A firewall inspects every data packet crossing a network boundary, compares it to a set of rules, and then allows, blocks, or logs it. Acting as a barrier between internal assets and the external internet, firewalls filter traffic by approving safe transmissions and rejecting anything suspicious. The core methods include packet filtering, stateful inspection, and proxy services. So, how do firewalls work in practice, and which approach fits your organization best?
Key takeaways
- A firewall inspects every data packet at the network boundary, comparing it to a set of rules your team has created to allow, block, or log traffic before it reaches internal systems.
- Each of the core filtering methods (packet filtering, stateful inspection, proxy services, and next-generation firewalls) trades off speed, depth, and cost, so the right choice depends on your organization’s size and risk profile.
- Where you place your firewalls matters as much as which type you choose. Layering perimeter, segmentation, host-based, and cloud-based firewalls gives you broader coverage than any single position can.
- Firewalls can’t catch everything. IP spoofing, social engineering, or insider threats all fall outside of what a firewall can detect on its own, so pair it with antivirus, endpoint protection, and threat intelligence.
- Configuration is the difference between a strong defense and a false sense of security. Build rules around your actual business needs, and regularly audit as your network evolves.
Step-by-step guide to how a firewall works
To understand how firewalls work, let’s zoom in on each step that takes place once it’s in action:
- Traffic is monitored. The firewall constantly watches all incoming and outgoing network traffic, acting as a network gatekeeper. Every packet must pass through this checkpoint before it can enter or leave the network.
- The firewall reads the packet header. It pulls out identifying details, such as IP address, destination IP address, and protocol, and inspects them for any suspicious activity.
- The packet is matched against the rule base. The firewall compares each packet against the predefined security rules and typically stops at the first match.
- The firewall applies its filtering method. Depending on the type of firewall, this could mean simple packet filtering, stateful inspection that tracks the full connection, or a proxy that sits between the user and the destination server, forwarding requests so the two sides never communicate directly.
- Content is inspected (if supported by the filtering method). Next-generation and application-layer firewalls go deeper, scanning the actual payload for malware signatures, anomalous behavior, or policy violations.
- The firewall allows, drops, or rejects the packet Based on inspection and rules, legitimate traffic passes through to its destination. Potential threats are blocked and either dropped silently or rejected with a notification sent back to the sender.
- The action is logged. The firewall maintains detailed logs of every action, including the timestamp, IPs, port, matched rule, and decision made. It then generates alerts for suspicious activity or unauthorized access attempts, giving security teams the visibility into spot patterns and allowing them to fine-tune rules.
What a firewall checks in every packet
When the firewall pulls out identifying details from the packet header, it uses them to decide whether a packet should be passed or blocked. These details, such as IP addresses, ports, and protocols, are the configuration criteria that administrators use to build rules controlling internal and external data exchanges.
First, the source and destination IP addresses are examined to determine where the packet came from and where it’s going. The firewall then cross-references both addresses against the rule base to determine whether the route is trusted. Alongside the IPs, the firewall checks the port number to identify the specific service in use, such as port 80 for HTTP or port 443 for HTTPS, and to determine whether traffic on that port is permitted under the current company policy.
The protocol matters, too: by identifying whether the packet is using TCP, UDP, ICMP, or another protocol, the firewall verifies that it’s allowed for the given source, destination, and port combination.
All of these criteria work in tandem. For example, a packet might come from a trusted IP on an approved port but still be flagged if its payload carries a known threat signature—a pattern of code or behavior that matches a cataloged threat. Some advanced firewalls can also scan packets for specific keywords or phrases, blocking any traffic that contains flagged terms. Therefore, the more criteria a firewall can evaluate, the greater its control over what enters and leaves the network.
What a firewall rule looks like
Now we can look at an even more granular point: a single firewall rule. Basically, it’s a single line of instructions that tells the firewall what to do when a packet matches a specific set of conditions. Each rule defines who can talk to whom, over which port and protocol, and whether that traffic should be allowed or blocked. Here’s what two basic rules could look like in practice:
Rule | Action | Source IP | Destination IP | Port | Protocol | Log |
|---|---|---|---|---|---|---|
1 | Allow | 192.168.1.0/24 | 10.0.0.5 | 443 | TCP | Yes |
2 | Deny | Any | Any | 23 | TCP | Yes |
We have 2 cases, or 2 rules, where one allows a packet to go through and the other denies entry. Rule 1 lets any device on the internal network (192.168.1.0/24) reach the server at 10.0.0.5 over HTTPS (port 443). Rule 2 blocks all Telnet traffic (port 23) regardless of source or destination, since Telnet sends data unencrypted and is a common attack vector. Additionally, both rules have logging turned on, so every match gets recorded for the security team to review.
How firewalls filter traffic
The best starting point for answering the question of how a firewall works is separating hardware firewalls and software firewalls.
Hardware firewalls are independent of the devices they protect. They typically run on a separate appliance, such as a broadband router, that can connect to large numbers of network devices. Protection scales easily, which makes hardware firewalls a popular choice for defending on-premises networks.
Software firewalls on the other hand, are installed directly on the devices being protected. Windows Defender is the most common example, but there are many alternative providers. Software firewalls require installation and updating, and protect a single device at a time. The trade-off is precision: users can easily customize their filtering settings, making software firewalls a more targeted solution.
These firewall systems both filter data. And both come in many forms with different filtering methods. If you’re building or reviewing your firewall policy, NIST offers detailed recommendations on firewall security and deployment in their Guidelines on Firewalls and Firewall Policy (SP 800-41 Rev. 1) Now, let’s run through the core types of firewalls and explain how they distinguish between legitimate and malicious traffic.
Packet filtering
Packet filtering firewalls are the oldest and simplest type of firewall. A packet filtering firewall can be hardware- or software-based, and will usually be installed at switches or network routers.
Packet filtering assesses the surface of data packets. Packets are segments of data created by transfer protocols when they dismantle files and reassemble them at destination devices. Every data packet has a header. This header includes various pieces of information that packet-filtering firewalls can use to allow or deny access.
Data inspected by packet filtering firewalls include:
- Internet Protocol (IP) address information
- Source and destination ports of incoming data
- Transfer protocols being used in the transfer
When incoming traffic arrives at a packet-filtering firewall, the appliance gathers as much header information as possible. It then compares this information against pre-established security rules (or Access Control Lists). Any data packet that satisfies these security rules is admitted. If not, the packet filter firewall will deny access, and the transmission is canceled.
Packet filter firewalls carry out relatively superficial inspection processes. However, this can still protect the internal network. For instance, filtering IP addresses can admit approved devices. This could include remote workers or third-party maintenance teams. If managers screen out unknown IP addresses, they can limit the threat surface.
Alongside IP address filtering, packet filters can also limit accessible ports if required. This can minimize the risks of port scanning, which is a common precursor to cyberattacks.
On the other hand, packet filters do not open packets and inspect the payload inside. This can limit their effectiveness. Firewalls will also forward approved traffic automatically to available ports. So, limiting open ports may not be sufficient.
However, the limitations of packet filtering can also be strengths. This type of firewall is less resource-intensive. Packet filters are also faster. Both are useful traits in situations where security is not paramount.
Circuit-level gateways
Circuit-level gateways focus on data transfer protocols instead of packet headers. In most cases, this involves checking the Transmission Control Protocol (TCP) handshake.
Inspecting the TCP handshake verifies that every stage of the data transmission is legitimate. If the handshake flags, such as SYN or ACK, are transmitted logically, the firewall will allow access. If not, the firewall will either deny access or request a re-transmission to prove that the transfer is legitimate.
Stateful inspection
Stateful inspection firewalls use information about the state of data transfers when making decisions. In this setting, “state” refers to the context in which data transfers occur. This includes much more information than packet headers can provide.
A stateful inspection firewall will usually carry out 3 filtering operations:
- Packet inspection. Stateful inspection checks every packet entering the network. The firewall gathers information about the origin and destination of incoming traffic. It detects the device in use, active ports, and transfer protocols.
- TCP handshake verification. Firewalls verify that each stage of the TCP handshake is followed properly. This applies to inbound and outbound connections.
- Relevant data from the two stateful inspection stages is added to a state table. The firewall compares each packet to data contained within the state table. This generates a deeper picture of who is seeking to access the network.
Stateful inspection firewalls tend to be more precise and secure than packet filters. They use more data points and apply historical information to assess access requests. And they also contribute data to future filtering actions. The firewall “remembers” more about network access over time, allowing it to make better decisions.
Because they process more data, stateful firewall appliances can be slower and consume more bandwidth. Users must balance these demands with improved network security.
Proxy services
Also called application-level gateways, proxy service firewalls stand between network devices and the external internet. A proxy firewall is a separate gateway with its own IP address. This means that, until proxy firewalls approve access, data has no direct connection with internal assets.
Using a proxy service firewall helps you protect your network by adding an extra layer of separation. Cyberattackers cannot directly access network resources. Instead, they must pass through the proxy and the firewall together. This reduces the risk of illicit intrusion.
As described above, proxy firewalls apply handshake and packet filtering. But they may also add deep packet inspection (DPI) to the process. DPI examines data payloads within packets. This can expose infected packets and neutralize malware that would otherwise pass unnoticed.
While proxies generally deliver strong network security, they have some potential limitations:
- Speed. Because it adds an extra appliance between networks and the internet, proxy usage can impact network traffic speeds. This can be a burden for digital businesses.
- Compatibility. Some common business applications are also incompatible with proxy firewalls. Therefore, they aren’t always the best firewall option.
- Web-only. Some proxies only screen traffic entering web applications. Proxies may not be able to handle non-web traffic, such as DDoS floods or DNS queries.
NAT filtering
Network Address Translation (NAT) firewalls are another option when filtering traffic. In NAT systems, all network devices connect to a single gateway. Local devices have separate private IP addresses, but they share the IP address of the gateway.
A NAT firewall is part of this architecture. It only accepts incoming web traffic if it has been requested by a private IP address on the NAT system.
This type of firewall is common in home and small office networks, where multiple devices share a single public IP address. Because the NAT gateway only forwards inbound traffic that matches an active request from an internal device, unsolicited connections from the outside are dropped automatically. However, NAT firewalls run into problems when interacting with external cloud or web applications.
Web application firewalls
A web application firewall (WAF) works differently from the aforementioned types of firewalls. Instead of filtering general network traffic, a WAF sits in front of a specific web application and monitors HTTP and HTTPS requests. A WAF is not designed to defend against all types of attacks as it mainly inspects incoming traffic for attacks that target application-level vulnerabilities, such as SQL injection, cross-site scripting (XSS), and cookie manipulation. However, because traditional firewalls operate at the network and transport layers, they can’t catch these kinds of threats, which makes a WAF a necessary addition for any organization running public-facing web applications.
Next-generation firewalls
Next-generation firewalls (NGFWs) are the most up-to-date option for defending a private network. They are often called multilayer firewalls as they inspect traffic between OSI layers 2–7. By comparison, stateful firewalls generally inspect network traffic between layers 2–4.
Because they work at a wide OSI range, NGFWs can filter network traffic in far more detail. A next-generation firewall inspects the content of data packets. It applies insights from intrusion prevention systems (IPS).
Next-generation firewalls also incorporate context from other sources, such as IAM software and global threat databases. This makes it easier to detect recently identified malware. It also makes it easier to differentiate verified users from potentially malicious code.
NGFWs are the best way to maximize network security. On the other hand, they come with a higher price tag and consume the most network data. These factors make NGFWs an unsuitable network security solution for many smaller organizations.
Where a firewall sits in your network
You can place a firewall virtually anywhere you need on your network, depending on what you need to protect and where you want to have visibility over the traffic. Most networks use firewalls in more than one position, layering them for broader coverage.
- Perimeter firewalls sit at the edge of your internal network, right where it meets the internet. This is the first line of defense, filtering all traffic entering or leaving the company’s network. Most organizations start here.
- Internal (segmentation) firewalls are placed between different zones inside your network. For example, you might separate your finance department’s systems from your general office network, or isolate a database server from front-end applications. If an attacker gets past the perimeter, segmentation firewalls limit how far they can move laterally.
- Host-based firewalls run directly on a user’s device and work at the operating system level to control traffic for that single machine. They’re especially useful for protecting remote employees or devices that connect to networks outside your control.
- Cloud-based firewalls protect infrastructure hosted in cloud environments like AWS, Azure, or Google Cloud. They are built to handle the elasticity of cloud workloads, scaling up or down as traffic demands change. For organizations running hybrid setups, cloud-based firewalls cover what perimeter hardware can’t reach.
As you might guess, the strongest setups combine several of these positions. A perimeter firewall catches broad threats at the edge, segmentation firewalls contain damage internally, host-based firewalls protect individual endpoints, and cloud-based firewalls extend coverage to off-premises infrastructure.
How exactly does a firewall protect data?
Data on your private network requires protection from external attackers. This applies whether data is held locally on company servers or stored in cloud containers. And the first step in protecting data is adding firewall filters to screen out malicious actors.
Firewall security can block a wide range of cyber threats and reduce the risks posed by others:
- Denial-of-service. Distributed denial-of-service (DDoS) attacks mobilize huge quantities of bots to flood targeted systems with more traffic or requests than they can handle. As the volume of incoming connections overwhelms the server’s capacity, legitimate users can no longer get through, and the target is eventually taken offline. Smart firewalls protect your network by detecting DDoS floods before an attack becomes critical, reducing the risk of downtime and damage to network resources.
- Spam. Spam can also flood network users with useless messages or, worse, malicious software. These links can lead to malware infections and ransomware attacks. Both threats can cripple network operations. A good firewall will filter spam from legitimate traffic and screen emails before users can click on dangerous links.
- Backdoors. Important network applications or operating systems may include backdoors that allow unauthorized access. These loopholes can lead to application hijacking and data theft. Companies often fail to apply patches as backdoors are identified. Firewalls defend your network by screening out unverified users. This makes it far more difficult for hackers to gain access to compromised apps.
- Remote hijackings. Sometimes, third parties may gain remote access to network devices. This is usually a legitimate task for maintenance purposes. But hackers can also gain remote access via partner organizations or poorly secured remote work tools. Firewalls check device data, adding an extra set of filters. This should make it harder to capture devices remotely.
- Viruses. Viruses arrive on an internal network via conventional traffic and can sometimes be hard to spot. But firewalls can use deep packet inspection to look for malicious code. Applying deep inspection is therefore advisable for high-priority devices. However, firewalls do not ensure total virus protection. Robust anti-malware and antivirus protection are also vital.
- Macros. Macros are scripts used with Microsoft Office applications like Word and Excel. When launched, macros can spread well beyond Microsoft apps, compromising entire networks. They are usually transmitted as email attachments. So if firewalls have email filters, they provide a degree of protection.
As the list above suggests, firewalls play a crucial role in protecting data. But firewall filtering alone is not a solution. It is just part of an effective network security system.
Companies must combine an effective firewall appliance with virus scanners, threat intelligence, data prevention tools, encryption, and identity and access management (IAM) systems.
Firewall vs. router: what’s the difference?
A router and a firewall handle two very different jobs, even though they both work at the network level. A router directs traffic, finding the fastest path to move data packets from one network to another, and enables devices to share resources, such as files or printers, across networks. Unlike a firewall, however, a router doesn’t protect the network from threats. Only a firewall evaluates and filters that traffic, deciding whether each packet should be allowed through based on a set of security rules.
What can’t a firewall protect against?
Even though firewalls are powerful, they still have blind spots, so knowing where they fall short is important to know, so you can reinforce your cybersecurity with adequate tools complementing your firewall.
For one, a firewall doesn’t judge intent. It evaluates packets based on headers, rules, and patterns, but it can’t tell whether a legitimate-looking source is real. Techniques like IP spoofing, where an attacker forges a trusted IP address can slip past filters because the packet technically meets the criteria. Social engineering attacks fall into the same gap: a phishing email that tricks a user into clicking a malicious link looks like normal traffic to the firewall, since the connection itself isn’t breaking any rules. Firewalls also can’t protect against newly released threats that haven’t been cataloged yet, because there are no known signatures or patterns to match against.
A firewall also only sees traffic that crosses it. If data moves between devices on the same internal network segment and never passes through the firewall, it goes completely unchecked. By assuming that everything is safe within a perimeter, the company stands vulnerable to insider threats such as malicious actions, data theft, or unauthorized access by employees or other trusted accounts.
Similarly, once a connection is permitted, the firewall trusts the traffic flowing through it (unless it’s a next-generation firewall performing deep inspection). A user browsing an approved website can still download an infected file, which is why antivirus and endpoint protection are still necessary alongside a firewall.
Finally, a misconfigured or unpatched firewall becomes a vulnerability itself. Outdated firmware, overly permissive rules, or default credentials can turn a line of defense into an entry point. Regular audits, updates, and rule reviews are what keep it effective.
How can I set up a firewall for my business?
A firewall’s effectiveness depends on careful design, as poorly chosen and configured firewalls can pose a security risk. So make sure to choose a provider that offers flexible firewall solutions
Once you’ve selected a firewall, start by defining a default deny policy, where all traffic is blocked unless a rule explicitly allows it. From there, build your rule base around what your business actually needs. For example, a company running a public web application might allow inbound TCP traffic on ports 80 and 443 to its web servers while blocking everything else. A business handling sensitive customer data could set up internal segmentation rules that isolate its payment processing servers from the rest of the corporate network, limiting access to a handful of authorized IPs.
Additionally, take into consideration that you may need to protect hybrid cloud deployments, IaaS environments, or predominantly on-premises networks. That’s why firewalls may need to screen large communities of remote workers or third parties. And you may need different firewall solutions for departments or branches.
Balance speed, cost, and security tools to protect your network, and plan your firewall to scale as your organization changes. What works now may not work with multinational locations or accelerated cloud transformations.