Firewall: Working System and Purpose

Firewall: Working System and Purpose

What is a Firewall?

A firewall is a network security device or software application that monitors, filters, and controls incoming and outgoing network traffic based on predefined security rules. It acts as a barrier between a trusted internal network and untrusted external networks, such as the Internet, protecting systems from unauthorized access, cyberattacks, and malicious traffic.

Think of a firewall as a security guard at the entrance of a building. It checks everyone entering or leaving and allows only authorized people while blocking intruders.

How a Firewall Works

A firewall examines every data packet traveling through a network and decides whether to:

• Allow the traffic
• Block the traffic
• Log the activity for monitoring
• Alert administrators if suspicious activity is detected

The firewall uses security policies and rules based on factors such as

• Source IP address
• Destination IP address
• Port number
• Protocol (TCP, UDP, ICMP)
• Application type
• Website or domain
• User identity

Packet Filtering Process

Incoming Data Packet

         │

         ▼

 Check Firewall Rules

         │

  ┌──────┴──────┐

  │             │

Allowed?      Blocked?

  │             │

  ▼             ▼

Send to      Discard Packet

Destination   Generate Log

Types of Firewalls

1. Packet Filtering Firewall

• Inspects individual data packets.
• Checks IP addresses, ports, and protocols.
• Fast and efficient.
• Limited protection against advanced attacks.

Advantages

• High performance
• Low cost
• Easy implementation

Disadvantages

• Cannot inspect packet contents deeply
• Vulnerable to sophisticated attacks

2. Stateful Inspection Firewall

Maintains information about active network connections.

Instead of checking every packet independently, it tracks the entire communication session.

Features

• Better security
• Faster than application filtering
• Detects suspicious connections

3. Proxy Firewall

Acts as an intermediary between users and the Internet.

Instead of users connecting directly to websites, they communicate through the firewall.

Benefits

• Hides internal IP addresses
• Prevents direct communication
• Filters web traffic

4. Next-Generation Firewall (NGFW)

An advanced firewall combining traditional filtering with modern security features.

Features

• Deep Packet Inspection (DPI)
• Intrusion Prevention System (IPS)
• Antivirus scanning
• Malware detection
• Application awareness
• URL filtering
• SSL/TLS inspection

5. Cloud Firewall

A firewall hosted in the cloud to protect cloud-based applications and services.

Suitable for:

• Cloud computing
• Hybrid networks
• Remote workforce

Firewall Deployment Types

Hardware Firewall

A dedicated physical device installed between the Internet and the internal network.

Suitable for

• Enterprises
• Data centers
• Offices
• Schools

Software Firewall

Installed directly on computers or servers.

Examples:

• Windows Defender Firewall
• Linux iptables/nftables
• macOS Firewall

Cloud Firewall

Protects cloud resources without requiring physical hardware.

Purpose of a Firewall

1. Prevent Unauthorized Access

Blocks hackers from accessing private networks.

2. Protect Sensitive Data

Safeguards confidential information such as

• Customer records
• Financial data
• Medical records
• Employee information

3. Block Malware

Stops malicious software including:

• Viruses
• Worms
• Trojans
• Spyware
• Ransomware

4. Monitor Network Traffic

Logs all network activity to help administrators identify suspicious behavior.

5. Control Internet Usage

Organizations can restrict access to

• Social media
• Gaming websites
• Streaming platforms
• Unauthorized applications

6. Prevent Cyber Attacks

Helps defend against

• Denial-of-Service (DoS)
• Distributed Denial-of-Service (DDoS)
• Port scanning
• Unauthorized login attempts
• Exploitation attempts

7. Enforce Security Policies

Ensures users follow organisational security rules regarding network access.

Advantages of Firewalls

• Protects against unauthorised access
• Reduces cyberattack risks
• Controls network traffic
• Supports compliance with security standards
• Provides activity logging and monitoring
• Improves network security
• Protects sensitive business information

Limitations of Firewalls

• Cannot stop attacks that bypass network controls (e.g., infected USB drives).
• May not prevent insider threats.
• Cannot protect against weak passwords on its own.
• Requires regular updates and proper configuration.
• Advanced attacks may require additional security tools.

Firewall vs Antivirus

Common Firewall Use Cases

Home Networks

• Protect home Wi-Fi
• Secure smart devices
• Block unauthorized access

Small Businesses

• Secure office networks
• Protect customer data
• Enable secure remote access

Enterprises

• Protect large corporate networks
• Segment departments
• Secure data centers
• Monitor thousands of users

Cloud Environments

• Protect virtual machines
• Secure cloud applications
• Control access to cloud resources

Best Practices

• Enable the firewall on all devices.
• Keep firewall software and firmware updated.
• Use the principle of least privilege when creating rules.
• Review firewall logs regularly.
• Combine firewalls with antivirus, intrusion detection/prevention systems (IDS/IPS), and multi-factor authentication (MFA).
• Remove unused or outdated firewall rules.

Conclusion

A firewall is a fundamental component of cybersecurity that protects networks by inspecting and controlling traffic according to security policies. Whether deployed as hardware, software, or a cloud service, firewalls help prevent unauthorized access, reduce cyber risks, enforce organizational security policies, and protect valuable data. While essential, they are most effective when used as part of a layered security strategy that includes antivirus, endpoint protection, regular updates, backups, and user awareness training.