloud?
Security groups. Stateful rules attached to instances or interfaces. They allow listed traffic and deny the rest. Fast to use, low cost, limited inspection.
Network access control lists. Stateless rules at the subnet boundary. Useful as a coarse second layer.
Host firewalls. Software on each machine, such as the operating system firewall. They follow the workload wherever it moves.
Virtual appliances. A firewall running as a machine image, placed inline. They can inspect application layer content, apply intrusion rules and give one policy across accounts.
Kubernetes network policies. Rules between pods inside a cluster, enforced by the network plugin if it supports them.
Do I need an appliance, or are security groups enough?
For many workloads, well kept security groups plus host firewalls are enough. They are default deny, close to the workload and cheap to run.
Consider an appliance when you must inspect content, not just addresses and ports. Examples are egress filtering by domain name, inspection of decrypted traffic where policy allows, or a single audit point across many accounts. Weigh the cost: an inline device is a new point of failure, a new throughput limit and a new thing to patch.
A constructed example
A team runs a web tier, an application tier and a database in one virtual network. Their security group for the database allows port 5432 from "anywhere in the virtual network," because it was quick. A compromised web server can therefore reach the database directly.
The fix is not a new product. The database group should accept traffic only from the application tier's group, and the web tier group should not list the database at all. If the team also needs to block outbound traffic to unknown domains, that is where an appliance or a DNS filter earns its place.
How to check or apply this
- Export every security group and list rules that allow wide sources or all ports.
- Draw the allowed flows between tiers and delete rules not on the drawing.
- Reference groups instead of address ranges so rules follow the workload.
- Apply default deny for outbound traffic where you can, and allow what is needed.
- Turn on flow logs and review rejected and unexpected accepted traffic monthly.
- Add Kubernetes network policies for namespaces that hold sensitive services.
- Decide whether you have a requirement for deep inspection before buying an appliance.
- Test rule changes in a staging copy first.
Quick check
Is a virtual firewall less secure than a hardware one?
Not by nature. Security depends on rule quality and placement. Hardware may offer higher throughput, while software is easier to deploy per workload.
Do cloud security groups count as a firewall?
Functionally yes, they filter traffic by rule. They are usually layer 3 and 4 only, so they do not replace content inspection.
Sources
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- NIST SP 800-125B, Secure Virtual Network Configuration for VM Protection
Last reviewed: 18 October 2026.
