NexusSec.How a firewall works
Every piece of data crossing a network is broken into packets, each carrying a source address, a destination address, a port number and a payload. A firewall inspects these packets and compares them against its rule set — its policy — then takes one of three actions: allow, deny (silently drop), or reject (drop and notify the sender).
The rules are evaluated in order, top to bottom, and the first match wins. Most firewalls end with an implicit "deny everything else", which is why a properly designed policy explicitly permits only what is needed.
The generations of firewall
1. Packet-filtering firewalls
The earliest type. They examine each packet in isolation against source and destination addresses and ports. Fast, but they have no memory — they cannot tell whether a packet belongs to a legitimate ongoing conversation.
2. Stateful inspection firewalls
These track the state of active connections. If your computer initiates a request to a web server, the firewall remembers that and allows the reply back — while blocking an unsolicited inbound packet pretending to be a reply. This is the baseline expectation for any firewall today.
3. Next-generation firewalls (NGFW)
NGFWs add application awareness (recognising that traffic is a specific application regardless of the port it uses), user identity awareness, integrated intrusion prevention, TLS/SSL inspection, and threat-intelligence feeds. This is what businesses deploy in 2026 — see our NGFW vs UTM explainer.
4. Web application firewalls (WAF)
A different category. A WAF sits in front of a web application and inspects HTTP requests specifically, blocking attacks such as SQL injection and cross-site scripting. A WAF complements a network firewall; it does not replace it.
Hardware, software and cloud firewalls
| Type | Where it runs | Typical use |
|---|---|---|
| Hardware appliance | Dedicated device at the network edge | Protecting an office or data centre perimeter |
| Software / host firewall | On the endpoint or server itself | Protecting an individual machine |
| Virtual firewall | As a VM in a hypervisor | Virtualised data centres, segmentation between VMs |
| Cloud firewall | Delivered as a service | Cloud workloads and distributed users |
What a firewall protects against
- Unauthorised inbound access to internal systems and services
- Exposure of services that should never face the internet, such as RDP or database ports
- Known attack patterns, via integrated intrusion prevention
- Access to malicious or inappropriate destinations, via web and DNS filtering
- Lateral movement between network segments, when segmentation is configured
What a firewall does not protect against
Why configuration matters more than brand
In the assessments we run, the majority of firewall weaknesses are not product flaws. They are overly permissive "any-any" rules added during troubleshooting and never removed, intrusion prevention left in monitor-only mode, TLS inspection never enabled, no segmentation between user and server networks, and firmware years out of date.
A mid-range firewall configured and maintained properly provides far better protection than a flagship appliance running defaults. If your rule base has never been reviewed, a firewall audit is usually the highest-value place to start.
The bottom line
A firewall enforces which traffic is allowed to cross a network boundary. Modern next-generation firewalls understand applications, users and content rather than just ports and addresses. They are an essential control — but they work alongside endpoint protection, patching, multi-factor authentication and segmentation, not instead of them.