Firewalls Explained: Types, Rules, How They Work & Security
Firewalls Explained: How Network Firewalls Work, Types, Rules, and Security
Introduction
A firewall is one of the fundamental security controls used to protect modern computer networks. Whether you are securing a home network, small business, enterprise data center, cloud environment, or internet-facing server, a firewall plays an important role in determining which communications should be permitted or blocked.
At its simplest, a firewall answers an important question:
Should this network connection be allowed or denied according to the security policy?
However, modern firewalls do much more than block unwanted ports. Depending on their capabilities, they can evaluate source and destination addresses, protocols, connection states, applications, user identities, security zones, domains, URLs, and indicators of malicious activity.
Some advanced firewalls also integrate intrusion prevention, application control, malware detection, threat intelligence, and centralized security monitoring.
Understanding firewalls therefore requires knowledge of several interconnected concepts, including TCP/IP, routing, access control, network segmentation, VPNs, and security architecture.
If you are new to networking, begin with our TCP/IP Explained guide. For a broader introduction to security controls and cyber threats, read Cybersecurity for Beginners.
This comprehensive guide explains how firewalls work, the differences between stateless and stateful inspection, next-generation firewalls, firewall rules, Windows and Linux firewall administration, DMZ architectures, cloud security, logging, and practical troubleshooting.
What Is a Firewall?
A firewall is a hardware device, software component, virtual appliance, or cloud-based service that controls network communications according to a defined security policy.
A firewall generally operates between systems or security zones with different access requirements.
For example, a company might place a firewall between its internal network and the public internet.
INTERNET
|
v
+----------------+
| FIREWALL |
| |
| ALLOW / DENY |
+----------------+
|
v
INTERNAL LANWhen network traffic reaches the firewall, the system evaluates it using configured rules and supported inspection mechanisms.
If the traffic satisfies the relevant security policy, it may be allowed. Otherwise, it may be blocked, rejected, or handled according to another configured action.
For example, a company may allow internet users to reach its public web server on TCP port 443 while preventing direct access to its internal database server.
A simplified policy might be:
| Source | Destination | Service | Action |
|---|---|---|---|
| Internet | Public web server | HTTPS, TCP 443 | Allow |
| Internet | Internal database | MySQL, TCP 3306 | Deny |
| Admin VPN | Approved servers | SSH, TCP 22 | Allow |
| Guest network | Management network | Any | Deny |
These are illustrative rules. Production behavior also depends on network topology, connection state, rule order, NAT configuration, and platform-specific processing.
The NIST Guidelines on Firewalls and Firewall Policy, published as SP 800-41 Revision 1, provide a foundational reference for firewall policy design, deployment, and management.
Why Do Networks Need Firewalls?
Modern networks communicate with many services, including DNS resolvers, web servers, cloud APIs, authentication systems, software repositories, email servers, databases, and internal applications.
Without appropriate traffic controls, services may become reachable from networks or users that have no legitimate reason to access them.
Consider a server running the following services:
22 SSH
80 HTTP
443 HTTPS
3306 MySQL
3389 Remote Desktop ProtocolNot every service necessarily needs to be accessible from the internet.
A public web application may need HTTPS access, but there may be no business reason to expose its database or administrative services directly.
A firewall allows administrators to define which connections are permitted.
For example:
Internet
|
v
Firewall
|
+---- TCP 443 ----> Public Web Application
|
+---- TCP 22 -----> Block direct access
|
+---- TCP 3306 ---> Block
|
+---- TCP 3389 ---> Block
Admin VPN
|
+---- TCP 22 -----> Approved ServersThis reduces unnecessary exposure and limits the number of services available to potential attackers.
Firewalls also help organizations enforce network segmentation, control outbound communication, monitor traffic, and investigate connectivity problems.
The objective is not to block as much traffic as possible.
The objective is to permit necessary communication while reducing unauthorized or unnecessary access.
How Does a Firewall Work?
A firewall examines traffic and applies the relevant policy based on its configuration and capabilities.
The following diagram illustrates a simplified decision process:
INCOMING TRAFFIC
|
v
+----------------+
| IDENTIFY |
| SOURCE, DEST., |
| PORT, PROTOCOL |
+----------------+
|
v
+----------------+
| EVALUATE |
| SECURITY RULES |
+----------------+
|
+------+------+
| |
v v
ALLOW DENY
| |
v v
FORWARD DROP OR
REJECTA basic packet-filtering firewall might evaluate source and destination IP addresses, ports, protocols, and interfaces.
A stateful firewall can additionally consider connection-tracking information.
A next-generation firewall may identify applications, inspect supported content, and correlate network behavior with threat intelligence.
The depth of inspection depends on the firewall platform, available features, encryption, and security policy.
What Information Can a Firewall Inspect?
Depending on its implementation, a firewall may use:
- Source and destination IP addresses
- TCP or UDP ports
- Network protocol
- Source and destination interfaces
- Security zones
- Connection state
- Application identification
- User or device identity
- Domain and URL information
- Available packet payload information
- Intrusion detection signatures
- Threat intelligence indicators
Not every firewall supports every type of inspection.
For example, a traditional network ACL generally does not identify applications in the same way as a next-generation firewall.
Likewise, encrypted HTTPS traffic limits what an intermediary can inspect without additional decryption or endpoint-supported mechanisms.
Firewall Rules Explained
Firewall rules define how matching traffic should be handled.
A rule normally includes one or more conditions and an associated action.
A typical rule may specify:
- Source network or address
- Destination network or address
- Protocol
- Destination port
- Security zone or interface
- Application or user identity, where supported
- Action, such as allow or deny
- Logging behavior
Consider the following example:
| Priority | Source | Destination | Protocol | Port | Action |
|---|---|---|---|---|---|
| 1 | Admin VPN | Server subnet | TCP | 22 | Allow |
| 2 | Internet | Web server | TCP | 443 | Allow |
| 3 | Employee LAN | Approved web services | TCP | 443 | Allow |
| 4 | Internet | Database subnet | Any | Any | Deny |
| 5 | Any | Any | Any | Any | Deny |
This policy allows specific business communications while denying other traffic.
Firewall Rule Order
On many firewall platforms, rules are evaluated according to an ordered policy.
For example:
Rule 1: ALLOW Internet -> Web Server TCP/443
Rule 2: DENY Internet -> Web Server ANYIn a first-match policy, an HTTPS connection matching Rule 1 is allowed before Rule 2 is evaluated.
If the order is reversed:
Rule 1: DENY Internet -> Web Server ANY
Rule 2: ALLOW Internet -> Web Server TCP/443the broad deny rule may prevent the intended HTTPS access.
However, rule-processing models differ among platforms. Some systems use priorities, multiple policy stages, or other evaluation mechanisms.
Administrators should therefore understand the behavior of their specific firewall product before modifying production policies.
Implicit Deny vs Explicit Deny
An implicit deny means traffic that matches no permitted rule is blocked by the platform’s default policy.
An explicit deny is a configured rule that blocks traffic matching particular conditions.
Both can support a restrictive security model.
The important operational principle is to avoid permitting unnecessary traffic by default.
Stateless vs Stateful Firewalls
One of the most important distinctions in firewall technology is the difference between stateless and stateful inspection.
Stateless Firewall
A stateless firewall evaluates packets independently rather than maintaining full connection context.
It typically uses packet header information such as IP addresses, protocols, ports, and interfaces.
For example:
Source IP: 192.168.1.50
Destination IP: 8.8.8.8
Protocol: UDP
Destination Port: 53
Action: ALLOWStateless filtering can be efficient and predictable.
However, because individual packets are evaluated without the same level of connection tracking, administrators may need additional rules to accommodate response traffic.
Stateless filtering is commonly associated with basic network ACLs and certain cloud networking controls.
Stateful Firewall
A stateful firewall maintains information about active traffic flows or connections.
When a client initiates an allowed connection, the firewall can create a corresponding state entry.
Return traffic associated with that connection can then be evaluated using the recorded state.
Consider a workstation accessing a web server:
CLIENT
192.168.1.20:51542
|
| TCP CONNECTION
v
FIREWALL
|
v
WEB SERVER
203.0.113.20:443A conceptual state entry might contain:
Source: 192.168.1.20:51542
Destination: 203.0.113.20:443
Protocol: TCP
State: ESTABLISHEDA TCP connection begins with handshake traffic, and stateful firewalls use supported connection-tracking logic to determine whether subsequent packets belong to an allowed flow.
Modern stateful inspection can also track connection-oriented or flow-like behavior for protocols other than TCP, including UDP.
Stateless vs Stateful Firewall Comparison
| Feature | Stateless Firewall | Stateful Firewall |
|---|---|---|
| Packet inspection | Individual packet criteria | Packet criteria plus connection state |
| Connection tracking | Generally absent | Supported |
| Return traffic handling | Often needs explicit policy | Can use existing state |
| Resource usage | Often lower | Additional state-table resources |
| Common applications | Basic ACLs, network filtering | Enterprise and host firewalls |
Stateful inspection is useful, but it does not automatically identify every malicious connection.
A connection can satisfy stateful firewall rules while carrying harmful application traffic.
Packet Filtering and Access Control Lists
Packet filtering is one of the oldest and most widely used firewall techniques.
It evaluates network packets against conditions such as source address, destination address, protocol, and port.
For example:
IF destination = 10.0.0.10
AND protocol = TCP
AND destination port = 443
THEN ALLOWAn Access Control List (ACL) is an organized set of traffic-control rules.
ACLs may be used on routers, Layer 3 switches, firewalls, and other network devices.
For example:
ALLOW 10.0.0.0/24 -> 10.0.20.10 TCP/443
ALLOW 10.0.0.0/24 -> DNS TCP/UDP 53
DENY ANY -> 10.0.20.0/24Actual syntax varies by platform, and production rules must be tested with appropriate attention to rule order and implicit policies.
ACLs should follow the principle of least privilege.
Instead of allowing all communication between large networks, administrators should identify the specific systems and services that require access.
For more information about network traffic and the devices enforcing these policies, see Routers, Switches and Network Devices.
What Is a Next-Generation Firewall (NGFW)?
A Next-Generation Firewall (NGFW) extends traditional firewall capabilities with additional application-aware and threat-focused security features.
Traditional firewalls primarily enforce network traffic rules based on addresses, ports, protocols, and connection state.
An NGFW may integrate:
- Application identification and control
- Intrusion prevention
- URL filtering
- Threat intelligence
- Identity-based policies
- Supported malware detection
- Deep packet inspection
- Centralized logging and monitoring
The exact feature set varies across vendors and products.
How Does an NGFW Work?
A simplified architecture looks like:
INTERNET
|
v
+-------------------+
| NGFW |
+-------------------+
| | |
v v v
IPS URL APPLICATION
FILTERING CONTROL
| | |
+-------+-------+
|
v
INTERNAL LANAn NGFW may identify traffic based on the actual application rather than relying exclusively on traditional port numbers.
For example, it might recognize a particular web application even when several applications use TCP port 443.
Application awareness and intrusion prevention can improve security policy precision, but they do not remove the need for proper configuration, software updates, or endpoint protection.
Deep Packet Inspection
Deep Packet Inspection (DPI) examines packet information beyond basic network headers, where available.
Depending on the platform, it may analyze application protocol information, content indicators, or other supported traffic characteristics.
However, encryption changes what can be observed.
When traffic is protected by TLS, a firewall that does not terminate or decrypt that connection cannot automatically read the protected application payload.
Some organizations use carefully controlled TLS inspection where justified and technically supported.
TLS inspection introduces privacy, compatibility, performance, certificate-management, and security implications.
It should be implemented only under an appropriate organizational policy and after evaluating the impact on users and applications.
Network-Based vs Host-Based Firewalls
Firewalls can operate at different points in a network.
Network-Based Firewalls
A network firewall controls traffic passing between network segments or security zones.
Typical implementations include hardware appliances, virtual firewalls, cloud firewall services, and NGFW platforms.
For example:
INTERNET
|
v
NETWORK FIREWALL
|
v
OFFICE LANNetwork firewalls are useful for enforcing policies between departments, connecting offices, protecting data centers, and controlling internet access.
Host-Based Firewalls
A host-based firewall runs directly on an endpoint or server.
It controls traffic entering or leaving that specific system according to local or centrally managed rules.
Examples include Windows Defender Firewall and Linux firewall tools that configure the kernel’s packet-filtering facilities.
INTERNET / LAN
|
v
COMPUTER
+-------------------+
| HOST FIREWALL |
| |
| ALLOW / BLOCK |
+-------------------+
|
v
APPLICATIONSHost firewalls are valuable because not all threats originate outside the organization.
A compromised workstation may attempt to contact another internal system without passing through the company’s perimeter firewall.
Combining network firewalls and host-based controls supports defense in depth.
Windows Firewall: Configuration and Useful PowerShell Commands
Windows includes a built-in firewall managed through Windows Defender Firewall and associated security tools.
Administrators can inspect firewall profiles and rules through PowerShell.
Check Windows Firewall Profiles
Run:
Get-NetFirewallProfileThis displays configured settings for the Domain, Private, and Public firewall profiles.
To examine active profile policy information more explicitly, use:
Get-NetFirewallProfile -PolicyStore ActiveStoreList Windows Firewall Rules
To list firewall rules:
Get-NetFirewallRuleTo display enabled rules:
Get-NetFirewallRule |
Where-Object { $_.Enabled -eq "True" }Administrators can also inspect profile information using:
netsh advfirewall show allprofilesEnable Windows Firewall Profiles
The following command enables the three common firewall profiles:
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled TrueThis changes the firewall configuration and should only be used after verifying the intended policy.
On remotely administered systems, firewall changes can interrupt administrative access.
Administrators should maintain an approved recovery method and test changes before applying them widely.
Microsoft provides additional command guidance in its Get-NetFirewallProfile and Set-NetFirewallProfile documentation.
Linux Firewall: nftables, UFW, and firewalld
Linux systems commonly use the kernel’s Netfilter infrastructure for packet filtering and related network operations.
Several tools can configure firewall behavior, including:
- nftables
- UFW
- firewalld
- iptables compatibility interfaces
The appropriate tool depends on the Linux distribution, installed packages, and system-management model.
nftables
nftables provides a modern framework for packet filtering and classification.
To inspect the current ruleset:
sudo nft list rulesetThis command is useful for understanding active packet-filtering configuration.
Administrators should avoid modifying nftables rules without understanding how the system manages them, especially when other tools or services also configure firewall policies.
Ubuntu’s official nftables documentation explains the architecture and available management interfaces.
UFW
UFW, or Uncomplicated Firewall, simplifies firewall configuration on supported Linux distributions.
To inspect its status:
sudo ufw status verboseTo permit SSH on its conventional TCP port:
sudo ufw allow 22/tcpTo permit HTTPS:
sudo ufw allow 443/tcpTo deny Telnet:
sudo ufw deny 23/tcpThese commands modify firewall policy.
On a remote system, verify the actual SSH port and ensure that administrative connectivity will remain available before applying changes.
If another firewall manager controls the same underlying rules, configuration interactions may produce unexpected behavior.
firewalld
firewalld provides a management interface for firewall policies and security zones on supported Linux distributions.
It is widely used in several enterprise-oriented Linux environments.
Administrators can inspect the active configuration using supported firewall-cmd operations.
For Linux network diagnostics beyond firewall rules, consult our Linux Network Tools Guide and Linux Server Administration.
Firewall Zones and Network Segmentation
Many enterprise firewalls organize traffic according to security zones.
A zone represents a group of interfaces, networks, or resources associated with a particular security policy.
Common zones include:
- Outside or internet
- Inside or internal LAN
- DMZ
- Management
- Guest
- Server or application networks
- VPN access zones
For example:
INTERNET
|
v
+------------+
| FIREWALL |
+------------+
/ | \
/ | \
v v v
DMZ LAN MANAGEMENT
| | |
v v v
Web Server Users Admin SystemsThe firewall can apply different rules depending on the source and destination zones.
For example, internet users might access a public web application while being denied direct communication with the internal management network.
Similarly, guest devices can be restricted from accessing corporate servers.
Network segmentation is most effective when the corresponding traffic paths are controlled by suitable firewalls, ACLs, or other policy-enforcement mechanisms.
What Is a DMZ in Network Security?
A DMZ, or demilitarized zone, is a network segment designed to host services that require external connectivity while limiting their direct access to more trusted internal systems.
Typical DMZ services include web servers, reverse proxies, public DNS services, and mail gateways.
A simplified architecture might look like:
INTERNET
|
v
FIREWALL
/ \
/ \
v v
DMZ INTERNAL LAN
| |
Web Server Employees
Mail Gateway Internal AppsA compromised public-facing server should not automatically provide unrestricted access to employee workstations or internal databases.
For example:
| Source | Destination | Policy |
|---|---|---|
| Internet | Public web server TCP 443 | Allow |
| Internet | Internal database | Deny |
| Web application | Required database service | Allow only required traffic |
| DMZ server | Employee workstations | Deny |
| Admin VPN | Approved management interfaces | Allow according to policy |
A DMZ is not an inherently secure network just because it has a particular name.
Its security depends on the isolation, routing, access controls, and monitoring implemented around it.
Ingress and Egress Filtering
Firewall policies should consider both incoming and outgoing traffic.
Ingress Filtering
Ingress filtering controls traffic entering a network or security zone.
For example, a perimeter firewall may allow HTTPS traffic to a public application while blocking unauthorized access to internal services.
INTERNET
|
| INBOUND CONNECTION
v
FIREWALL
|
v
APPROVED SERVICEEgress Filtering
Egress filtering controls traffic leaving a network or security zone.
This is important because compromised devices may attempt to connect to attacker-controlled infrastructure.
For example, malware on an internal workstation may attempt to contact an external command-and-control service.
An appropriately configured egress policy can restrict some unwanted connections.
COMPROMISED DEVICE
|
| OUTBOUND CONNECTION
v
FIREWALL
|
X
BLOCKEgress filtering can also help reduce accidental data exposure and unauthorized application traffic.
However, it requires careful planning to avoid disrupting necessary business services.
Firewalls should therefore be considered security controls for communication in multiple directions, not merely barriers against inbound internet traffic.
Network Address Translation (NAT) and Firewalls
Network Address Translation (NAT) changes addressing information in packets as they pass through a translation device.
NAT is commonly implemented on routers and firewall appliances.
For example, a private client using 192.168.1.50 may access the internet through a public address such as 198.51.100.20.
PRIVATE CLIENT
192.168.1.50
|
v
FIREWALL / NAT
|
v
PUBLIC INTERNET
198.51.100.20Port forwarding may also be used to direct inbound connections to a private server.
For example:
PUBLIC IP:443
|
v
FIREWALL / NAT
|
v
10.0.10.20:443However, NAT and firewall security are not the same thing.
NAT translates addresses or ports.
A firewall enforces traffic-control policies.
Although the two functions often operate on the same appliance, administrators should evaluate them separately.
A NAT rule does not necessarily imply that traffic is authorized, and a firewall rule does not automatically provide address translation.
Firewalls in Cloud Computing
Cloud environments also use firewall-like security controls.
However, cloud networking differs from traditional on-premises infrastructure because policy enforcement may be distributed across virtual networks, interfaces, managed security services, and workload-specific controls.
Common categories include:
- Virtual network security rules
- Instance or workload-level security groups
- Subnet-level access controls
- Managed network firewall services
- Application-layer web firewalls
- Host-based firewall policies
Cloud administrators should understand whether a particular control is stateful or stateless, where it operates, and how it interacts with other security policies.
A workload may be protected by several independent controls.
For example:
INTERNET
|
v
CLOUD EDGE POLICY
|
v
CLOUD WAF
|
v
NETWORK FIREWALL
|
v
WORKLOAD SECURITY
RULES
|
v
WEB APPLICATIONThese controls should be configured according to least privilege rather than assuming that cloud infrastructure is automatically secure.
To understand the underlying infrastructure model, see Cloud Computing Explained and Network Access Control (NAC).
Firewall Logging and Monitoring
A firewall should generate useful operational and security logs.
Depending on the platform, a log event may contain:
- Timestamp
- Source and destination IP addresses
- Source and destination ports
- Protocol
- Security zones or interfaces
- Rule identifier
- Action taken
- Application information
- Threat detection indicators
A simplified event might look like:
2026-10-12 14:32:05
SRC=203.0.113.45
DST=10.0.10.20
PROTO=TCP
DPORT=3389
ACTION=DENY
RULE=105This example shows a denied connection attempt to TCP port 3389.
However, one denied event does not automatically prove an attack.
Administrators need context, frequency analysis, correlation with other events, and knowledge of the intended network behavior.
Why Firewall Logs Matter
Firewall logs can help identify port scanning, unexpected access attempts, configuration mistakes, suspicious outbound communication, and possible security incidents.
They are also useful for determining why an application cannot connect to a destination.
However, logging every packet without appropriate filtering and retention can generate large data volumes.
Organizations should balance visibility with storage capacity, performance, privacy, and monitoring requirements.
For larger environments, firewall events may be forwarded to a Security Information and Event Management platform.
Read SIEM Explained for an introduction to centralized logging and security event correlation.
Firewall vs IDS vs IPS
Firewalls, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS) are related but different security technologies.
A firewall primarily enforces communication policy.
An IDS analyzes relevant activity and generates alerts when it detects potentially suspicious behavior.
An IPS can also block or otherwise act on detected activity, depending on its deployment and configuration.
| Technology | Primary Function |
|---|---|
| Firewall | Allows or denies traffic according to policy |
| IDS | Detects and reports suspicious activity |
| IPS | Detects and can block suspicious activity |
| NGFW | Combines firewalling with additional security capabilities |
A modern NGFW may include integrated IPS functionality.
However, integrating multiple functions into one platform does not eliminate the conceptual differences between these technologies.
For more information, explore Intrusion Detection and Prevention Systems.
Firewall and VPN Integration
Firewalls and VPNs are frequently deployed together.
A VPN establishes protected network connectivity, while firewall policies determine which resources connected users can reach.
For example:
REMOTE USER
|
v
INTERNET
|
v
VPN GATEWAY
|
v
FIREWALL POLICY
|
+---- Approved Application
|
+---- Authorized Server
|
X---- Restricted DatabaseA successful VPN connection should not automatically provide access to every internal network.
Organizations should distinguish remote employees, administrators, contractors, and other authorized users according to their access requirements.
Firewall policies may enforce restrictions based on VPN address pools, user identity, device information, and destination resources, depending on the platform.
For a detailed explanation of encrypted tunnels, remote-access architectures, and routing, see VPNs Explained: Protocols, Encryption, Tunneling and Security.
Firewall Rule Design Best Practices
A secure firewall deployment begins with carefully designed policies.
1. Use Default Deny Where Appropriate
A restrictive policy normally permits explicitly authorized services and denies other traffic.
For example:
ALLOW Required HTTPS Traffic
ALLOW Approved DNS Traffic
ALLOW Necessary NTP Traffic
ALLOW Authorized Administration
DENY Other Unauthorized TrafficThe actual rules must reflect legitimate operational requirements, including return traffic, routing, and required infrastructure services.
2. Apply Least Privilege
Avoid unnecessarily broad rules such as:
ANY -> ANY -> ALLOWInstead, identify the actual source, destination, application, and service requirements.
For example:
Source: 10.10.20.0/24
Destination: 10.20.30.40
Protocol: TCP
Port: 443
Action: ALLOWA narrow rule is easier to review and reduces unintended exposure.
3. Document Important Rules
Each significant rule should have a clear purpose.
Example:
Rule ID: 120
Purpose: Approved web application access
Source: Public Internet
Destination: Public Web Cluster
Service: TCP/443
Owner: Web Operations Team
Review Date: 2027-03-09Documentation helps future administrators understand why a rule exists.
4. Review and Remove Unused Rules
Over time, firewalls accumulate rules for old applications, retired servers, temporary projects, or obsolete VPN configurations.
Regular reviews should identify duplicate, unused, expired, shadowed, and overly permissive rules.
Rule cleanup should be based on evidence and approved change procedures, not on assumptions from low traffic counts alone.
5. Test Firewall Changes
Changes to production firewall policy should be validated before deployment.
Administrators should consider the affected applications, routing behavior, stateful sessions, NAT requirements, and rollback procedures.
A single incorrect rule can interrupt remote access, DNS, business applications, or monitoring systems.
6. Maintain Configuration Backups
Firewall configurations should be backed up securely.
Backups may contain sensitive information, including internal addressing, security rules, or secrets.
Access to these backups should be restricted.
7. Keep Firewall Software Updated
Firewall appliances, operating systems, and management interfaces can contain vulnerabilities.
Security updates should be evaluated according to risk, tested where appropriate, and applied through a controlled maintenance process.
Firewall Troubleshooting: Step-by-Step Guide
Firewall problems are often mistaken for routing, DNS, or application failures.
A structured troubleshooting process helps administrators identify the actual cause.
Imagine a user cannot access a web application hosted at 10.0.0.20 on TCP port 443.
Step 1: Verify Connectivity
On Windows:
Test-NetConnection 10.0.0.20 -Port 443On Linux:
nc -vz 10.0.0.20 443These tests can help determine whether a TCP connection can be established.
However, they do not prove that the entire application is functioning correctly.
Step 2: Check DNS
If the application is accessed using a hostname, verify that the name resolves to the expected destination.
For example:
nslookup example.comor:
dig example.comIf the hostname resolves incorrectly, the problem may involve DNS rather than a firewall rule.
Read DNS Explained for further troubleshooting background.
Step 3: Inspect Routing
On Linux:
ip routeOn Windows:
route printVerify that the destination network is reachable through the expected gateway and that a return route exists.
Step 4: Review Firewall Policy
Check the source address, destination address, protocol, service port, interfaces, security zones, rule order, NAT policy, and connection state.
Also examine whether the relevant rule logs an allow or deny decision.
Step 5: Check the Destination Server
Even if firewall traffic is permitted, the destination service must be running.
On Linux:
sudo ss -lntpOn Windows:
Get-NetTCPConnection -State ListenVerify that the application is listening on the expected address and port.
Step 6: Check Application Health
A server may accept TCP connections but still fail to process application requests.
For HTTPS, a test such as:
curl -I https://example.comcan help inspect the HTTP response.
Interpret results in context and avoid disabling certificate validation merely to make a failing test succeed.
Step 7: Correlate Logs
Review firewall, reverse proxy, operating system, and application logs.
The objective is to determine precisely where the communication fails.
A firewall cannot repair an application that is not listening, and restarting an application will not resolve a denied firewall rule.
Real-World Firewall Troubleshooting Example
Consider the following web application architecture:
USER
|
v
INTERNET
|
v
FIREWALL
|
v
REVERSE PROXY
|
v
WEB SERVER
|
v
APPLICATION
|
v
DATABASEUsers report that the website is unavailable.
Instead of immediately restarting servers or changing firewall policies, the administrator can investigate the path systematically.
First, verify public DNS resolution.
Next, test TCP connectivity to the public application endpoint.
Then review firewall and NAT policies.
If the firewall reports denied traffic to TCP port 443, the issue may involve policy configuration.
If traffic is allowed and reaches the reverse proxy, continue investigating proxy upstream configuration, web server health, application responses, and database connectivity.
This layered method reduces unnecessary changes and makes the investigation more reproducible.
Firewall Architecture for Small Businesses
A small business may need to protect employee devices, internal servers, Wi-Fi, and guest networks.
A simplified design might look like:
INTERNET
|
v
FIREWALL
|
+---------+---------+
| | |
v v v
OFFICE SERVERS GUEST
LAN NETWORK WI-FI
| | |
v v v
Employees Business Visitors
SystemsRecommended priorities include separating guest access, restricting administrative interfaces, enabling appropriate host firewalls, maintaining device updates, and reviewing firewall logs.
The business should also protect firewall administration with strong authentication and maintain secure configuration backups.
A small organization may not need an advanced enterprise NGFW to achieve meaningful security improvements.
Correct configuration and ongoing maintenance are essential regardless of product size.
Enterprise Firewall Architecture
Larger organizations often deploy multiple security enforcement points.
A common architecture includes a perimeter firewall, isolated DMZ services, internal segmentation, host-based controls, and centralized monitoring.
For example:
INTERNET
|
v
EDGE PROTECTION
|
v
PERIMETER FIREWALL
|
+----------+----------+
| |
v v
DMZ INTERNAL FIREWALL
| |
Public Web +----+----+
Mail Gateway | |
v v
USERS SERVERS
|
v
DATABASE ZONEAdditional controls may include:
- Intrusion detection and prevention
- Endpoint Detection and Response
- Network Access Control
- SIEM monitoring
- Identity-aware authorization
- Remote-access VPNs
- Host-based firewalls
- Security-zone segmentation
The purpose is to reduce dependence on a single security device and limit the impact of a successful compromise.
For related infrastructure concepts, see Servers and Infrastructure Explained.
Firewall vs Router vs Proxy vs WAF
Several networking technologies are often confused with firewalls.
| Technology | Main Function |
|---|---|
| Router | Forwards traffic between networks |
| Firewall | Enforces network traffic security policies |
| Proxy | Acts as an intermediary for supported communications |
| IDS | Detects potentially suspicious activity |
| IPS | Detects and can block certain suspicious activity |
| NGFW | Combines firewalling with additional inspection and security functions |
| WAF | Applies security controls to web application traffic |
A modern firewall appliance may combine routing, NAT, VPN, IPS, and application-control features.
However, those features remain distinct concepts.
Network Firewall vs Web Application Firewall
A Web Application Firewall (WAF) focuses on HTTP and HTTPS application traffic.
It can help detect or block certain attacks targeting web applications, depending on its capabilities and configuration.
A network firewall is usually more focused on controlling communications between hosts and networks.
Consider:
INTERNET
|
v
NETWORK FIREWALL
|
v
WEB APPLICATION FIREWALL
|
v
WEB APPLICATIONA WAF complements a network firewall but does not replace secure application development, authentication, authorization, or software patching.
The two technologies address different parts of the security problem.
Firewalls and Zero Trust Architecture
Traditional network security often relied heavily on distinguishing trusted internal networks from untrusted external networks.
However, modern environments include remote workers, cloud applications, mobile devices, contractors, and distributed infrastructure.
A Zero Trust architecture avoids granting broad trust solely because a device is connected to an internal network.
Instead, access decisions may consider:
- User identity
- Device identity
- Device security posture
- Requested application
- Requested resource
- Contextual risk
- Authorization policies
Firewalls remain useful in Zero Trust environments because network-level enforcement and segmentation still matter.
The difference is that firewall policies can be combined with identity-focused controls rather than relying exclusively on source network location.
For related identity and network security principles, read Cybersecurity for Beginners and Network Security Basics.
Common Firewall Configuration Mistakes
Even advanced firewalls can provide weak protection when configured incorrectly.
Allowing Unnecessary Traffic
Broad rules such as ANY -> ANY -> ALLOW can create excessive access between networks.
Use narrowly defined rules wherever practical.
Exposing Administrative Services
Avoid unnecessarily exposing SSH, RDP, firewall management interfaces, and database ports directly to the public internet.
Use appropriate management networks, approved remote-access mechanisms, and strong authentication.
Ignoring Egress Traffic
Outbound traffic can create security risks when compromised systems communicate with external destinations.
Design egress restrictions according to legitimate application requirements.
Relying Only on Perimeter Security
Internal lateral movement may not pass through the internet-facing firewall.
Use internal segmentation and host-based controls where appropriate.
Keeping Obsolete Rules
Old rules may remain active after applications and servers have been retired.
Periodic reviews can reduce policy complexity and exposure.
Making Changes Without Testing
Firewall configuration errors can interrupt critical services.
Maintain a rollback plan, review expected traffic flows, and validate changes before broad deployment.
Ignoring Firewall Logs
Without useful logging, administrators may struggle to explain blocked connections or investigate suspicious events.
Log collection should be paired with meaningful analysis and monitoring.
Firewall Security Checklist
Use this checklist when reviewing an existing firewall deployment.
Firewall Policy
-
Unnecessary inbound services are blocked.
-
Appropriate default-deny policies are applied.
-
Rules follow least-privilege principles.
-
Administrative access is restricted.
-
Unused rules are reviewed and removed.
-
Important rules have a documented owner and purpose.
Network Architecture
-
Security zones are clearly defined.
-
Guest networks are appropriately isolated.
-
Public-facing services are separated from sensitive internal systems.
-
Server-to-server access is restricted where appropriate.
-
Outbound traffic policies are reviewed.
-
VPN access follows explicit authorization requirements.
Monitoring and Operations
-
Relevant firewall logs are enabled.
-
Security events are monitored.
-
Firewall software and firmware are maintained.
-
Configuration backups are protected.
-
Rule changes follow a controlled process.
-
Recovery procedures are documented and tested.
Advanced Security
-
Intrusion prevention is considered where appropriate.
-
Application-aware controls are evaluated.
-
Threat intelligence is used where useful.
-
Identity-aware policies are reviewed.
-
TLS inspection risks are understood before deployment.
-
Firewall capacity and high availability meet operational requirements.
Frequently Asked Questions
What Is a Firewall in Simple Terms?
A firewall is a security control that allows or blocks network communication according to configured rules and policies.
How Does a Firewall Work?
A firewall examines network traffic, compares it against the relevant security policy, and takes an action such as allowing, dropping, or rejecting the traffic.
Some firewalls also track connection state or inspect supported application information.
What Is the Difference Between Stateless and Stateful Firewalls?
A stateless firewall evaluates packets independently.
A stateful firewall maintains connection information and uses that context when processing traffic.
What Is a Next-Generation Firewall?
A Next-Generation Firewall combines traditional firewall capabilities with features such as application awareness, intrusion prevention, URL filtering, and other supported security functions.
What Is the Difference Between a Firewall and Antivirus?
A firewall primarily controls network communication.
Antivirus and endpoint security tools focus on detecting or responding to malicious software and activity on individual systems.
The two technologies are complementary.
Does a Firewall Stop Hackers?
A firewall can reduce exposure and block unauthorized network connections, but it cannot prevent every attack.
Attackers may exploit allowed applications, stolen credentials, software vulnerabilities, or human behavior.
Firewalls should therefore operate as part of a broader security strategy.
Should Every Computer Have a Firewall?
Most computers benefit from host-based firewall protection, even when a network firewall is already deployed.
A dedicated hardware firewall is not required for every individual computer.
Can a Firewall Protect Against DDoS Attacks?
Some firewalls provide rate limiting and related controls.
However, large-scale Distributed Denial-of-Service attacks can exceed the capacity of a firewall or internet connection.
Specialized upstream mitigation may be necessary.
What Is a DMZ?
A DMZ is a network segment used to isolate services that require external connectivity from more sensitive internal networks.
What Is the Difference Between a Firewall and a Router?
A router forwards packets between networks.
A firewall enforces security policies controlling which traffic may pass.
One device may provide both functions.
Is NAT the Same as a Firewall?
No.
NAT changes addressing information, while a firewall evaluates traffic against security policy.
They are frequently implemented together but perform different functions.
What Is a Web Application Firewall?
A WAF applies security policies to web application traffic, typically HTTP and HTTPS.
It complements network firewalls and application security controls.
What Is the Best Firewall Configuration?
There is no universal configuration that suits every environment.
A strong design generally combines least-privilege rules, appropriate default-deny behavior, network segmentation, secure management, logging, updates, and regular policy reviews.
Key Takeaways
A firewall is not simply a device that blocks hackers.
It is a network security enforcement mechanism that controls communication according to defined policies.
The most important concepts to remember are:
- Firewall rules define permitted and denied traffic.
- Stateless inspection evaluates packet criteria independently.
- Stateful inspection uses connection-tracking information.
- Access Control Lists provide structured traffic-filtering rules.
- Next-Generation Firewalls add supported application and threat-focused capabilities.
- DMZs help isolate externally accessible systems.
- Ingress and egress filtering control traffic in different directions.
- Host-based firewalls add protection directly to computers and servers.
- Firewall logging supports investigation and troubleshooting.
- Least privilege reduces unnecessary network exposure.
- Network segmentation limits communication between security zones.
- Firewall maintenance and testing are essential for reliable operation.
A properly designed firewall does not attempt to make every system unreachable.
Instead, it ensures that network communication is intentional, controlled, observable, and consistent with security requirements.
Conclusion
Firewalls remain essential components of modern network security.
From home networks to enterprise data centers and cloud infrastructure, they help administrators control communication, reduce attack exposure, and enforce security policies.
Understanding how firewalls work requires more than memorizing port numbers or creating simple allow-and-deny rules.
Network professionals should understand stateless and stateful inspection, ACLs, security zones, DMZ architecture, NAT, application-aware filtering, logging, and troubleshooting.
Equally important is understanding how firewalls interact with VPNs, identity systems, intrusion prevention, endpoint protection, and Zero Trust architecture.
No single firewall can eliminate every cybersecurity risk.
The strongest approach is to combine well-designed firewall policies with appropriate network segmentation, least-privilege access, continuous monitoring, secure administration, and tested recovery procedures.
To continue learning, explore our related guides on VPNs Explained, Intrusion Detection and Prevention Systems, Network Security Basics, and TCP/IP Explained.