Firewalls were initially walls within buildings that helped contain the spread of fires. Since the late 1980s, however, firewalls have come to be more commonly associated with network security as an essential line of defense against external threats seeking unauthorized access to private networks.
Depending on the needs and size of an organization, a firewall can be a physical device, a hardware firewall, a software firewall, or a service like cloud-based firewalls or Firewalls-as-a-Service (FaaS). Regardless of the firewall type, the basic principle is the same. They all use predefined security rules to block or allow network traffic to travel between a trusted network, like an office network, and an untrusted network, like the Internet. By analyzing individual packets of data, firewalls prevent cyberattacks, protect sensitive data, and help maintain the privacy of computers, servers, and networks.
Firewalls operate at both the network and local levels. At the network level, a firewall acts as a barrier between an internal network, like a corporate intranet, and an external network, like the Internet. It creates choke points where all incoming and outgoing network traffic can be monitored and controlled based on predetermined security rules and policies. Network administrators often write these rules to meet the specific needs of their network. Much like a security guard who monitors a building entrance, these firewalls check the ‘credentials’ of network traffic before allowing it through.
At the local level, a software firewall can be installed on individual computers for an additional layer of security. Local firewalls are limited to monitoring the network traffic of that specific computer. They can identify a range of suspicious activities, including attempts to connect to the computer from an unknown source or control when applications can access the network.
Most conventional firewalls are external and focus on monitoring traffic moving between internal and external networks. However, organizations with particularly sensitive departments or systems, like research or industrial manufacturing systems, must also monitor internal traffic. They meet this challenge with internal firewalls that create internal subnetworks that are only accessible by trusted internal parties.
Despite differences in their objectives, each of these firewalls operates according to the same technical principles. When network traffic arrives in the form of a data packet, the firewall will analyze some or all the following information:
The source IP address (who sent it)
The destination IP address (where it is going)
The associated port (the service using the data)
Network operation and status flags (how data is sent and received)
The data to be delivered
This information is compared to the security rules and policies to determine if the packet should be delivered, dropped, denied, or routed to a different recipient. Information about traffic and connections is also logged for further analysis. The type of firewall will determine the depth of analysis and security options available to security teams. However, all firewalls are crucial to effective IP address management. This process can include hiding internal IP addresses from external networks or enforcing security policies for different segments within an internal network.
While firewalls effectively deliver network protection, they are not designed to work solo against malware or other infections, like Advanced Persistent Threats (APTs). For this reason, Next-Generation Firewalls (NGFWs) might offer integrated Intrusion Prevention Systems (IPS) or sandboxing technologies to help detect threats within files. Furthermore, security and IT teams should also integrate firewalls with additional security solutions, such as Security Information and Event Management (SIEM) systems, Endpoint Detection and Response (EDR) solutions, and threat intelligence feeds to provide a comprehensive security posture.
Most organizations rely heavily on communication with external networks, like the Internet, to make sales, communicate with clients, and pay suppliers. While the productivity gains are enormous, connecting with external networks makes their internal networks easier for someone with an internet connection and the right tool to discover them.
Firewalls can help reduce this risk by:
Centralizing network traffic to minimize attack pathways: This includes channeling all network communication through a single point to limit the number of open connections between private and external networks. This makes it easier to manage and mitigate security threats.
Preventing Remote Access: A firewall can prevent remote access to a network or system unless authorized. This is important because it prevents remote logins from hackers who try to access and steal data.
Mitigating DDoS Attacks: Firewalls can help mitigate Distributed Denial of Service (DDoS) attacks. In a DDoS attack, a network is flooded with traffic until it becomes unavailable. Firewalls can identify and block such traffic.
Enforcing Policy: Firewalls can also enforce network security policies. Administrators can configure a firewall to block access to specific sites, ensuring network computers cannot be used to access unauthorized or inappropriate websites.
Hardware firewalls are physical devices installed between computers and the external network. Typically used by organizations to protect many devices, they require professional knowledge to configure and manage. However, they can offer better network performance as they do not consume any resources of the devices in the network.
Software firewalls use the same technology as hardware firewalls, but they are software solutions deployed on servers, virtual machines, virtualized networks, or cloud environments. They are easier to deploy and manage than hardware firewalls and can protect the entire network or individual devices.
Internal firewalls control and monitor internal traffic between trusted networks. They can help segment these networks to provide an additional layer of protection.
Network firewalls are positioned between trusted and untrusted networks to monitor and control incoming and outgoing traffic. They protect an entire network of connected devices, including computers, servers, printers, and IoT devices.
Host-based firewalls are installed on individual network devices. They are typically software solutions and can provide access to specific applications and services not permitted under default firewall settings.
Stateless inspection firewalls are first generation firewall technology with basic filtering of packets as they travel between networked devices. They filter packets based on IP addresses, ports, and packet protocols. Each packet is analyzed in isolation, with no context regarding the state of the connection or the data being sent.
Stateful inspection firewalls are the most well-known type of firewall. It controls and monitors traffic based on the state, port, and protocol. It can monitor all activity from opening a connection until it is closed. The filtering decisions are made based on administrator-defined rules and context. This means it can use information from previous connections to confirm that packets belong to the same connection.
Proxy firewalls are also known as application-level firewalls because they apply rules to determine which applications are allowed to send and receive data from external networks. They a data packet’s content, or payload, and prevent direct connections between internal users and external services.
Web application firewalls (WAF) are placed in front of websites to monitor and control Hypertext Transfer Protocol (HTTP) traffic. They filter any potentially harmful traffic that might exploit web vulnerabilities.
Next-generation firewalls (NGFWs) offer the highest firewall protection and combine conventional firewall technology with additional security features like deep packet inspection, malware filtering, antivirus, IPS/IDS, application control, and more.
Early Days (1990s): Stateless Packet Filtering
The first generation of firewalls relied on stateless packet filtering. These basic systems analyzed individual data packets based on pre-defined rules, including source and destination IP addresses, ports, and protocols. However, they lacked context about ongoing connections, making them vulnerable to spoofing attacks and complex threats.
Stateful Inspection (Early 2000s)
Stateful inspection firewalls addressed the limitations of stateless filtering. They tracked the state of network connections, monitoring the entire communication flow from initiation to closure. This development allowed for more granular control and better detection of suspicious activity.
Proxy Firewalls (1990s - Present)
Proxy firewalls, also known as application-level firewalls, act as intermediaries between internal users and external services. They inspect the content (payload) of data packets and enforce rules based on applications allowed to communicate. While offering strong security, they can impact network performance.
Web Application Firewalls (WAFs) (2000s - Present)
As web applications became prevalent, WAFs emerged to protect them specifically. These firewalls sit in front of web servers and analyze incoming HTTP traffic, filtering out malicious requests that might exploit vulnerabilities.
Next-Generation Firewalls (NGFWs) (2008 - Present)
NGFWs represent the current pinnacle of firewall technology. They combine traditional firewall functionalities with advanced features like deep packet inspection, intrusion prevention systems (IPS), application control, and malware detection. This approach offers robust protection against a broader range of threats.
The Future of Firewalls
Firewall technology is constantly evolving to keep pace with the ever-changing threat landscape. Machine learning (ML) integration is increasingly used for anomaly detection and automated threat response. Additionally, the rise of cloud computing necessitates firewalls that can adapt to dynamic and distributed network environments.
Firewalls are the cornerstone of network security, but their effectiveness depends on proper use and configuration.
Essential Uses:
Best Practices:
Home vs. Corporate Use:
Integration with Remote Connections:
As a first line of defense, firewalls are a critical component in any secure environment. However, they are best deployed as part of a multi-layered security strategy which ensures coverage against some limitations.
Limited threat detection: Firewalls are designed to block unauthorized access to a network, which can leave networks vulnerable to malware delivered via email attachments or malicious websites. If an authorized user executes these types of malware, they can bypass the firewall and infect the system.
Social engineering attacks: Firewalls provide limited protection against social engineering tactics, like phishing, where users are tricked into giving away sensitive information.
Insider threats: While firewalls can stop unauthorized access to a private network, they are less effective against malicious insiders with legitimate access to the network.
Zero-day threats: Firewalls can be susceptible to security vulnerabilities in software that are unknown, or do not have a patch to mitigate them.
Despite their limitations, firewalls remain a cornerstone of modern network security architecture. An effective line of defense, their capabilities are often used in conjunction with other security layers to provide a robust defense against cyberattacks.
Intrusion Prevention Systems (IPS): While firewalls focus on predefined rules, IPS take a more proactive approach. They analyze network traffic for suspicious behavior and can block potential attacks in real-time. Firewalls and IPS work together to provide a comprehensive defense against network-based threats.
Anti-Malware and Anti-Virus Software: Firewalls can't stop malware that infiltrates a system after it's already on the network. Antivirus and anti-malware software are essential to protect individual devices from these threats.
Data Loss Prevention (DLP): Firewalls can help control data flow, but DLP solutions go further. They can identify sensitive data and prevent unauthorized exfiltration, through legitimate channels.
Security Information and Event Management (SIEM): SIEM systems collect data from various security tools, including firewalls, IPS, and antivirus software. This allows for centralized monitoring and analysis, helping security teams identify and respond to threats more effectively.
Bitdefender GravityZone platform delivers a multi-layered security solution with an integrated firewall for protecting endpoints and Windows servers. With easy to manage rules and profiles, administrators can control the visibility of internal networks and the traffic flowing between them and external networks. Part of a robust network security solution that includes content control and network attack defense, GravityZone delivers unprecedented control over host-based network threats.
One of the firewall’s primary functions is to inspects the data packets travelling through a network. This action has the potential to impact network speeds. The size of the impact will be determined by the type of firewall used. For example, a packet filtering firewall provides limited packet analysis, so the impact on network performance is low. On the other hand, an application-level gateway provides deeper analysis which can have a negative impact on network speeds.
Configuring a firewall can be difficult depending on the type of firewall and the complexity of the environment it is protecting. While many vendors offer plug-n-play firewalls, to ensure peak network performance and security efficacy, it is recommended to consider a professional configuration for complicated networks comprised of multiple devices.
A firewall and a VPN serve different purposes. While each is concerned with network security, a firewall monitors and controls incoming and outgoing network traffic. A VPN, on the other hand, creates secure connections between a device and the internet. It does this by routing traffic through a server, encrypting it, and masking the origin of the data.