Firewall is one of those words everyone's heard but many people don't actually know what it does. The simplest definition: a firewall is a digital gatekeeper that sits between your network and the outside world (or between two different segments of a network) and, based on predefined rules, decides which traffic is allowed through and which should be blocked.
Why do we even need a firewall?
Without a firewall, any device on the internet could connect directly to any open port on your network's servers and computers — exactly like a building with no door, where anyone off the street can walk straight into any room. A firewall controls these entry points and only lets through the traffic that's actually needed (e.g., web requests to the company server).
Main types of firewalls
Packet-Filtering Firewall: the simplest type — decides based on source/destination IP address and port number (similar to the ACLs covered in my Cisco tutorials — an ACL is, in fact, a simple form of firewall).
Stateful Firewall: on top of address and port, it also tracks connection state — e.g., it knows whether a packet is a reply to a legitimate request or a new, unwanted connection.
Next-Generation Firewall (NGFW): on top of all the above, it inspects the actual content of packets (Deep Packet Inspection) and can even identify and block a specific application (like an unauthorized messenger or VPN) — products like Palo Alto and Fortinet fall in this category.
Web Application Firewall (WAF): specifically protects web applications against attacks like SQL Injection and XSS — a different layer from a typical network firewall.
Software firewall vs. hardware firewall
A firewall can be a dedicated physical device (like a Cisco or Fortinet appliance installed at the organization's network entry point), or software running on a computer itself (like Windows Defender Firewall) that only protects that one device. In a well-designed enterprise network, both layers are usually used together — defense in depth.
A practical firewall rule example
Say you want to allow only IT department employees to remotely connect (via SSH) to internal servers. A typical firewall rule would look like:
Source: IT subnet (e.g., 192.168.10.0/24)
Destination: internal servers
Port: 22 (SSH)
Action: Allow
followed by a default rule at the end that denies everything else — exactly the same logic we saw in my Cisco ACL tutorial.
Why is understanding firewalls essential?
A firewall is the first and most fundamental layer of defense in any network — before antivirus, before intrusion detection systems, it's the firewall that decides what traffic even gets in the door in the first place. Mastering the firewall concept and configuration is a core part of any network security learning path — from CCNA to CEH — fully covered in my courses.
Blog