A software firewall is a program that runs on one computer and controls what network traffic may enter or leave that machine. It is the host-based firewall built into most operating systems. It adds a layer inside the network, covers laptops away from the office and limits how malware spreads.
What does NIST say about host-based firewalls?
NIST SP 800-41 Revision 1 describes host-based firewalls for servers and personal firewalls for desktops and laptops as an additional layer of security against network-based attacks. They are software-based, reside on the hosts they protect, and each monitors and controls incoming and outgoing traffic for a single host. NIST says they can provide more granular protection than network firewalls.
The guide notes that host-based firewalls come as part of server operating systems and can also be third-party add-ons. A personal firewall is similar, but meant for end users, so the interface is usually simpler. It adds protection for PCs both inside and outside the perimeter, such as mobile laptop users, since it can restrict inbound communications and often outbound too.
Why have one if you already have a network firewall?
A network firewall sits at a boundary and sees only traffic that crosses it. Several situations slip past it:
- A laptop on a coffee shop network is not behind any office firewall.
- Two servers on the same internal subnet talk without crossing any boundary.
- A compromised machine tries to scan its neighbors.
NIST makes the second point directly. Configuring a host-based firewall to allow only necessary traffic provides protection against malicious activity from all hosts, including those on the same subnet or on other internal subnets not separated by a network firewall. It adds that limiting outgoing traffic from a server can help stop certain malware from spreading to other hosts.
What can it do and not do?
NIST says host-based firewalls usually perform logging, can often be configured with address-based and application-based access controls, and many can act as intrusion prevention systems that take action after detecting an attack in progress.
Limits are real. If an attacker gets administrator rights on the machine, they can usually change or switch off its firewall. The firewall does not inspect what a permitted application does with a permitted connection. It also relies on someone writing and maintaining rules. A firewall set to allow everything is a log, not a barrier.
What does a good setup look like?
A constructed example: a company runs a small database server. The default rules allow inbound connections from anywhere on the internal network. The administrator changes them to default deny inbound, then allows the database port only from the two application servers by address, and allows remote administration only from one management host. A month later, an infected laptop on the office network scans the subnet. It cannot reach the database, and the denied attempts show up in logs, giving the team an early warning.
For outbound rules, start with logging and move to blocking for servers, since a database server rarely needs to browse the internet.
How to check or apply this
- Confirm the host firewall is turned on for every server and laptop. Check settings by policy, not by hand.
- Set the default for inbound traffic to deny, and allow only required ports from required sources.
- For servers, restrict outbound traffic to what the service needs.
- Prevent standard users from changing the firewall. Alert when it is disabled.
- Send firewall logs to a central store and review denied connections.
- Keep one tested rule set per server role, and apply it from code or configuration management.
- Review rules every quarter and remove ones nobody can explain.
Quick check
Does a software firewall replace a network firewall?
No. They work together. A network firewall filters traffic at a boundary. A software firewall protects one host, including when it is outside the boundary or talking to its neighbors.
Can malware turn off a software firewall?
If it gains administrator rights, often yes. That is why standard users should not run with admin rights and why you should alert when a firewall is disabled.
Sources
Last reviewed: 18 October 2026.
