How Firewalls Work: Network Security Explained

How Firewalls Work: The First Line of Network Defense

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Acting as a barrier between a trusted internal network and untrusted external networks (such as the internet), firewalls are one of the oldest and most fundamental components of network security infrastructure. The concept was first developed in the late 1980s, and today virtually every organization and most consumer internet connections employ some form of firewall protection.

Firewalls examine each network packet — the basic unit of data transmitted over a network — and decide whether to allow or block it based on a set of rules. The sophistication of this examination has evolved dramatically over four decades, from simple packet filtering to deep application-layer inspection powered by artificial intelligence.

How Network Traffic Works

To understand firewalls, it is essential to understand the basics of network communication. Data transmitted over the internet is broken into packets, each containing:

• Source IP address: The address of the sending device
• Destination IP address: The address of the intended recipient
• Source port: The port number on the sending device
• Destination port: The port number on the receiving device (e.g., port 80 for HTTP, port 443 for HTTPS)
• Protocol: The communication protocol (TCP, UDP, ICMP)
• Payload: The actual data being transmitted

Firewalls use some or all of this information to make filtering decisions.

Types of Firewalls by Filtering Method

Packet Filtering Firewalls

The simplest and oldest type, packet filtering firewalls examine the header information of each packet and compare it against a set of rules (access control lists, or ACLs). A rule might specify: "Allow all TCP traffic from any source to destination port 443 (HTTPS)" or "Deny all traffic from IP address range 10.0.0.0/8." Packet filters are fast because they examine only header information, but they cannot detect malicious content within allowed traffic or track the state of connections.

Stateful Inspection Firewalls

Developed in the early 1990s by Check Point Software, stateful inspection firewalls maintain a state table that tracks all active network connections. When a packet arrives, the firewall checks whether it belongs to an already-established, legitimate connection. This approach is significantly more secure than simple packet filtering because it can:

• Distinguish between legitimate response packets and unsolicited incoming traffic
• Detect packets that do not match any known connection state (and block them)
• Track TCP handshake sequences to prevent certain types of spoofing attacks

Application-Layer Gateways (Proxy Firewalls)

Proxy firewalls operate at the application layer (Layer 7 of the OSI model), acting as an intermediary between the internal network and external servers. When an internal user requests a web page, the proxy firewall makes the request on behalf of the user, receives the response, inspects it for threats, and forwards it. This complete interception allows deep inspection of application data but introduces additional latency.

Next-Generation Firewalls (NGFWs)

Next-generation firewalls combine traditional firewall capabilities with advanced features:

• Deep packet inspection (DPI): Examines the full content (payload) of network packets, not just headers, enabling detection of malware, data exfiltration, and policy violations
• Application awareness and control: Identifies and controls traffic by application (e.g., distinguishing Skype from general web traffic) regardless of port or protocol
• Integrated Intrusion Prevention System (IPS): Actively detects and blocks known attack signatures and anomalous behavior in real time
• Threat intelligence feeds: Real-time updates from global threat intelligence networks enable the firewall to block newly discovered malicious IP addresses, domains, and attack patterns
• TLS/SSL inspection: Decrypts encrypted traffic to inspect its contents, then re-encrypts and forwards it — essential because over 90% of web traffic is now encrypted

Firewall Deployment Models

How Firewall Rules Work

Firewall rules define the policy that determines which traffic is permitted and which is blocked. Rules are evaluated in order (top to bottom), and the first matching rule is applied. A typical rule set includes:

• Allow rules: Permit specific types of traffic (e.g., allow HTTPS outbound to any destination)
• Deny rules: Block specific types of traffic (e.g., deny all inbound traffic from known malicious IP ranges)
• Default deny (implicit deny): Best practice dictates that the final rule in any firewall policy should deny all traffic not explicitly permitted — the principle of least privilege applied to network access

Example of a simplified firewall rule set:

• Rule 1: Allow TCP destination port 443 (HTTPS) outbound — employees can browse secure websites
• Rule 2: Allow TCP destination port 25 (SMTP) from mail server only — only the mail server can send email
• Rule 3: Allow TCP destination port 22 (SSH) from IT admin subnet only — restrict remote management access
• Rule 4: Deny all other traffic (default deny)

Firewall Limitations

While firewalls are essential, they are not a complete security solution:

• Encrypted traffic: Standard firewalls cannot inspect encrypted (HTTPS/TLS) traffic without SSL inspection capabilities. This means malware delivered over encrypted connections may bypass the firewall
• Insider threats: Firewalls primarily protect against external threats. Malicious or compromised insiders operating within the trusted network may not trigger firewall rules
• Zero-day attacks: Signature-based detection cannot identify previously unknown attacks. Behavioral analysis and AI-based detection help but are not foolproof
• Application vulnerabilities: A firewall may allow traffic to a legitimate web server, but it cannot protect against vulnerabilities in the web application itself (SQL injection, cross-site scripting)
• Misconfiguration: Firewall rules that are too permissive, outdated, or incorrectly ordered are a common source of security gaps. Firewall management and regular auditing are critical

Evolution of Firewall Technology

• Late 1980s: First packet filtering firewalls developed (DEC, AT&T Bell Labs)
• 1991: Application-layer proxy firewalls introduced (DEC SEAL)
• 1993: Check Point introduces stateful inspection technology
• 2004–2007: Next-generation firewalls emerge, combining IPS, application control, and deep packet inspection (Palo Alto Networks, Fortinet)
• 2010s: Cloud firewalls and Firewall-as-a-Service models proliferate alongside the migration to cloud computing
• 2020s: AI/ML-enhanced firewalls that automatically detect anomalous patterns and adapt to evolving threats

Firewalls in the Zero Trust Architecture

Modern network security is shifting toward a Zero Trust model, which assumes no user or device — inside or outside the network — should be automatically trusted. In a Zero Trust architecture, firewalls remain important but are supplemented by identity verification, microsegmentation (isolating workloads from each other), continuous monitoring, and least-privilege access controls at every layer. The firewall evolves from a single perimeter gatekeeper into a distributed enforcement mechanism embedded throughout the network.

Firewalls have evolved from simple packet filters into sophisticated, AI-powered security platforms that inspect traffic at every layer, enforce granular policies, and integrate with broader security ecosystems. As network architectures continue to evolve — with cloud computing, remote work, and IoT expanding the attack surface — firewalls remain an indispensable component of any defense-in-depth security strategy.