What Are Firewalls (computing)?

Firewalls, in computing, are devices or software programs that control the flow of network traffic between networks or hosts operating at different levels of trust. They enforce access control policies by examining packets and deciding whether to permit or block them based on rules derived from addresses, ports, protocols, and application state. Firewalls are a foundational countermeasure in computer network security, positioned at the boundary between trusted internal networks and untrusted external networks such as the internet, as well as between segments within an organization's own infrastructure. The NIST Special Publication 800-41 Rev. 1 provides detailed guidance on firewall technologies, policy development, and deployment practices.

Firewalls operate within a broader layered security architecture that includes intrusion detection systems, encryption, and authentication. No single firewall configuration eliminates all network risk, but properly configured firewalls reduce the attack surface by blocking unauthorized access attempts and limiting lateral movement within a network after a breach.

Packet Filtering and Stateful Inspection

The earliest firewall implementations used packet filtering, examining each network packet in isolation against a set of rules based on source and destination IP addresses, TCP/UDP port numbers, and protocol type. Packet filters are computationally efficient but stateless: they cannot distinguish between a new connection and one that has already been established, which limits their ability to detect certain attack patterns. Stateful inspection firewalls address this limitation by tracking the state of each active connection in a state table. Packets are evaluated in the context of their connection, so only packets that correspond to an established, expected session are permitted through. Stateful inspection is now the baseline capability for most network firewalls. The NIST guidelines note that stateful inspection firewalls "improve on the capabilities of packet filters by tracking the state of connections and blocking packets that deviate from the expected state."

Application-Layer and Unified Threat Management Firewalls

Application-layer firewalls, sometimes called proxy firewalls, operate at the top layer of the network model, examining the content of communications rather than just header information. By understanding specific application protocols such as HTTP, DNS, and SMTP, these firewalls can detect malformed requests, enforce protocol compliance, and block attacks that exploit application-layer vulnerabilities, as described in IEEE research on network security architectures. Unified threat management firewalls integrate packet filtering, stateful inspection, and application awareness into a single platform, often adding capabilities such as deep packet inspection, SSL/TLS decryption, and integration with threat intelligence feeds. Host-based firewalls, implemented as software running directly on a server or workstation, provide a second layer of control that operates independently of network-level perimeter defenses.

Firewall Policy and Management

A firewall policy defines how an organization's firewalls should handle inbound and outbound traffic for specific addresses, ports, and application types, in accordance with the organization's information security objectives. Policy design requires balancing access requirements against risk: overly restrictive rules impede legitimate business functions, while overly permissive rules leave systems exposed. Rule sets are evaluated in order, with the most specific rules placed before general ones. Regular auditing of rule sets is necessary because accumulated rules from past projects can create gaps or unintended permissions over time. The NIST Cybersecurity Framework and related guidance help organizations align firewall governance with broader information security program objectives.

Applications

Firewalls in computing have applications across a wide range of network environments, including:

• Enterprise perimeter defense separating internal networks from the public internet
• Data center segmentation isolating application tiers from each other
• Industrial control system protection separating operational technology from corporate IT networks
• Cloud infrastructure access control enforcing least-privilege connectivity between virtual resources
• Home networks providing basic protection for consumer devices against unsolicited inbound connections