What Is a Firewall? How Network Security Filtering Works

1What Is a Firewall?

A firewall is a security system that monitors incoming and outgoing network traffic and blocks any connection that does not meet a defined set of rules. It acts as a checkpoint between a trusted network, such as an internal company network, and an untrusted one, such as the public internet.

Firewalls can exist as dedicated hardware devices, as software running on an individual computer or server, or as a managed feature built into a cloud provider's networking layer.

2How a Firewall Decides What to Block

A firewall makes decisions based on rules that typically specify a source address, a destination address, a port, and a protocol, then either allows or denies traffic matching that pattern.

Rules are usually evaluated in order, and most firewalls follow a default-deny approach: traffic is blocked unless a rule explicitly allows it, which is the safer default posture for network security.

3Types of Firewalls

Firewalls have evolved through several generations, each adding a deeper level of inspection to the traffic passing through it.

• Packet-filtering firewalls: inspect individual packets based on source, destination, and port, without tracking the broader connection.
• Stateful inspection firewalls: track the state of active connections, allowing return traffic for a connection that was legitimately initiated.
• Application-layer firewalls: inspect traffic at the application level, understanding protocols like HTTP well enough to block malicious patterns within them.
• Next-generation firewalls (NGFW): combine stateful inspection with deeper application awareness and integrated threat detection features.

4Where Firewalls Sit in a Network

Firewalls are commonly placed at the perimeter between an internal network and the internet, but modern network design also places them between internal segments, such as separating a database tier from a public-facing web tier.

This segmentation limits how far an attacker can move if they compromise one part of a network, since internal firewall rules restrict lateral movement between segments.

5Firewalls and Defense in Depth

A firewall is a perimeter control, not a complete security solution on its own; it filters traffic based on defined rules but does not inspect encrypted content deeply, and it cannot stop an attack that comes through an already-permitted, legitimate channel.

Effective network security layers a firewall alongside other defenses, such as encryption for data in transit, strong access controls, and monitoring for unusual behavior once traffic is inside the network.

6Firewalls in Cloud Environments

Cloud providers offer firewall functionality as a managed service, often called a security group or network security group, letting administrators define rules without managing physical hardware.

These cloud-native firewalls follow the same underlying logic as traditional firewalls, filtering traffic by source, destination, and port, but are configured through the provider's console or infrastructure-as-code tools instead of dedicated appliances.

7Next Steps

A firewall filters network traffic against defined rules, acting as a checkpoint that blocks connections that do not belong, and modern networks layer several types together for stronger coverage.

Understanding firewall rule structure and placement is a foundational building block for anyone studying computer networking or preparing for cybersecurity-focused interview questions.