A firewall decides which network traffic may pass between two places, based on rules about addresses, ports, protocols and sometimes applications or users. It blocks what policy forbids and lets the rest through. It cannot judge traffic it is allowed to carry, such as a phishing link or a stolen password.
How does NIST define a firewall?
NIST SP 800-41 Rev. 1 defines firewalls as devices or programs that control the flow of network traffic between networks or hosts employing differing security postures. The key phrase is "differing security postures". A firewall earns its place where trust changes: internet to company network, user network to server network, one cloud subnet to another.
What are the main types?
The guide covers several technologies, and they differ by how much of the traffic they understand.
Packet filters check each packet against rules on source, destination, port and protocol. They are fast and simple. They have no memory of earlier packets.
Stateful firewalls track connections, so a reply is allowed only if an inside host asked for it. This closes many gaps that stateless rules leave.
Application aware firewalls and proxies read the protocol itself. They can allow a web connection and still block a particular type of request.
Host firewalls run on one machine and decide what that machine will accept and send.
What does a rule set look like?
Rules are checked in order, and the first match wins in many designs. A sensible policy ends with a default deny: if nothing allows it, drop it.
A constructed example for a small web service:
- Internet to load balancer, port 443: allow.
- Load balancer to app servers, port 8080: allow.
- App servers to database, port 5432: allow.
- Anything to anything: deny.
Notice what is absent: the internet cannot reach the database, and the database cannot start connections out. If an app server is compromised, the attacker still faces rule 4 for everything else.
What can a firewall not stop?
Traffic it is told to allow. If port 443 is open, a malicious request over port 443 arrives like any other, unless the firewall inspects deeply. Phishing emails, stolen credentials used through a legitimate login, and malicious files downloaded over an allowed web connection all pass.
Encryption limits inspection too: the firewall sees the header but not the encrypted contents, unless it decrypts.
And a firewall cannot protect paths that bypass it, such as a laptop on a mobile hotspot or a forgotten cloud account without its own rules.
What does NIST recommend for policy?
SP 800-41 gives recommendations for establishing firewall policies and for selecting, configuring, testing, deploying and managing firewalls. Practical lessons from that guidance: base rules on a documented need, deny by default, review rules on a schedule, and test changes before relying on them.
Where do firewalls sit in a modern setup?
At the network edge, between internal zones, on each host, and in cloud networks as security groups and network access lists. Cloud rules are API objects, so a mistaken change is live in seconds and can be made by anyone with the right permission. Treat rule changes like code: review them, record who made them, and test them. A rule that was added during an incident and never removed is one of the most common sources of unexpected exposure.
How to check or apply this
- Export your current rules and mark each with an owner and a reason. Delete rules nobody can explain after a notice period.
- Confirm the last rule is a deny, and that logging is on for denied traffic.
- Look for any rule allowing any source to any destination. These usually mean a rushed fix.
- Test from outside: scan your public addresses and compare the open ports with what you intended.
- Add host firewalls on servers so one flat network does not mean one open door.
- Review the rules every quarter and after each major change.
Quick check
Is a firewall enough to protect a company?
No. It controls which connections are allowed. Attacks that use allowed connections, such as phishing and stolen passwords, need other controls.
What is the difference between a stateful and a stateless firewall?
A stateful firewall tracks connections and allows replies to requests made from inside. A stateless packet filter judges each packet alone.
Sources
- NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
- RFC 8404, Effects of Pervasive Encryption on Operators
Last reviewed: 18 October 2026.
