What Is a Firewall?
A firewall guards the entry point to a network. It examines all incoming and outgoing data packets based on established security rules to ensure only authorized traffic passes through. This protects internal information from unauthorized access and prevents cyber threats like malware, viruses, and denial-of-service attacks from entering or leaving the network.
Firewalls come in hardware devices and software, including the Windows Firewall Control Panel and Unix/Linux firewalls. Each has its own unique set of features. Some are a foundational protection like packet filtering, while others include advanced technologies like artificial intelligence (AI) and automation to stop sophisticated attacks in real time.
The basic capabilities of a firewall are pretty well established: it looks at each data packet and based on pre-defined security rules allows it, drops it, or discards it. Some more advanced firewalls also evaluate each packet on a case-by-case basis and keep a record of its behavior over time to make more precise and effective decisions about which access requests are allowed or denied.
Typically, a firewall will examine each data packet for certain characteristics like which ports it uses and which applications it is associated with. It may also check for known pattern patterns that indicate potential threats. NGFWs are more sophisticated and apply more context to analyze data, such as application context, user identity, and other factors.
Firewalls can also act as proxies that intercept and filter communication between two systems. This is particularly useful for enhancing security when working with remote or third parties.