What Does a Firewall Do?
Firewalls block unauthorized traffic to PCs, protecting data from theft or damage. They also help mitigate insider risks by detecting suspicious applications and preventing data exfiltration. Some are physical hardware appliances that plug into a network, while others are software running in the cloud or in virtual servers on-premises.
A firewall looks at each packet of information as it enters a network or leaves it, determining if it should be accepted and allowed to continue or if it should be denied or dropped. The decision is made based on rules — often a series of technical statements known as a “firewall policy” — that tell the firewall what to do.
Those rules can be based on criteria like IP addresses, protocols and ports, as well as specific packet-level details. Some firewalls take a more sophisticated approach to security by looking at the context of an entire session, a technique called stateful inspection. This can be more accurate and secure than simply evaluating individual packets, but can slow down networks and consume bandwidth.
Some firewalls also use threat intelligence to detect malicious patterns, blocking them in real time. They can also detect encrypted traffic and apply Zero Trust policies across the network, ensuring that only trusted sources get through. Some, such as pfSense, provide advanced capabilities like deep packet inspection (DPI) to look at the contents of each packet, intrusion prevention systems that detect exploits in real time and prevent malware from spreading within your network and advance threat protection for zero-day attacks and ransomware.