A firewall decides which traffic may pass between two network zones and which must be blocked. Put like that it sounds simple, but firewalls differ widely: they look at different information and work at different points in the infrastructure. Choosing the right type and writing clear rules matters more than the product you buy.
Where the firewall sits
- Network firewall: a device, or a router feature, that filters traffic between networks, for example between the Internet and the LAN, or between the guest network and the work devices.
- Host firewall: an operating system component that filters traffic for a single computer or server, such as Windows Defender Firewall, nftables or firewalld on Linux, or the macOS application firewall.
- Cloud firewall: security groups and network rules offered by cloud providers, applied to individual virtual machines or virtual networks.
These defences are not mutually exclusive: a network firewall protects the whole, a host firewall protects each machine even when another machine on the same network is compromised.
How firewalls think
Stateless filtering
The simplest filters examine each packet on its own, looking at source and destination addresses, protocol and ports. They are fast but limited: to let replies to an outbound connection through, you also have to open the return traffic explicitly, often with overly broad rules.
Stateful inspection
A stateful firewall keeps track of active connections. When an internal computer opens a connection to a server, the firewall records the session and automatically lets the replies through. Everything else inbound is dropped. This is the standard behaviour of almost every modern firewall, including those in home routers.
Next-generation firewalls
So-called NGFWs add application identification regardless of port, integration with corporate directory users, intrusion prevention systems and website category filtering. To inspect encrypted traffic, however, they have to decrypt it, which means installing a certificate on every device and raises privacy questions.
Web Application Firewall
A WAF works at the HTTP level in front of a website or application. It recognises typical attack patterns in requests, such as SQL injection or script injection attempts, and can rate-limit clients. It does not replace a well-written application, but it reduces the exposed surface.
Writing effective rules
Start from default deny
The most solid policy is to deny everything that is not explicitly allowed. For inbound traffic from the Internet this is almost always the starting point. For outbound traffic many home networks allow everything, while in a business setting it pays to restrict it at least for servers, which rarely need unrestricted Internet access.
Order matters
In most firewalls rules are evaluated from top to bottom and the first match applies. A generic rule placed too high makes the specific ones below it useless.
An example of an ordered set for a small web server:
| No. | Source | Destination | Port | Action | Note |
|---|---|---|---|---|---|
| 1 | Any | Server | 443/TCP | Allow | HTTPS site |
| 2 | Any | Server | 80/TCP | Allow | HTTPS redirect only |
| 3 | Admin VPN network | Server | 22/TCP | Allow | Remote management |
| 4 | Server | DNS and update servers | 53, 443 | Allow | Required outbound |
| 5 | Any | Any | Any | Deny and log | Final rule |
Readable, documented rules
- Give every rule a description explaining why it exists and, if possible, who requested it.
- Use address and service groups or aliases instead of repeating the same values.
- Avoid "any to any" rules created for a test and never removed.
- Review the set periodically and delete what is no longer needed.
Logging without drowning
Log blocked connections on the final rules and allowed connections to critical services. Logging everything produces huge volumes nobody reads; logging nothing leaves you without information when you need to reconstruct an event.
Common mistakes
- Exposing admin panels: management interfaces of routers, NAS units or servers reachable from the Internet are among the most frequent targets. Make them accessible only from the internal network or through a VPN.
- Forgetting IPv6: careful IPv4 rules and no IPv6 rules leave a side door open.
- Relying only on the perimeter firewall: a compromised device inside the network bypasses the perimeter. Segment networks and use host firewalls too.
- Opening huge port ranges to make an application work whose requirements nobody knows.
In short
- There are network, host and cloud firewalls: use them together, not as alternatives.
- Stateful firewalls let replies through and block unsolicited inbound connections.
- Start from default deny and allow only what is needed, in a deliberate order.
- Document every rule, review the set and log with judgement.
- Do not expose admin interfaces and do not forget IPv6.
