Firewall

A firewall is a network security system that monitors incoming and outgoing network traffic and decides whether to allow or block it based on a defined set of security rules. Positioned at the boundary between a trusted network, such as a home or office network, and an untrusted one, such as the broader internet, a firewall acts as a checkpoint, inspecting the traffic attempting to cross that boundary and filtering out connections that look suspicious, unauthorized, or simply unnecessary for the network’s legitimate purposes. Firewalls exist in many forms, from software running on an individual computer to dedicated hardware appliances protecting an entire corporate network.

How Firewalls Filter Traffic

The simplest firewalls use packet filtering, examining basic information in each data packet, such as its source and destination IP address and the specific port number it is trying to use, and comparing that information against a list of rules that specify what is allowed. A rule might permit web traffic on the standard web port while blocking traffic on a port commonly used by a known type of malicious software, for example. Packet filtering is fast and simple but has no awareness of whether a given packet is actually part of a legitimate ongoing conversation or an isolated, potentially malicious attempt.

Stateful firewalls improve on this by tracking the state of active network connections, remembering that a particular outgoing request was made and automatically allowing the corresponding expected response back in, while still blocking unsolicited incoming traffic that does not match any legitimate ongoing connection. The most advanced modern firewalls, often called next-generation firewalls, go further still, inspecting the actual content of traffic rather than just its headers, recognizing specific applications regardless of which port they use, and integrating with threat intelligence feeds that identify known malicious destinations, letting the firewall block connections associated with recognized attack infrastructure even if the traffic would otherwise look technically valid.

Where Firewalls Fit in a Security Strategy

A firewall is usually one layer within a broader security strategy rather than a complete solution on its own. Network firewalls sit at the boundary of an entire network, protecting every device behind them at once, while host-based firewalls run directly on an individual computer or server, adding a second layer of protection even if a threat somehow gets past the network-level firewall, and controlling which specific applications on that device are allowed to send or receive network traffic at all. Most modern operating systems, including Windows and macOS, include a built-in host-based firewall enabled by default.

Firewalls are generally effective at blocking unsolicited external connection attempts and enforcing basic network segmentation, but they are not designed to catch every kind of threat on their own; a user who is tricked into downloading malicious software through a phishing email, for instance, can still infect their own device even with a properly configured firewall in place, since the malicious traffic in that case originates from an action the user themselves initiated from inside the trusted network. This is why firewalls are typically deployed alongside other security tools, including antivirus software, intrusion detection systems, and user security awareness training, rather than relied upon as a single standalone defense.

Origins of Network Firewalls

The term firewall originally described a physical barrier built into a building specifically to slow or stop the spread of an actual fire from one section to another, and network security researchers borrowed the term in the late 1980s to describe software that similarly contained the spread of unwanted or dangerous network traffic. The earliest network firewalls, developed as organizations began connecting their internal networks to the wider, far less trusted internet, were simple packet filters, and the technology grew steadily more sophisticated through the 1990s and 2000s as attackers developed more advanced techniques for disguising malicious traffic as something more innocent-looking.

Cloud computing has added a further layer to how firewalls are deployed, with many organizations now relying on firewall capabilities built directly into their cloud provider’s infrastructure alongside, or sometimes instead of, traditional physical hardware firewall appliances. Some organizations now favor a security model called zero trust, which assumes no device or user should be automatically trusted just because it sits inside the traditional network boundary, applying firewall-like verification checks continuously throughout a network rather than relying mainly on a single perimeter boundary the way earlier firewall deployments typically did.

Frequently Asked Questions

What is the difference between a network firewall and a host-based firewall? A network firewall protects an entire network by filtering traffic at its boundary with outside networks, covering every connected device at once. A host-based firewall runs on an individual device and controls traffic for that specific device alone, providing an additional layer of protection even if a threat gets past the network firewall.

Can a firewall stop every kind of cyberattack? No. Firewalls are effective at blocking unauthorized network connection attempts, but they generally cannot stop threats that arrive through actions a legitimate user takes, such as opening a malicious email attachment or visiting a compromised website, which is why firewalls are used alongside other security measures rather than as a complete standalone defense.

What is a next-generation firewall? A next-generation firewall adds deeper inspection capabilities beyond basic packet filtering, including recognizing specific applications regardless of the network port they use, inspecting the actual content of traffic for threats, and integrating with external threat intelligence to block connections to known malicious destinations.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 2, 2026Researched and drafted with AI assistanceReport an issue